Overview

Sage CRM Exchange Integration allows users to synchronise calendar data between Microsoft Exchange and Sage CRM. Authentication is performed per user via the Preferences → Switch Email Account section using their email address and Exchange credentials.

An issue has been identified where a password change for a single Exchange user, without re-authentication in Sage CRM, can cause Exchange integration to fail for all users enabled for synchronisation.

This advisory explains the behaviour, impact, root cause, and current workaround.

What is happening?

When Exchange Integration is enabled each user authenticates their Exchange mailbox in Sage CRM via the preferences tab and Synchronisation works correctly for all authenticated users.

However, if a user changes their Exchange password, and does not re-authenticate via the Preferences tab then Exchange integration may fail for all users configured for synchronisation, not just the affected user.

Cause

This behaviour is caused by invalidated authentication tokens in Microsoft Entra ID (Azure Active Directory).

When a user changes or resets their Exchange password previously issued OAuth tokens become invalid and Microsoft Entra ID revokes the authentication grant

The following error is observed in current_crm log:

java.util.concurrent.CompletionException: com.microsoft.aad.msal4j.MsalInteractionRequiredException: AADSTS50173: The provided grant has expired due to it being revoked, a fresh auth token is needed. The user might have changed or reset their password. The grant was issued on 'xxxx-xx-xxTxx:xx:xx.6178840Z' and the TokensValidFrom date (before which tokens are not valid) for this user is 'xxxx-xx-xxTxx:xx:xx.0000000Z'.

Current Workaround

At present, the following manual steps are required to restore Exchange integration:

1. Identify users who have recently changed their Microsoft Exchange password.
2. Request affected users to log in to Sage CRM and reauthenticate via the preferences tab or exclude the user from synchronization.
3. Confirm that synchronisation resumes successfully for all users after enabling sync.

Recommendation

To minimise disruption:

• Ensure users are informed that any Microsoft Exchange password change requires re-authentication in Sage CRM
• Communicate this dependency as part of internal IT password change procedures
• Monitor CRM logs for authentication-related errors

This is a known issue and is currently under investigation.

A permanent fix is being assessed to ensure that Exchange authentication failures are isolated at a per-user level, preventing a single user’s credential change from impacting global synchronisation.