Expired or invalid Token

[santisq]

Hi, I've attempted to run the assessment in our Tenant and I'm facing the the attached expired or invalid token error. This happened on 2 different runs and at approximately 6~ hours of running. When this happens, instead of terminating the loop, it gets stuck exporting the same Json file over and over.

[santisq]

The error points to this loop:

	do {
		$results = Invoke-MgGraphRequest -Method GET -Uri $uri -OutputType HashTable
		$currentCount = Export-Page -PageIndex $pageIndex -Path $folderPath -Results $results -RelatedPropertyNames $RelatedPropertyNames -EntityName $EntityName -EntityUri $EntityUri -CurrentCount $currentCount -TotalCount $totalCount -ProgressActivity $ProgressActivity -ShowCount:$ShowCount

		if (-not $results) {
			$uri = $null
		}
		else {
			$uri = $results.'@odata.nextLink'
		}
		$pageIndex++

		if (-not $uri) {
			break
		}
		elseif ($hasTimeLimit -and (Get-Date) -gt $stopTime) {
			Write-PSFMessage "Maximum time limit reached for $EntityName"
			break
		}
	}
	while ($true)

Which could be transformed to this using a try / catch:

    do {
        try {
            $results = Invoke-MgGraphRequest -Method GET -Uri $uri -OutputType HashTable -EA 1
            $uri = $results.'@odata.nextLink'

            if (-not $results.value) {
                break
            }

            $exportPageSplat = @{
                PageIndex            = $pageIndex
                Path                 = $folderPath
                Results              = $results
                RelatedPropertyNames = $RelatedPropertyNames
                EntityName           = $EntityName
                EntityUri            = $EntityUri
                CurrentCount         = $currentCount
                TotalCount           = $totalCount
                ProgressActivity     = $ProgressActivity
                ShowCount            = $ShowCount
            }
            $currentCount = Export-Page @exportPageSplat
            $pageIndex++

            if ($hasTimeLimit -and (Get-Date) -gt $stopTime) {
                Write-PSFMessage "Maximum time limit reached for $EntityName"
                break
            }
        }
        catch {
            # handle...
        }
    }
    while ($uri)

This would solve the problem of exporting the same page over and over... As for the token expired / invalid, it's confusing because Graph module is supposed to handle the token refresh internally tho that doesn't seem to be the case.

[merill]

Good call out. Definitely can be improved for the error handling.

Do you know if your PIM scope expired during that window? That could explain the token expiring and not being able to renew it.

[santisq]

Hi @merill, I had permanent Global Reader during my 2 test runs.