IT Error Decoder
Microsoft Graph PowerShell

How to Fix Microsoft Graph 401 Unauthorized

Last reviewed

Error message

Response status code does not indicate success: 401 (Unauthorized).

401 means 'who are you?' — a different problem from 403, which means 'I know who you are but you can't do that.'

What this error means

Microsoft Graph couldn't even authenticate the request. The bearer token is missing, expired, or doesn't validate against the tenant.

Why this happens

Common causes: expired access token, wrong tenant in the authority URL, invalid client secret/cert for app-only auth, or the token was acquired for a different audience.

Quick fix (for end users)

  • Disconnect-MgGraph and run Connect-MgGraph again. Most 401s come from stale or expired sessions.
  • Check that you're connecting to the right tenant.

Admin / engineer fix

  • Force a fresh sign-in.

    command
    Disconnect-MgGraph
Connect-MgGraph -Scopes 'User.Read.All'

  • If using app-only auth with a certificate, verify it hasn't expired and is in the correct cert store.

    command
    Get-ChildItem Cert:\CurrentUser\My | Where-Object Subject -match 'MyApp'

  • Confirm the system clock is within a few minutes of real time. Token validation fails on large clock skew.

Step-by-step fix

  1. Disconnect any cached session.

  2. Reconnect with the right tenant and credentials.

  3. Retry the failing call.

Affected products

Microsoft Graph

Common variations of this error

People also see these phrasings of the same problem:

  • 401 Unauthorized — Microsoft Graph
  • InvalidAuthenticationToken

Still broken? Try these

  • If using a federated identity, your IdP may be rejecting the sign-in upstream.
  • App-only with secret? Check the secret hasn't been rotated.
  • Try a known-good account in Graph Explorer to isolate whether the tenant is healthy.

Related errors

Related searches

  • microsoft graph 401 unauthorized
  • graph token expired

Frequently asked questions

What's the difference between 401 and 403?

401 means the request wasn't authenticated at all (no token, expired token, invalid signature). 403 means it authenticated but isn't authorized for this operation.

Browse more errors in Microsoft Graph PowerShell: Fix Microsoft Graph PowerShell errors. Insufficient privileges, invalid object ID, missing cmdlets, token problems, and more. Or paste your own error into the error decoder tool to find a match. You can also go back to the homepage to browse common errors by topic.