OBO Auth Issue - AADSTS500133: Assertion is not within its valid time range

Question

OBO Auth Issue - AADSTS500133: Assertion is not within its valid time range

BasuAyusman-3102 6

Not sure What else is missing or needs to be done! Any Help would be appreciated
Error:
AADSTS500133: Assertion is not within its valid time range. Ensure that the access token is not expired before using it for user assertion, or request a new token.

I have two Apps registered for my Azure WebApp that call Foundry agents using Python SDK and Streamlit UI which in turn connects to Fabric Data Agent. Had to go via this OBO route due to the following reason: https://community.fabric.microsoft.com/t5/Fabric-platform/Fabric-Data-Agent-inaccessible-from-Azure-WebApp-using-Foundry/m-p/4915477#M24463

Registered Apps:

Auth App registration for Authentication code (for use by either MSAL or Easy Auth (Settings > Authentication > Add identity provider in the Web App resource)
SDK App registration for the application (for use by body of code that is using the Azure SDK for Python). This is a SEPARATE app registration from the one used for authentication.

Auth App permissions: (SDK app has been provided user_impersonation delegate permission with Admin Consent among the API permissions in the Auth app.)
User's image

SDK App permissions:
User's image

When I tried debugging my code, I could see the following: Token Type (typ): JWT Algorithm (alg): RS256 Audience (aud): api://<SDK_appID> Issuer (iss): https://sts.windows.net/<tenant_id>/ App ID (appid): <Auth_appID> Token Version (ver): 1.0 Scopes (scp): user_impersonation It was able to give "Token audience matches: api://<SDK_appID>"

Referred the following: https://stackoverflow.com/questions/78525641/attempting-to-use-the-azure-web-app-identity-provider-feature-with-a-web-app-t

Carolyne 1,151 Reputation points Microsoft Employee

2026-02-03T08:04:43.93+00:00

Hello!It seems this is documented here as an issue that is known but no timelines for resolution have been shared.
https://github.com/AzureAD/microsoft-authentication-library-for-js/issues/5330
I would imagine that long‑running or delayed backend calls which may be common with Fabric/Foundry agents will hit this. You may need to review this documentation for long running processes- https://learn.microsoft.com/en-us/entra/msal/dotnet/acquiring-tokens/web-apps-apis/on-behalf-of-flow#long-running-obo-processes
BasuAyusman-3102 6 Reputation points

2026-02-10T05:19:19.5766667+00:00

OBO Current Code.txt Hi Carolyne, thanks for your response, right now I am getting:
Exception: Failed to get OBO token: MSAL OBO failed: invalid_grant - AADSTS65001: The user or administrator has not consented to use the application with ID '<SDK_App_ID>' named '<SDK_App_Name>

Even though the tenant Admins has already consented to all the SDK App permissions from Azure Portal and also using the Consent URL.

PFA My Code
Refer functions:
def decode_token(token)
def is_token_expired(token, buffer_seconds=300)
def get_user_access_token()
def get_obo_token_with_msal()
def get_cached_obo_token()
def get_cached_obo_credential()

Your answer

Carolyne 1,151 Reputation points Microsoft Employee

2026-02-03T08:04:43.93+00:00

Hello!It seems this is documented here as an issue that is known but no timelines for resolution have been shared.
https://github.com/AzureAD/microsoft-authentication-library-for-js/issues/5330
I would imagine that long‑running or delayed backend calls which may be common with Fabric/Foundry agents will hit this. You may need to review this documentation for long running processes- https://learn.microsoft.com/en-us/entra/msal/dotnet/acquiring-tokens/web-apps-apis/on-behalf-of-flow#long-running-obo-processes
BasuAyusman-3102 6 Reputation points

2026-02-10T05:19:19.5766667+00:00

OBO Current Code.txt Hi Carolyne, thanks for your response, right now I am getting:
Exception: Failed to get OBO token: MSAL OBO failed: invalid_grant - AADSTS65001: The user or administrator has not consented to use the application with ID '<SDK_App_ID>' named '<SDK_App_Name>

Even though the tenant Admins has already consented to all the SDK App permissions from Azure Portal and also using the Consent URL.

PFA My Code
Refer functions:
def decode_token(token)
def is_token_expired(token, buffer_seconds=300)
def get_user_access_token()
def get_obo_token_with_msal()
def get_cached_obo_token()
def get_cached_obo_credential()