# Error: InvalidAuthenticationToken: token expired (Microsoft 365)

Source: https://catalystgroup.gg/docs/email-delivery/error-invalid-authentication-token/
Updated: 2026-10-19 · By Duane Garner

Microsoft Graph rejected the access token the plugin sent. Usually the server clock is off or a cached token is stale.

This article is for sites using the **365 / Outlook** mailer (Microsoft 365 through Microsoft Graph) where a send fails with `InvalidAuthenticationToken`.

 

> **The error as you see it:** `InvalidAuthenticationToken: Access token has expired or is not yet valid.`
>  
> Shown by the **365 / Outlook** mailer, in the failed-send banner, in **Tools → Debug Events** and in the **Email Log**.

 

## What this error means

 

The plugin signs in to Microsoft Entra ID with your **Tenant ID**, **Application (Client) ID** and **Client Secret**, receives an access token that lasts about an hour, and keeps it until shortly before it expires. It then sends that token to Microsoft Graph with each email. This error means Graph looked at the token and refused it: by Graph's clock the token is out of date, not valid yet, or not meant for Graph. Getting a token worked, so your IDs and secret are probably fine.

 

## Common causes

 
- **The web server's clock is wrong.** If your server runs fast or slow, the plugin keeps a token longer than it should, or Graph sees one that appears to come from the future.
- **A stale token is stored** in WordPress (for example after restoring a database backup or copying the site), and an object cache keeps serving it.
- **The app registration changed** (permissions removed, app moved or deleted) after the token was issued.
- **A security policy in your tenant** shortened token lifetimes or revoked sessions.

 

## How to fix

 
1. Check the server clock
  In WordPress, **Settings → General** shows "Universal time". Compare it with the real UTC time. If it is more than a minute or two off, ask your host to turn on clock synchronisation (NTP).
2. Clear the cached token
  The plugin stores the token as a WordPress transient. Clear transients with your caching plugin, or with WP-CLI run `wp transient delete --all`. If you use a persistent object cache (Redis, Memcached), flush it too.
3. Check the app in Microsoft Entra
  Open `https://entra.microsoft.com/` and go to **Identity → Applications → App registrations → your app**. Under **API permissions**, make sure Microsoft Graph **Mail.Send** of type *Application* is listed with a green *Granted* status. If not, press **Grant admin consent**.
4. Re-save the settings
  In **CRM-NG SMTP → Settings → General**, confirm the **Tenant ID**, **Application (Client) ID** and **Client Secret** belong to that app, then press **Save Settings**.
5. Send a test
  Go to **CRM-NG SMTP → Tools → Email Test**, fill in **Send To** and press **Send Email**.

 

## Verify it worked

 

The test page shows "Test email sent successfully! Check your inbox to confirm delivery." The message also appears in the **Sent Items** folder of the From Email mailbox, because the plugin asks Graph to keep a copy there.

 

## Notes

 
- If the token request itself fails, the error starts with "Microsoft 365 token request failed:". That points to the IDs or secret instead; see [400 invalid_request](https://catalystgroup.gg/docs/email-delivery/error-400-invalid-request/) and [AADSTS50194](https://catalystgroup.gg/docs/email-delivery/error-aadsts50194-single-tenant/).
- Client secrets expire on the date you chose when creating them. An expired secret gives a token-request error, not this one, but put a reminder in your calendar anyway.

 

## Related

 
- [Microsoft 365 / Outlook](https://catalystgroup.gg/docs/email-delivery/mailer-microsoft-365/)
- [Error: 400 invalid_request (Microsoft 365)](https://catalystgroup.gg/docs/email-delivery/error-400-invalid-request/)
- [Error: ErrorSendAsDenied (Microsoft 365)](https://catalystgroup.gg/docs/email-delivery/error-send-as-denied/)
- [Troubleshooting email delivery](https://catalystgroup.gg/docs/email-delivery/troubleshooting/)