Using MSGraphClientFactory causes: monitor_window_timeout: Token acquisition in iframe failed due to timeout.

Target SharePoint environment

SharePoint Online

What SharePoint development model, framework, SDK or API is this about?

💥 SharePoint Framework

Developer environment

macOS

What browser(s) / client(s) have you tested

• 💥 Internet Explorer
• 💥 Microsoft Edge
• 💥 Google Chrome
• 💥 FireFox
• 💥 Safari
• mobile (iOS/iPadOS)
• mobile (Android)
• not applicable
• other (enter in the "Additional environment details" area below)

Additional environment details

• browser version: basically all the latest and earlier versions of the major browsers (e.g. Chrome/145.0.0.0, Edg/145.0.0.0, Safari 26.3, etc.)
• SPFx version: 1.18.2
• Node.js version: 18.20.2

Describe the bug / error

Our SPFx solution, which is deployed across many tenants and accessed through various devices, browsers, and Microsoft Teams clients, frequently encounters the following error when using the Microsoft Graph client provided by SPFx:

monitor_window_timeout: Token acquisition in iframe failed due to timeout.

When this error occurs, we automatically trigger a browser refresh and retry the operation. In approximately 90-95% of cases, this resolves the issue. However, a notable percentage of users continue to experience the error even after the refresh.

The graph below shows the frequency of this error across our user base (number of errors per hour):

When focusing specifically on the errors that persist after the automatic refresh, we see the following:

Given the scale of our deployment, this impacts a significant number of end users. We would appreciate any insights into the underlying cause (for example, iframe restrictions, third-party cookie behavior, WebView limitations, or token acquisition timing issues), as well as recommendations for a more reliable mitigation strategy than a full-page refresh.

Steps to reproduce

Consistently reproducing this issue is not possible. It occurs intermittently across many independent installations of our solution and does not appear to be tenant-specific.

Below is a simplified example of how we obtain and use the Graph client in our SPFx solution.

We acquire the Microsoft Graph client in the root web part file as part of the render function:

public async render(): Promise<void> {
    const graphClient = await this.context.msGraphClientFactory.getClient('3');
    ...
}

This shared graphClient instance is then used throughout the solution. For example, to retrieve security group memberships:

const secGroups = await graphClient
    .api('/me/getMemberGroups')
    .post({
        securityEnabledOnly: false,
    });

One important observation: this issue appears to occur only in a browser context. We have not observed it in native Microsoft Teams clients (neither desktop nor mobile).

Expected behavior

Issue should not occur this frequently.