Overview
The MFA Token monitoring test appears in the Microsoft 365 section of the monitoring console.
Monitoring Benefit
Where a credential stored in ENow uses multi-factor authentication, the product holds an access token and a refresh token so it can keep working without prompting anyone. The MFA Token test verifies that those stored tokens can still be used and still be renewed. If a token can no longer be used or refreshed — revoked, expired, or invalidated for any other reason — the test reports it.
This is about ENow's own stored credentials, not about your users' MFA. The name invites the opposite reading. Nothing here reports on whether your users have MFA enabled, whether their sign-ins are being challenged, or how their MFA is configured. It reports on one thing: whether the credentials ENow itself has stored are still usable.
That makes it a quiet but consequential check. A refresh token that has stopped working does not announce itself — monitoring simply stops returning data for whatever that credential covers, and the gap can go unnoticed until someone asks why a workload has no recent results.
How do we verify the monitoring test results?
1. Re-validate the credential in the Admin Console. This is both the check and the fix. Open the affected credential in the ENow Admin Console and re-validate it. A successful validation obtains a fresh access and refresh token, and the indicator clears on the next run.
2. Establish why the token stopped working. Re-validating restores service, but the token was invalidated for a reason, and if that reason persists it will happen again. The usual causes:
- The account's password was changed or reset — this invalidates existing refresh tokens.
- An administrator revoked the account's sessions or refresh tokens, in Microsoft Entra ID or through a script.
- A Conditional Access policy changed and now blocks the non-interactive refresh.
- The account was disabled, deleted, or had its licence removed.
- The refresh token reached the end of its permitted lifetime without being used.
3. Check the account in Microsoft Entra ID. Confirm the account is enabled, still licensed, and not caught by a policy that would block non-interactive token refresh. Sign-in logs for that account will usually name the failure.
4. Confirm what else was affected. A stored credential often serves more than one monitoring test. After re-validating, check that the tests depending on that credential have resumed returning data rather than assuming the indicator clearing is the whole story.
Common warning or error results, and potential solutions
| Result | Potential solution |
| The stored token can no longer be used or refreshed | Re-validate the credential in the ENow Admin Console. This is a manual step by design — a fresh token cannot be obtained without it. |
| The token fails again shortly after re-validation | Something is invalidating it repeatedly. Check for a Conditional Access policy change, a password rotation schedule, or an automated session-revocation process affecting that account. |
| Monitoring data missing for a workload, with this indicator raised | Expected. Tests that rely on the affected credential cannot run until the token is renewed. Re-validate first, then re-check those tests. |
| The account was recently changed | Password changes, session revocation, disabling the account and licence removal all invalidate stored refresh tokens. Re-validate after the account is settled, not before. |
| Uncertain which credential is affected | The alert identifies the stored credential. Re-validate that one specifically rather than re-entering every credential in the console. |
Related
- Conditional Access and service-account guidance: see the ENow articles on configuring service accounts to bypass MFA and Conditional Access policies, and on named locations and trusted IPs for external monitoring.
Comments
0 comments
Please sign in to leave a comment.