Azure / Azure/azure-powershell

Restore-AzApiManagement fails with token expired for longer operations

Open
#29,257 0 comments 0 reactions 0 assignees View on GitHub
bug customer-reported
Dominant language
C#
Stars
4.8k
Forks
4.3k
Avg merge
3d 14h
Merged PRs (30d)
54

Description

### Description

I ran the Restore-AzApiManagement but it failed ~55m into the backup with the attached error message. It seems that if the restore operations is taking longer than 1h, the Azure access token used for polling the operation status expires and causes this error.

### Issue script & Debug output

```PowerShell
An error has occurred that was not properly handled. Additional information is shown below. The PowerShell process will exit.
Unhandled exception. Azure.Identity.AuthenticationFailedException: ClientAssertionCredential authentication failed:
---> MSAL.CoreCLR.4.65.0.0.MsalServiceException:
ErrorCode: invalid_client
Microsoft.Identity.Client.MsalServiceException: A configuration issue is preventing authentication - check the error message from the server for details. You can modify the configuration in the application registration portal. See https://aka.ms/msal-net-invalid-client for details. Original exception: AADSTS700024: Client assertion is not within its valid time range. Current time: 2026-02-12T12:27:28.5018238Z, assertion valid from 2026-02-12T11:32:15.0000000Z, expiry time of assertion 2026-02-12T11:42:14.0000000Z. Review the documentation at https://learn.microsoft.com/entra/identity-platform/certificate-credentials . Trace ID: ed4179d7-e888-4c64-829f-10e91d489400 Correlation ID: db9212e2-203f-4f3c-a120-7457e95b2a95 Timestamp: 2026-02-12 12:27:28Z
at Microsoft.Identity.Client.OAuth2.OAuth2Client.ThrowServerException(HttpResponse response, RequestContext requestContext)
at Microsoft.Identity.Client.OAuth2.OAuth2Client.CreateResponse[T](HttpResponse response, RequestContext requestContext)
at Microsoft.Identity.Client.OAuth2.OAuth2Client.ExecuteRequestAsync[T](Uri endPoint, HttpMethod method, RequestContext requestContext, Boolean expectErrorsOn200OK, Boolean addCommonHeaders, Func`2 onBeforePostRequestData)
at Microsoft.Identity.Client.OAuth2.TokenClient.SendHttpAndClearTelemetryAsync(String tokenEndpoint, ILoggerAdapter logger)
at Microsoft.Identity.Client.OAuth2.TokenClient.SendHttpAndClearTelemetryAsync(String tokenEndpoint, ILoggerAdapter logger)
at Microsoft.Identity.Client.OAuth2.TokenClient.SendTokenRequestAsync(IDictionary`2 additionalBodyParameters, String scopeOverride, String tokenEndpointOverride, CancellationToken cancellationToken)
at Microsoft.Identity.Client.Internal.Requests.RequestBase.SendTokenRequestAsync(IDictionary`2 additionalBodyParameters, CancellationToken cancellationToken)
at Microsoft.Identity.Client.Internal.Requests.ClientCredentialRequest.GetAccessTokenAsync(CancellationToken cancellationToken, ILoggerAdapter logger)
at Microsoft.Identity.Client.Internal.Requests.ClientCredentialRequest.ExecuteAsync(CancellationToken cancellationToken)
at Microsoft.Identity.Client.Internal.Requests.RequestBase.<>c__DisplayClass11_1.<b__1>d.MoveNext()
--- End of stack trace from previous location ---
at Microsoft.Identity.Client.Utils.StopwatchService.MeasureCodeBlockAsync(Func`1 codeBlock)
at Microsoft.Identity.Client.Internal.Requests.RequestBase.RunAsync(CancellationToken cancellationToken)
at Microsoft.Identity.Client.ApiConfig.Executors.ConfidentialClientExecutor.ExecuteAsync(AcquireTokenCommonParameters commonParameters, AcquireTokenForClientParameters clientParameters, CancellationToken cancellationToken)
at Azure.Identity.AbstractAcquireTokenParameterBuilderExtensions.ExecuteAsync[T](AbstractAcquireTokenParameterBuilder`1 builder, Boolean async, CancellationToken cancellationToken)
at Azure.Identity.MsalConfidentialClient.AcquireTokenForClientCoreAsync(String[] scopes, String tenantId, String claims, Boolean enableCae, Boolean async, CancellationToken cancellationToken)
at Azure.Identity.MsalConfidentialClient.AcquireTokenForClientAsync(String[] scopes, String tenantId, String claims, Boolean enableCae, Boolean async, CancellationToken cancellationToken)
at System.Threading.ThreadPoolWorkQueue.Dispatch()
at System.Threading.PortableThreadPool.WorkerThread.WorkerThreadStart()

##[error]PowerShell exited with code 'null'.
```

### Environment data

```PowerShell
PowerShell 7.5.3
```

### Module versions

```PowerShell
Az 14.4.0
Az.Resources 8.1.0
Az.Accounts 5.3.0
Az.ApiManagement 4.1.0
```

### Error output

```PowerShell

```

Contributor guide

Open the contributing guide

Research direction

Start at the Restore-AzApiManagement entry point in the Az.ApiManagement module and reproduce a restore that runs longer than an hour. Trace how polling obtains Azure credentials and verify completion without the expired-token failure; done means long-running restores continue until completion.

Written by the indexing model from the issue text.

Assessment

Tech stack
azure, csharp, powershell
Domain
api, authentication, cloud
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.