Outlook Trigger authentication expires after 2–3 days and requires manual reauthorization

[erbanku]

Self Checks

• This is only for bug report, if you would like to ask a question, please head to Discussions.
• I have searched for existing issues Dify issues & Dify Official Plugins, including closed ones.
• I confirm that I am using English to submit this report (我已阅读并同意 Language Policy).
• [FOR CHINESE USERS] 请务必使用英文提交 Issue，否则会被关闭。谢谢！:）
• Please do not modify this template :) and fill in all the required fields.

Dify version

1.14.0

Plugin version

latest

Cloud or Self Hosted

Self Hosted (Docker)

Steps to reproduce

The Outlook Trigger stops working after approximately 2–3 days because its OAuth access token expires and the plugin does not appear to refresh it automatically using the registered refresh token.

Expected behavior

The plugin should use the OAuth refresh_token to obtain a new access token automatically before or after expiration, so the Outlook Trigger remains active without manual reauthorization.

✔️ Error log

No response

[erbanku]

https://github.com/langgenius/dify-official-plugins/blob/main/triggers/outlook_trigger

[dosubot]

The Outlook Trigger plugin does implement automatic token refresh via _oauth_refresh_credentials — it uses the stored refresh_token to obtain a new access token with a 60-second proactive buffer before expiration [1].

However, there was a recent bug fix merged on July 8, 2026 that addresses exactly this scenario: token refresh was failing because the tenant ID wasn't being properly preserved during the OAuth lifecycle. Without the correct tenant context, the refresh request to Microsoft's token endpoint would fail silently, causing the trigger to stop working after the initial token expired (~1 hour, but Microsoft sometimes issues longer-lived tokens up to 24–72 hours) [2].

Resolution: Update your outlook_trigger plugin to the latest version. The fix ensures tenant IDs are saved and used correctly during token refresh. If you're already on the latest plugin version and still seeing this, try re-authorizing once after the update so the stored credentials include the tenant ID — subsequent refreshes should then work automatically.

To reply, just mention @dosu.

---

Share context across your team and agents. Try Dosu.

[erbanku]

https://github.com/langgenius/dify-official-plugins/pull/3408/changes

[Harsh23Kashyap]

Closing this out — the Outlook trigger's _oauth_refresh_credentials is already implemented at triggers/outlook_trigger/provider/outlook.py:233-274 (merged via PR #3408 on 2026-07-09).

The implementation covers every branch needed for this bug:

• POSTs grant_type=refresh_token to https://login.microsoftonline.com/{tenant}/oauth2/v2.0/token
• Preserves the rotated refresh_token when Microsoft returns a new one
• Computes expires_at from expires_in with a 60s safety margin
• Raises TriggerProviderOAuthError on missing credentials, network failures, non-200 responses, or missing access_token in the body
• Preserves tenant_id across the OAuth lifecycle (the original root cause behind this report)

If anyone is still hitting this after upgrading to a recent plugin version, the most likely cause is that their pre-fix credentials were stored without a refresh_token (older OAuth clients without offline_access). Re-authorizing once after upgrading should resolve it — _oauth_get_credentials (lines 180-231) now requires a refresh_token in the response and raises TriggerProviderOAuthError("No refresh token in response") otherwise, which surfaces the problem at re-auth time instead of silently dying 1 hour later.

No new PR needed for this issue; closing as resolved by #3408.