Official documentation checked October 14, 2026.
If Copilot in Microsoft Edge repeatedly reports an expired token, record the exact message before changing settings. A repeated sign-in failure can involve the account, browser session, organization policy, or service. The message alone does not prove that Windows credentials are corrupt, and a browser repair should not start by deleting credentials or purging domain tickets.
Key takeaways
- Confirm whether you are using a personal Microsoft account or a work or school account and the intended Copilot experience.
- Complete the normal sign-in and MFA prompts, then use targeted site-data cleanup only if needed.
- For organizational sign-in errors, use the error code and sign-in logs to investigate policy or service causes.
Why the Copilot Token Expired Loop Occurs in Edge
Copilot Chat in Edge can use a Microsoft Entra work or school account, while personal Copilot uses a different account context. Microsoft describes these differences and the Edge access controls in managing Copilot Chat. Do not assume that every Edge Copilot session is an enterprise OAuth session with the same token lifetime.
For Entra sign-ins, session expiry or a failed reauthentication check can require a new sign-in. Conditional Access can also require reauthentication or completion of MFA. Microsoft’s sign-in troubleshooting guide explains how to distinguish these conditions using actual failure details. It does not establish that every policy change invalidates every token, or that Edge cannot show a new prompt.
Cookies can retain sign-in state, and browser settings can prevent sites from saving or reading data needed for a session. That is a reason to inspect a failing browser session, rather than evidence that an Office credential entry or Kerberos ticket caused the error.
Steps to Break the Token Expired Loop in Edge
1. Check the account and complete sign-in
- Record the Copilot entry point, exact error, time, and any displayed request or correlation ID. Do not copy authentication tokens or cookie values into a support message.
- Check the account shown in Copilot and the Edge profile. For organizational Copilot Chat, use the intended work or school account rather than a personal account with a similar address.
- Use the affected service’s sign-out control if it is available, then sign back in and complete the required prompts. Signing out of one website does not guarantee revocation of all Microsoft 365 sessions.
- Compare the sidebar with the organization’s approved Copilot web entry point. Record which one fails; success in the web experience narrows the investigation but does not identify a single cause.
2. Update Edge and inspect the affected session
Save open work and select Settings and more > Help and feedback > About Microsoft Edge. Install an available update and restart if prompted, following Microsoft’s Edge update instructions. For a managed device, use the help desk’s approved update process.
If another permitted profile or browser session works, investigate differences in account, extensions, and cookie settings. Keep the original profile and its data. An InPrivate result is not a definitive Conditional Access diagnosis: private browsing can also change cookies, extensions, and session state.
3. Remove only the affected site’s stored data if needed
Save any unsent work first. Microsoft’s cookie-management guide provides a site-specific route: Settings > Privacy, search, and services > Cookies > See all cookies and site data. Search for the affected Copilot site, expand its entry, and delete that site’s data. Sign in again afterward.
This can remove the selected site’s session and preferences. Avoid the All time bulk browsing-data dialog if your aim is to clear one site; that dialog’s cookie selection can sign you out of many sites. If shared Microsoft sign-in data also needs removal, have the help desk identify the affected domain and explain the impact before clearing it.
If Copilot Still Shows Token Expired After the Main Fix
For a work or school account, ask an authorized administrator to inspect the corresponding Entra sign-in event. The documented route is Entra ID > Monitoring & health > Sign-in logs. Review the failure reason, error code, authentication details, and policy result. Users can also review their own sign-ins through Microsoft’s My Sign-ins service. Check service health when multiple users are affected.
A policy may require an approved compliant device or another authentication step. Complete that requirement with IT rather than disabling MFA or Conditional Access. Do not remove MicrosoftOffice credentials, disconnect a managed Windows account, delete the Edge profile, or run klist purge as a general Copilot repair. Those actions can affect other applications and are not supported by the diagnosis established here.
For a personal account, use the support path for that account and service; tenant sign-in logs are not a universal diagnostic for personal Copilot. Escalate the sanitized error and the results of the targeted checks if the loop continues.
Copilot Token Expired Loop vs Other Copilot Authentication Errors
| Observation | Useful check | Avoid assuming |
|---|---|---|
| One normal sign-in resolves it | Session and account context | Every future failure has the same cause |
| Only one browser session fails | Site data, profile account, and permitted browser settings | The Windows credential cache must be deleted |
| Organizational sign-in fails repeatedly | Actual Entra event, error code, and policy outcome | MFA or Conditional Access should be disabled |
| Several users fail together | Service health and shared configuration | A local cookie reset is guaranteed to fix it |
No affected Edge session or tenant was tested for this article. The official guidance supports these checks, but it does not provide a universal cause or guaranteed cure for the exact “token expired” phrase.