OAuth 2.0 Microsoft - Token error randomly

[rmarkwald]

All,

In preparation for SMTP AUTH getting turned off next year, I have set up the OAuth 2.0 (Microsoft) setting in the four Canon MFP's we currently have.  One machine, a Canon iR-ADV 529, will scan to email fine for about one week, then stops.  Remoting in shows a "token error", so we have to disable and enable the OAuth 2.0 function again, re-authenticate using the User Code, and it works...for about a week.  The other three machines do not do this and work without issue.

I know refresh tokens are valid for 90 days.  Does the MFP communicate with Office 365 before the 90-day mark to get a new token automatically, or will this require us to remote in to do these every 90 days?

Reaching out to our service vendor, they state "Not much else out there other than to redo it when it happens. I'm beginning to think it isn't a reliable service, but we have no control over it. Scan to Folder is the other option you can do."...I'm working with the remote site to further troubleshoot, but outside of this one MFP, I am starting to think something on-site could be an issue.

[Danny]

Thanks for joining the conversation, rmarkwald!

While our forum community members are welcome to chime in, Canon does not provide direct support for imageRUNNER series products. Instead, your dealer will be able to help you! If you don't have a dealer and you're in the United States, please call us at 1-800-OK-CANON (1-800-652-2666) and we will be happy to provide you with the names of dealers in your area.

If you're outside the USA, visit http://global.canon and choose your country or region from the map for local support.

We hope this helps!

[bugmenotcanon]

Hi Mark,

I don't know if I've found the solution, but I think I know one or two things that might work.

1. As you pointed out, refresh tokens are valid for 90 days, and as far as I could see, those aren't configurable.  However, I found a post on the Microsoft forums saying "... you can configure the sign-in frequency in Conditional Access to define the time periods before a user is required to sign in again." This seems to suggest a possible work-around. What I did:
   1. Go to entra.microsoft.com then Identity > Applications > Enterprise Applications
   2. Find & click "Application for Sending E-mail..." then click "Conditional Access" in the sidebar
   3. "New policy" at the top > click "0 controls" under Session > Type a name (ex: extended-login)
   4. Check Sign-in frequency > type a number and choose Days in the drop-down > click Select
   5. Click On at the bottom for "Enable policy" and then click Create
   6. In theory, now you'll just need to authenticate the printers once a year
       
2. One of the first things I looked at was to compare OAuth Enterprise App configuration for the printers vs another app I have for OAuth for my Service Desk to send emails. When you find the printer app in sub-step 2 above, right under Conditional Access is Permissions - when you go there, there aren't any permissions listed. However, my Service Desk's KB article advised me to add the following permissions for the app. 
   However, this also has a "companion" app on portal.azure.com where I had to create a certificate that I then copied details from into the Service Desk config.  I set this cert to have a 2-year expiration.  I don't think Canon's config has anything that we can add these details to, so I'm not sure how viable this idea is, and I wasn't keen in adding permissions without verifying that they're necessary. Anyway, the permissions from the other app are shown in the table below if you want to play with them.  If I find anything else, I may update this again.

API name	Claim value	Permission	Type	Granted through	Granted by
Microsoft Graph	offline_access	Maintain access to data you have given it access to	Delegated	Admin consent	An administrator
Microsoft Graph	User.Read	Sign in and read user profile	Delegated	Admin consent	An administrator
Microsoft Graph	IMAP.AccessAsUser.All	Read and write access to mailboxes via IMAP.	Delegated	Admin consent	An administrator
Microsoft Graph	POP.AccessAsUser.All	Read and write access to mailboxes via POP.	Delegated	Admin consent	An administrator
Microsoft Graph	SMTP.Send	Send emails from mailboxes using SMTP AUTH.	Delegated	Admin consent	An administrator
Microsoft Graph	Mail.ReadWrite	Read and write access to user mail	Delegated	Admin consent	An administrator

[rmarkwald]

Thank you for this information!  I do appreciate it!