AADSTS70008 — "The provided authorization code or refresh token has expired due to inactivity. Send a new interactive authorization request for this user and resource." Unlike revocation (AADSTS50173), this is simple ageing: the refresh token was not used within its inactivity window (90 days is the default maximum inactive time), or an authorization code was redeemed too late.
AADSTS70008
Refresh token expired due to inactivity
What it means
Common causes
A device or app was offline/unused for months and tries to resume with its old refresh token — seasonal workers, shelved laptops, kiosk devices.
An authorization code was not redeemed promptly (codes are valid only minutes) — usually a coding or queuing flaw.
Long-running background services relying on a user's refresh token instead of an application identity.
How to fix it
Trigger an interactive sign-in on the affected client; that mints a fresh grant.
Redeem authorization codes immediately upon receipt in your auth code flow implementation.
Re-platform unattended workloads onto client credentials or managed identities so nothing depends on a user token staying warm.