- Shipped
- September 16, 2026 at 9:52 PM UTC
- Author
- Kamo
- Commit
- c94150e
An org connected Microsoft 365 through Kamo's platform app; the platform app was later switched off and the org has no registration of its own. The resolver then found no client, the refresh went out with a blank client_id, and Microsoft answered AADSTS900144 — on every mailbox resolve, once a minute on both pods, for twelve days, while the access token stayed expired. A refresh with no enabled registration is no longer sent. That, and a token endpoint answering invalid_grant / invalid_client / unauthorized_client, flips the org's provider to ERROR — which the settings screen already turns back into the Connect button — warns once, and holds further attempts back for an hour. A later refresh that succeeds (the app re-enabled) puts the provider back to ACTIVE; reconnecting does so immediately. Transient failures keep the old warn-and-use- existing-token behaviour.