Expected behavior when an 

Microsoft Active Directory

 password is changed

When a user changes their 

Active Directory

 password, it may take some time for the user's access token to expire before 

BlackBerry Work

, 

BlackBerry Notes

, 

BlackBerry Tasks

, or 

BlackBerry Connect

 prompts the user to re-authenticate. The length of time before the token expires is configured in 

Microsoft Azure

. 

BlackBerry

 has no control over access token expiry time. The default lifespan of an access token is one hour. If the previously used credentials are no longer valid when a user's access token expires, the user must authenticate again. If a user logs in with a password (for example, they are using Forms Based authentication), the authentication form is displayed and the user must enter their credentials again. If a user logs in without a password (for example, they are using 

Kerberos

 Constrained Delegation or Certificate Based Authentication), the user is automatically re-authenticated and does not have to enter their credentials again.

 For more information, visit https://support.blackberry.com/community/s/article/55799 to read article 000055799.