Azure AI Search Indexer scheduled execution throws error Verification code expired before contacting the server

[adnankhanitknocks]

I am working for a client and implemented Azure AI search and created indexers and indexes for Sharpoint. I am able to create and run indexer through code but Inders scheduled execution throws error "Verification code expired before contacting the server". I believe indexer is not able to refresh new token or there is something wrong when trying to connect with Azure App for sharepoint.

I read a resolution to generate a new client secret in app registration but I am not able to find config settings to update that client secret in Indexers.

Help in this regards would be highly appreciated. I have attached snapshots related to indexer execution history and settings.

[leestott]

Hi @adnankhanitknocks

This typically points to an OAuth token or client secret issue in the Azure App Registration used to authenticate with SharePoint.

Problem Summary

• The indexer works when triggered manually via code.
• But scheduled runs fail, throwing a token expiration error.
• The likely cause is that the indexer isn't refreshing its token properly during scheduled execution.

I would suspect the Root Cause is one of the following

• The client secret used in the Azure App Registration may have expired or is not being refreshed.
• The user suspects they need to update the client secret, but can't find where to configure it in the indexer settings.

Fix

1. Regenerate the client secret in Azure App Registration.

2. Update the credential reference in the Azure AI Search indexer configuration.

   • If you're using a data source object (e.g. az search datasource), update the credentials section.
   • If it's managed via Azure Portal, go to the indexer’s data source and reconfigure the authentication.

3. Verify token refresh behavior:

   • Scheduled executions rely on persistent credentials.
   • If you're using a federated identity or managed identity, ensure it's properly scoped for SharePoint access.

Useful resources

• Scheduling Indexers

  • Learn how to configure interval and startTime for automated runs.
  • [Schedule indexer execution](https://learn.microsoft.com/en-us/azure/search/search-howto-schedule-indexers)

• SharePoint Online Indexer Setup

  • Preview documentation for ingesting SharePoint Online content.
  • [SharePoint Online indexer](https://learn.microsoft.com/en-us/azure/search/search-howto-index-sharepoint-online)

• Running & Resetting Indexers

  • Covers manual vs scheduled execution and how to reset indexers.
  • [Run or reset indexers](https://learn.microsoft.com/en-us/azure/search/search-howto-run-reset-indexers)

• Troubleshooting Indexers

  • Includes guidance for silent failures, token issues, and data source errors.
  • [Indexer troubleshooting guide](https://github.com/MicrosoftDocs/azure-ai-docs/blob/main/articles/search/search-indexer-troubleshooting.md)

[adnankhanitknocks]

Hi @leestott ,

Thanks for your message.

1. I have tried your fix
2. As well as created new App registration with API permission of Type "Application" as suggested in this thread below. Using c# code I created new Index, new Datasource but when I try to create INDEXER. Still getting same error
   using Code and on Azure portal UI
   https://learn.microsoft.com/en-us/answers/questions/1434302/creating-indexer-for-the-cognitive-search-from-sha

I have explained my actions in detail below.

1. I Regenerated the client secret in Azure App Registration.

2. I am using data source object , I updated the credentials section, which was just application ID and tenant ID. which didnt change. I have shared JSON for both Indexer and Datasource.

JSON INdexer
{
"@odata.context": "https://xxxx",
"@odata.etag": ""0x8DDE2DB81F1xxxx"",
"name": "sharepoint-indexer",
"description": "Indexer to chunk documents, generate embeddings, and add to the index",
"dataSourceName": "sharepoint-indexer",
"skillsetName": "sharepoint-index-skillset",
"targetIndexName": "sharepoint-index",
"disabled": false,
"schedule": {
"interval": "P1D",
"startTime": "2025-08-11T11:37:52.48Z"
},
"parameters": {
"batchSize": 1,
"maxFailedItems": 0,
"maxFailedItemsPerBatch": 0,
"configuration": {}
},
"fieldMappings": [],
"outputFieldMappings": [],
"cache": null,
"encryptionKey": null
}

Datasource JSON

{
"@odata.context": "https://xxxx.search.windows.net/$metadata#datasources/$entity",
"@odata.etag": ""0x8DDE2D93A29BECC"",
"name": "sharepoint-indexer",
"description": null,
"type": "sharepoint",
"subtype": null,
"indexerPermissionOptions": [],
"credentials": {
"connectionString": "SharePointOnlineEndpoint=https://xxxx.sharepoint.com/sites/CleveAI;ApplicationId=052a9b44-xxxx;TenantId=5cec81bf-xxxx;"
},
"container": {
"name": "defaultSiteLibrary",
"query": null
},
"dataChangeDetectionPolicy": null,
"dataDeletionDetectionPolicy": null,
"encryptionKey": null,
"identity": null
}

2. I have not seen any other options in datasource where I can reconfigure the authentication of datasource except JSON which just have AppID and TenantID.

3. I am using both delegated and APP.

I created new App registration

with API permissions of type "Application".
Using C# code
I created new Index and
Datasource connected with this new App registration.
But again when I try to create INDEXER I get same error on portal UI as well as in code. On Portal UI I have tried both options on portal "Add Indexer (Json)" and "Add Indexer"

New Idexer JSON
{
"@odata.context": "https://xxx.search.windows.net/$metadata#indexers/$entity",
"@odata.etag": ""0x8DDE2DB81F11xxx"",
"name": "sharepoint-indexertester",
"description": "Indexer to chunk documents, generate embeddings, and add to the index",
"dataSourceName": "sharepoint-indexertester",
"skillsetName": "sharepoint-indextester-skillset",
"targetIndexName": "sharepoint-indextester",
"disabled": false,
"schedule": {
"interval": "P1D",
"startTime": "2025-08-11T11:37:52.48Z"
},
"parameters": {
"batchSize": 1,
"maxFailedItems": 0,
"maxFailedItemsPerBatch": 0,
"configuration": {}
},
"fieldMappings": [],
"outputFieldMappings": [],
"cache": null,
"encryptionKey": null
}

New Datasource JSON
{
"@odata.context": "https://ixxxx.search.windows.net/$metadata#datasources/$entity",
"@odata.etag": ""0x8DDE2DE978B23AB"",
"name": "sharepoint-indexertester",
"description": null,
"type": "sharepoint",
"subtype": null,
"indexerPermissionOptions": [],
"credentials": {
"connectionString": "SharePointOnlineEndpoint=https://xxxx.sharepoint.com/sites/xxx;ApplicationId=639bf78b-yyyy;TenantId=5cec81bf-yyyy;"
},
"container": {
"name": "defaultSiteLibrary",
"query": null
},
"dataChangeDetectionPolicy": null,
"dataDeletionDetectionPolicy": null,
"encryptionKey": null,
"identity": null
}

[adnankhanitknocks]

@leestott

Issue fixed. I will share complete steps here what I did to resolve it.

[adnankhanitknocks]

Thanks @leestott I was able to resolve my issue by going through this article
https://learn.microsoft.com/en-us/azure/search/search-howto-index-sharepoint-online

So my issue was that my indexer on scheduled execution was continuously giving error “Verification code expired before contacting the server”.

I found two reasons for this issue.

1. One Indexer has limitation that when sharepoint is used as datasource then API permissions in App registration is recommended to be Application Type.

“User-delegated permissions enforce token expiration every 75 minutes, per the most recent security libraries used to implement this authentication type. This isn't a behavior that can be adjusted. An expired token requires manual indexing using Run Indexer (preview). For this reason, you should use app-based permissions instead.”
https://learn.microsoft.com/en-us/azure/search/search-howto-index-sharepoint-online

https://learn.microsoft.com/en-us/answers/questions/1434302/creating-indexer-for-the-cognitive-search-from-sha

2. 2ndly, When you create the indexer for the first time, the [Create Indexer (preview)] request waits until you complete the next step. You must call [Get Indexer Status] to get the link and enter your new device code.
https://learn.microsoft.com/en-us/azure/search/search-howto-index-sharepoint-online

My Implementation details step by step:

1. I created a new app registration and selected API permission as type Application.

How to Create a Microsoft Entra application registration
https://learn.microsoft.com/en-us/azure/search/search-howto-index-sharepoint-online

2. I created my index, Datasource and Indexer using c# code. I believe you can also create using Json. I have shared C# snippet and JSONs at the end of this response.

3. The format of the connection string in datasource changes based on whether the indexer is using delegated API permissions or application API permissions.

Connection string format
SharePointOnlineEndpoint=[SharePoint site url];ApplicationId=[Azure AD App ID];ApplicationSecret=[Azure AD App client secret];TenantId=[SharePoint site tenant id]
https://learn.microsoft.com/en-us/azure/search/search-howto-index-sharepoint-online

4. As mentioned above I need to do device login. Steps below.
4.1. Get Indexer status: I used postman to send below request as mentioned in below article. Define API key as shown in snapshot.

https://yoursearchapiurl.search.windows.net/indexers/sharepoint-indexertester/status?api-version=2025-05-01-preview&Content-Type=application/json

4.2. Follow the steps mentioned under heading in below article. Step 6: Create an indexer (Steps 3 to 7).
https://learn.microsoft.com/en-us/azure/search/search-howto-index-sharepoint-online

4.3. If you are getting error “Sign-in was successful but you don't have permission to this resource” then exclude your user from this policy for time being.

After these steps, Indexer created successfully and now I am able to run it manually from portal as well as schedule is also working without any issues.

Snippet of my C# code below:

internal static async Task SetupAndRunIndexer(Configuration configuration, SearchIndexClient indexClient, SearchIndexerClient indexerClient, OpenAIClient openAIClient)
{
// Create an Index
Console.WriteLine("Creating/Updating the index...");
var index = GetSampleIndex(configuration);
await indexClient.CreateOrUpdateIndexAsync(index);
Console.WriteLine("Index Created/Updated!");

SearchIndexerDataContainer(configuration.BlobContainerName));
//indexerClient.CreateOrUpdateDataSourceConnection(dataSource);
//Console.WriteLine("Data Source Created/Updated!");

   // Use SharePoint as custom string since it's not defined in enum
   Console.WriteLine("Creating/Updating the SharePoint data source connection...");

   var dataSource = new SearchIndexerDataSourceConnection(
      name: $"sharepoint-indexer",
      type: "sharepoint", // ← use the string instead of enum
      connectionString:
      $"SharePointOnlineEndpoint=https://xxxx.sharepoint.com/sites/sitexxxx;ApplicationId=639bf78b-xxxx xxxx;ApplicationKey=secretvalue;TenantId=xxxx;SiteUrl=https://xxxx.sharepoint.com/sites/sitename",
      container: new SearchIndexerDataContainer("defaultSiteLibrary")
  );


   //indexerClient.CreateOrUpdateDataSourceConnection(dataSource);
   Console.WriteLine("SharePoint Data Source Created/Updated!");


   // Create a Skillset  
   Console.WriteLine("Creating/Updating the skillset...");
   var skillset = new SearchIndexerSkillset($"{configuration.IndexName}-skillset", new List<SearchIndexerSkill>
   {  
       // Add required skills here    
       new SplitSkill(
           new List<InputFieldMappingEntry>
           {
               new InputFieldMappingEntry("text") { Source = "/document/content" }
           },
           new List<OutputFieldMappingEntry>
           {
               new OutputFieldMappingEntry("textItems") { TargetName = "pages" }
           })
       {
           Context = "/document",
           TextSplitMode = TextSplitMode.Pages,
           MaximumPageLength = 2000,
           PageOverlapLength = 500,
       },
       new AzureOpenAIEmbeddingSkill(
           new List<InputFieldMappingEntry>
           {
               new InputFieldMappingEntry("text") { Source = "/document/pages/*" }
           },
           new List<OutputFieldMappingEntry>
           {
               new OutputFieldMappingEntry("embedding") { TargetName = "vector" }
           }
       )
       {
           Context = "/document/pages/*",
           ResourceUri = new Uri(configuration.AzureOpenAIEndpoint),
           ApiKey = configuration.AzureOpenAIApiKey,
           DeploymentId = configuration.AzureOpenAIEmbeddingDeployedModel,
       }
   })
   {
       IndexProjections = new SearchIndexerIndexProjections(new[]
       {
           new SearchIndexerIndexProjectionSelector(configuration.IndexName, parentKeyFieldName: "parent_id", sourceContext: "/document/pages/*", mappings: new[]
           {
               new InputFieldMappingEntry("chunk")
               {
                   Source = "/document/pages/*"
               },
               new InputFieldMappingEntry("vector")
               {
                   Source = "/document/pages/*/vector"
               },
               new InputFieldMappingEntry("title")
               {
                   Source = "/document/metadata_storage_name"
               }
           })
       })
       {
           Parameters = new SearchIndexerIndexProjectionsParameters
           {
               ProjectionMode = IndexProjectionMode.SkipIndexingParentDocuments
           }
       }
   };
  // await indexerClient.CreateOrUpdateSkillsetAsync(skillset).ConfigureAwait(false);
   Console.WriteLine("Skillset Created/Updated!");

   // Create an Indexer  
   Console.WriteLine("Creating/Updating the indexer...");
   var indexer = new SearchIndexer($"sharepoint-indexer", dataSource.Name, configuration.IndexName)
   {
       Description = "Indexer to chunk documents, generate embeddings, and add to the index",
       Schedule = new IndexingSchedule(TimeSpan.FromDays(1))
       {
           StartTime = DateTimeOffset.Now
       },
       Parameters = new IndexingParameters()
       {
           BatchSize = 1,
           MaxFailedItems = 0,
           MaxFailedItemsPerBatch = 0,
       },
       SkillsetName = skillset.Name,
   };
   await indexerClient.CreateOrUpdateIndexerAsync(indexer).ConfigureAwait(false);
   Console.WriteLine("Indexer Created/Updated!");

   // Run Indexer  
   Console.WriteLine("Running the indexer...");
   await indexerClient.RunIndexerAsync(indexer.Name).ConfigureAwait(false);
   Console.WriteLine("Indexer is Running!");

}

JSON Index

{
"@odata.etag": ""0x8DDE3D5EC75262D"",
"name": "sharepoint-indextester",
"fields": [
{
"name": "parent_id",
"type": "Edm.String",
"searchable": true,
"filterable": true,
"retrievable": true,
"stored": true,
"sortable": true,
"facetable": true,
"key": false,
"synonymMaps": []
},
{
"name": "chunk_id",
"type": "Edm.String",
"searchable": true,
"filterable": true,
"retrievable": true,
"stored": true,
"sortable": true,
"facetable": true,
"key": true,
"analyzer": "keyword",
"synonymMaps": []
},
{
"name": "title",
"type": "Edm.String",
"searchable": true,
"filterable": false,
"retrievable": true,
"stored": true,
"sortable": false,
"facetable": false,
"key": false,
"synonymMaps": []
},
{
"name": "chunk",
"type": "Edm.String",
"searchable": true,
"filterable": false,
"retrievable": true,
"stored": true,
"sortable": false,
"facetable": false,
"key": false,
"synonymMaps": []
},
{
"name": "vector",
"type": "Collection(Edm.Single)",
"searchable": true,
"filterable": false,
"retrievable": true,
"stored": true,
"sortable": false,
"facetable": false,
"key": false,
"dimensions": 1536,
"vectorSearchProfile": "my-vector-profile2",
"synonymMaps": []
},
{
"name": "category",
"type": "Edm.String",
"searchable": true,
"filterable": true,
"retrievable": true,
"stored": true,
"sortable": true,
"facetable": true,
"key": false,
"synonymMaps": []
},
{
"name": "metadata_spo_item_weburi",
"type": "Edm.String",
"searchable": false,
"filterable": false,
"retrievable": true,
"stored": true,
"sortable": false,
"facetable": false,
"key": false,
"synonymMaps": []
},
{
"name": "metadata_spo_item_name",
"type": "Edm.String",
"searchable": false,
"filterable": false,
"retrievable": true,
"stored": true,
"sortable": false,
"facetable": false,
"key": false,
"synonymMaps": []
},
{
"name": "content",
"type": "Edm.String",
"searchable": false,
"filterable": false,
"retrievable": true,
"stored": true,
"sortable": false,
"facetable": false,
"key": false,
"synonymMaps": []
},
{
"name": "metadata_spo_item_path",
"type": "Edm.String",
"searchable": false,
"filterable": false,
"retrievable": true,
"stored": true,
"sortable": false,
"facetable": false,
"key": false,
"synonymMaps": []
},
{
"name": "metadata_spo_item_size",
"type": "Edm.String",
"searchable": false,
"filterable": false,
"retrievable": true,
"stored": true,
"sortable": false,
"facetable": false,
"key": false,
"synonymMaps": []
}
],
"scoringProfiles": [],
"suggesters": [],
"analyzers": [],
"normalizers": [],
"tokenizers": [],
"tokenFilters": [],
"charFilters": [],
"similarity": {
"@odata.type": "#Microsoft.Azure.Search.BM25Similarity"
},
"semantic": {
"configurations": [
{
"name": "my-semantic-config",
"flightingOptIn": false,
"rankingOrder": "BoostedRerankerScore",
"prioritizedFields": {
"titleField": {
"fieldName": "title"
},
"prioritizedContentFields": [
{
"fieldName": "chunk"
}
],
"prioritizedKeywordsFields": []
}
}
]
},
"vectorSearch": {
"algorithms": [
{
"name": "myHnsw",
"kind": "hnsw",
"hnswParameters": {
"metric": "cosine",
"m": 4,
"efConstruction": 400,
"efSearch": 500
}
},
{
"name": "myExhaustiveKnn",
"kind": "exhaustiveKnn",
"exhaustiveKnnParameters": {
"metric": "cosine"
}
}
],
"profiles": [
{
"name": "my-vector-profile2",
"algorithm": "myHnsw",
"vectorizer": "myOpenAIVectorizer"
},
{
"name": "myExhaustiveKnnProfile2",
"algorithm": "myExhaustiveKnn"
}
],
"vectorizers": [
{
"name": "myOpenAIVectorizer",
"kind": "azureOpenAI",
"azureOpenAIParameters": {
"resourceUri": "https://xxxx.openai.azure.com",
"deploymentId": "text-embedding-ada-002",
"apiKey": ""
}
}
],
"compressions": []
}
}

JSON Indexer

{
"@odata.context": "https://xxxx.search.windows.net/$metadata#indexers/$entity",
"@odata.etag": ""0x8DDE3E012F5xxxx"",
"name": "sharepoint-indexertester",
"description": "Indexer to chunk documents, generate embeddings, and add to the index",
"dataSourceName": "sharepoint-indexertester",
"skillsetName": "sharepoint-indextester-skillset",
"targetIndexName": "sharepoint-indextester",
"disabled": null,
"schedule": {
"interval": "P1D",
"startTime": "2025-08-24T14:02:40.207Z"
},
"parameters": {
"batchSize": 1,
"maxFailedItems": 0,
"maxFailedItemsPerBatch": 0,
"configuration": {
"indexedFileNameExtensions": ".pdf, .docx",
"excludedFileNameExtensions": ".png, .jpg",
"dataToExtract": "contentAndMetadata"
}
},
"fieldMappings": [
{
"sourceFieldName": "metadata_spo_site_library_item_id",
"targetFieldName": "parent_id",
"mappingFunction": {
"name": "base64Encode",
"parameters": null
}
},
{
"sourceFieldName": "metadata_spo_item_name",
"targetFieldName": "metadata_spo_item_name",
"mappingFunction": null
},
{
"sourceFieldName": "metadata_spo_item_path",
"targetFieldName": "metadata_spo_item_path",
"mappingFunction": null
},
{
"sourceFieldName": "content",
"targetFieldName": "content",
"mappingFunction": null
},
{
"sourceFieldName": "metadata_spo_item_weburi",
"targetFieldName": "metadata_spo_item_weburi",
"mappingFunction": null
}
],
"outputFieldMappings": [],
"cache": null,
"encryptionKey": null
}

JSON Datasource.
{
"@odata.context": "https://xxxx.search.windows.net/$metadata#datasources/$entity",
"@odata.etag": ""0x8DDE3E00EC81244"",
"name": "sharepoint-indexertester",
"description": null,
"type": "sharepoint",
"subtype": null,
"indexerPermissionOptions": [],
"credentials": {
"connectionString": "SharePointOnlineEndpoint=https://xxxx.sharepoint.com/sites/CleveAI;ApplicationId=639bf78b-xxxx;ApplicationSecret=...;TenantId=5cec81bf-xxxx;"
},
"container": {
"name": "defaultSiteLibrary",
"query": null
},
"dataChangeDetectionPolicy": null,
"dataDeletionDetectionPolicy": null,
"encryptionKey": null,
"identity": null
}