A downstream service did not respond in time

Likely causes

• Do not automatically retry non-idempotent writes unless the final state is checked first.
• The token is missing, expired, for the wrong audience, or contains the wrong delegated/application permission type.
• Consent, Microsoft Entra role, licensing, resource ownership, or endpoint-specific authorization is still insufficient.

Recommended fix

1. Retry idempotent requests with bounded exponential backoff.
2. Reduce expensive queries, page size, or broad expansions.
3. Check service health and retain request IDs when the timeout persists.

Verify

1. Acquire a new access token after permissions or consent change.
2. Confirm delegated permissions appear in scp or application permissions appear in roles, and that aud targets Microsoft Graph.
3. Repeat the exact HTTP method and endpoint and confirm the response no longer returns the same request ID/status.

Escalate when

• The failure persists after the documented prerequisites and a new authentication/session attempt.
• Multiple users, apps, devices, or networks show the same error, suggesting tenant policy or service scope.
• You can provide the exact UTC time, tenant, application/resource, correlation or request ID, and sanitized logs.