Official documentation checked October 14, 2026.
If Copilot begins reporting invalid_grant after a work-account password reset, first try a fresh sign-in in the affected application. A revoked or stale refresh token is one possible cause, but the error does not prove that every Microsoft 365 cache needs deleting.
Save your work before signing out. Do not delete the entire Office profile folder, remove unrelated credentials or reset every device as the first response.
Why a password change can interrupt Copilot
invalid_grant is an OAuth error indicating that authentication material is unusable. Microsoft’s error reference includes authorization codes, refresh tokens and other protocol material, so the accompanying error description or AADSTS code matters.
A password change can invalidate credentials that an application was using silently. However, it is incorrect to say every reset immediately invalidates every access token and refresh token. Microsoft’s refresh-token documentation distinguishes reset methods and token/client types. When a refresh token is no longer valid, interactive authentication is the supported way to obtain a usable session.
If the reset was unexpected or followed a suspicious sign-in, contact your security team before treating the issue as an ordinary application glitch.
Try a focused reauthentication test
- Record the complete error, time and application. If a request or correlation ID is shown, retain it privately for support.
- Save and synchronize open work, then sign out of the affected app’s work account using its normal account controls.
- Close and reopen that app. Sign in with the intended work or school account and complete the organization’s current authentication requirements.
- Retest the same Copilot task with non-sensitive content.
- For a web-only failure, test the approved work URL in a private browser window with only the intended account signed in.
If the private session works while the existing one fails, that narrows the problem to the existing session or browser environment; it does not identify which cookie or extension is responsible. Try a normal sign-out first. If IT recommends clearing site data, limit the action to the affected Microsoft sign-in/service sites and understand that it will end those sessions.
If several Office apps still request authentication, address their sign-in prompts individually. Avoid deleting %appdata%\Microsoft\Office\16.0 or applying an old Teams-cache recipe without verifying the app version and a specific documented need.
Have IT check the actual sign-in failure
An authorized administrator can open Entra ID > Monitoring & health > Sign-in logs, filter to the user and failure time, and inspect the failure reason and additional details. Microsoft’s sign-in troubleshooting guide describes this process.
Compare the failing desktop or mobile app with the successful browser test, if any. Check whether the requested account and tenant are correct and whether MFA, device compliance or another access requirement is involved. Do not bypass those requirements to make Copilot work.
For federated or hybrid identities, involve the identity administrator to verify the password-change path and sign-in result. Do not assume one legacy Azure AD command is mandatory for every federated reset.
Use session revocation only when justified
If investigation or a security response requires invalidating the user’s sessions, Microsoft documents the revokeSignInSessions operation and its supported Graph tooling. It invalidates refresh tokens and browser session cookies for the user, can affect multiple apps and devices, and can take a few minutes to apply. External-user sessions must be addressed in the home tenant.
This is an administrative action with a broader effect than refreshing one Copilot pane. The responsible administrator should verify the exact user, permissions and intended impact, then arrange a fresh sign-in. Repeatedly revoking sessions while the user is testing can perpetuate the symptom.
After correction, confirm that the original application can authenticate and complete the intended Copilot task. If it fails again, provide the new timestamp and error details to support instead of escalating to broad cache or account deletion.