Official documentation checked October 14, 2026.
If a desktop Copilot experience reports an invalid refresh token or an MSAL sign-in error, first capture the actual error details and try the app’s normal interactive sign-in. The message does not establish that Windows Credential Manager is corrupt. A token may no longer be usable after a legitimate account or security change, and deleting every Office credential is not the necessary first response.
This guide is for Microsoft 365 desktop apps using a work or school account on Windows. A consumer Copilot app, a browser extension, or a custom application can use different sign-in components, so include the exact app name when seeking help.
1. Identify the error instead of assuming a cache location
MSAL is Microsoft’s authentication library, not the name of one Copilot-specific token store. Microsoft’s MSAL.NET error guidance distinguishes library errors, identity-provider errors, and situations requiring user interaction. An invalid_grant response during silent sign-in can require an interactive flow; it does not by itself identify a damaged local file.
If your diagnostic output literally says MSAL_ERROR_INVALID_REFRESH_TOKEN, keep that wording, but also capture any underlying AADSTS code, failure description, request/correlation ID, and time with time zone. That uppercase label should not be treated as a universal error string shown by every Microsoft 365 Copilot client.
A refresh token lets an app obtain another access token. Microsoft documents expiration and server-side revocation, including account and administrator actions. The effect of a password change varies with the token and action involved. A fresh sign-in can be the expected recovery, not evidence that an Office installation needs reinstalling.
Do not send a token, browser cookie, password, or authentication code to a forum or paste it into a decoder. The error text and IDs are sufficient starting evidence for your private help desk.
2. Complete one normal sign-in and test the result
- Save and synchronize your work. Preserve unsaved documents and pending uploads before closing applications. Do not use Task Manager to terminate all Office processes simply to clear a sign-in message.
- Check the intended account. In Word or Excel for Windows, File > Account shows the current account. If the app is using the wrong identity, use its normal account-switch or sign-in flow for the organization that provides the feature.
- Complete the challenge you initiated. Use the normal Microsoft or organization sign-in page and approved authentication method. If an MFA or registration step cannot be completed, contact IT. Do not approve an unexpected request or grant unfamiliar app permissions just to dismiss a dialog.
- Close and reopen the affected app normally. Try one harmless Copilot action in an approved test document. Record whether the error disappears, returns immediately, or recurs only after an interval.
An “interaction required” result means the app may need to show a sign-in challenge. A “user canceled” result can follow a closed dialog; neither is a reason to delete all credentials automatically. If the sign-in window never appears or immediately closes, record that behavior too. It is different evidence from a completed sign-in that the service later rejects.
3. Ask IT to check why token renewal failed
For a repeating failure, the identity team should match the user, application, resource, and failure time in Microsoft Entra’s sign-in records. The non-interactive user sign-in log includes token-refresh attempts; checking only interactive sign-ins can miss the failed renewal. Expand grouped events to examine the relevant timestamps.
Where Conditional Access is involved, use the event’s failure details and applied policies, following Microsoft’s sign-in troubleshooting guidance. Correct the identified account, device, or client condition. Do not remove MFA or exclude the user from protection merely because a prompt is inconvenient.
Tell IT whether the problem began after a password reset, session revocation, device change, or security-policy rollout. If sessions were intentionally revoked during incident response, completing the approved recovery process matters more than making an old session work again. Repeated revocation should be investigated with the security team.
If another approved device or the web experience works with the same account, include that comparison. Different clients can face different access conditions, so the result does not prove local corruption. Likewise, a missing Copilot entitlement should be checked separately; recurrence after a few hours does not prove that a license change is repeatedly revoking refresh tokens.
4. Use current diagnostics before targeted local repair
On the affected Windows PC, open Get Help and search for sign in to Microsoft Office. Follow the Microsoft 365 sign-in troubleshooter and retain its findings. Microsoft lists it under Microsoft 365 troubleshooters. Review proposed changes with IT on a managed computer.
Old instructions to download the standalone Support and Recovery Assistant are no longer the default path: Microsoft states that Get Help troubleshooters replaced that assistant. Do not assume a diagnostic will always erase tokens or guarantee recovery.
A local Windows authentication-component fault is possible, but it needs matching evidence. For example, Microsoft has a specific missing-package authentication scenario with its own symptoms and repair. IT should establish that those conditions apply before changing the affected user’s WAM components. The generic token error alone does not justify deleting OneAuth, every MicrosoftOffice16 credential, or all broker data.
Do not run ospp.vbs /act to clear Copilot tokens. It is not a token-cache reset, and Microsoft’s subscription activation documentation says ospp.vbs does not manage Microsoft 365 Apps licensing. If Office itself reports a separate activation failure, diagnose that separately.
Escalate with the original message, app and Windows versions, sign-in timing, comparison results, and diagnostic findings. This preserves useful evidence and lets support choose a limited repair instead of repeatedly clearing unrelated accounts or reinstalling Office.