When a user changes their Active Directory password, it may take some time for the user's access token to expire before BlackBerry Work, BlackBerry Notes, or BlackBerry Tasks prompts the user to re-authenticate. The length of time before the token expires is configured in Microsoft Entra ID. BlackBerry has no control over access token expiry time. The default lifespan of an access token is one hour. If the previously used credentials are no longer valid when a user's access token expires, the user must authenticate again. If a user logs in with a password (for example, they are using Forms Based authentication), the authentication form is displayed and the user must enter their credentials again. If a user logs in without a password (for example, they are using Kerberos Constrained Delegation or Certificate Based Authentication), the user is automatically re-authenticated and does not have to enter their credentials again.

For more information, see KB 55799.