OAuth 2.0 Microsoft - Token error randomly

[rmarkwald]

All,

In preparation for SMTP AUTH getting turned off next year, I have set up the OAuth 2.0 (Microsoft) setting in the four Canon MFP's we currently have.  One machine, a Canon iR-ADV 529, will scan to email fine for about one week, then stops.  Remoting in shows a "token error", so we have to disable and enable the OAuth 2.0 function again, re-authenticate using the User Code, and it works...for about a week.  The other three machines do not do this and work without issue.

I know refresh tokens are valid for 90 days.  Does the MFP communicate with Office 365 before the 90-day mark to get a new token automatically, or will this require us to remote in to do these every 90 days?

Reaching out to our service vendor, they state "Not much else out there other than to redo it when it happens. I'm beginning to think it isn't a reliable service, but we have no control over it. Scan to Folder is the other option you can do."...I'm working with the remote site to further troubleshoot, but outside of this one MFP, I am starting to think something on-site could be an issue.

[Danny]

Thanks for joining the conversation, rmarkwald!

While our forum community members are welcome to chime in, Canon does not provide direct support for imageRUNNER series products. Instead, your dealer will be able to help you! If you don't have a dealer and you're in the United States, please call us at 1-800-OK-CANON (1-800-652-2666) and we will be happy to provide you with the names of dealers in your area.

If you're outside the USA, visit http://global.canon and choose your country or region from the map for local support.

We hope this helps!

[bugmenotcanon]

Hi Mark,

I don't know if I've found the solution, but I think I know one or two things that might work.

1. As you pointed out, refresh tokens are valid for 90 days, and as far as I could see, those aren't configurable.  However, I found a post on the Microsoft forums saying "... you can configure the sign-in frequency in Conditional Access to define the time periods before a user is required to sign in again." This seems to suggest a possible work-around. What I did:
   1. Go to entra.microsoft.com then Identity > Applications > Enterprise Applications
   2. Find & click "Application for Sending E-mail..." then click "Conditional Access" in the sidebar
   3. "New policy" at the top > click "0 controls" under Session > Type a name (ex: extended-login)
   4. Check Sign-in frequency > type a number and choose Days in the drop-down > click Select
   5. Click On at the bottom for "Enable policy" and then click Create
   6. In theory, now you'll just need to authenticate the printers once a year
       
2. One of the first things I looked at was to compare OAuth Enterprise App configuration for the printers vs another app I have for OAuth for my Service Desk to send emails. When you find the printer app in sub-step 2 above, right under Conditional Access is Permissions - when you go there, there aren't any permissions listed. However, my Service Desk's KB article advised me to add the following permissions for the app. 
   However, this also has a "companion" app on portal.azure.com where I had to create a certificate that I then copied details from into the Service Desk config.  I set this cert to have a 2-year expiration.  I don't think Canon's config has anything that we can add these details to, so I'm not sure how viable this idea is, and I wasn't keen in adding permissions without verifying that they're necessary. Anyway, the permissions from the other app are shown in the table below if you want to play with them.  If I find anything else, I may update this again.

API name	Claim value	Permission	Type	Granted through	Granted by
Microsoft Graph	offline_access	Maintain access to data you have given it access to	Delegated	Admin consent	An administrator
Microsoft Graph	User.Read	Sign in and read user profile	Delegated	Admin consent	An administrator
Microsoft Graph	IMAP.AccessAsUser.All	Read and write access to mailboxes via IMAP.	Delegated	Admin consent	An administrator
Microsoft Graph	POP.AccessAsUser.All	Read and write access to mailboxes via POP.	Delegated	Admin consent	An administrator
Microsoft Graph	SMTP.Send	Send emails from mailboxes using SMTP AUTH.	Delegated	Admin consent	An administrator
Microsoft Graph	Mail.ReadWrite	Read and write access to user mail	Delegated	Admin consent	An administrator

[rmarkwald]

Thank you for this information!  I do appreciate it!

[Jkirby555]

Hi rmarkwald,

Did either of these solutions work for you?

[rmarkwald]

I read over bugmenotcanon's post, and did not perform either option at this time.  We just did an office move and I had to re-authenticate the Canon, but it only required me to re-authenticate it one other time which was after some bad weather and the building lost power.  It seems to happen occasionally, not enough at the moment to dig further, but it is on my radar to look into more when I have time.  We still use OAuth 2.0 on it currently.

[bend1]

We have this exact same issue on our Canon  iR-ADV C357 printers. The OAuth2.0 randomly expires. It will say "token error". The "user code" always seems to be stuck until I got into the basic settings of the printer and then go back. It happens on different printers and different address locations. To fix the token error I have to go into the printer ----> Microsoft Oauth2.0 ---> click on "Edit..." (to edit Basic settings) ----> don't change anything and click "OK" (to bring back to Oauth2.0 Microsoft main page) --->  I click "refresh icon" and then the "user code" will change ----> Then I have to reauthorize the token and activate it

I've contacted our support rep and they said the printer's firmware is up to date and nothing much they can do. Kind of at a loss with this issue. 

[IP-KVD]

We have exactly the same issue at one office. 3 canon copiers, all identical models, all on the same firmware version recently updated by the vendor.

Two are good as gold, zero issues. Number 3 breaks every week

[SamanthaW]

Hi,

We definitely recommend reaching out to your dealer, because that sounds frustrating as heck! If you don't already have one, give our support team a call and they'll find one for you! 1-800-OK-CANON (1-800-652-2666), Monday to Friday, excluding holidays. 

Thanks for posting!