Copilot for Sales: Resolve Connection Errors - Expired Session or OAuth Token Issues

Table of Contents

Microsoft Copilot for Sales is a powerful tool designed to enhance sales productivity by seamlessly integrating with CRM systems like Salesforce. This integration enables sales professionals to perform critical tasks, access customer data, and update records directly from their communication platforms, such as Outlook. However, maintaining a stable and secure connection between Copilot for Sales and Salesforce is crucial for uninterrupted workflow. Occasionally, users may encounter connection errors, specifically the “Connection lost” message, which disrupts their ability to leverage Copilot for Sales effectively.

This comprehensive guide aims to help you troubleshoot and resolve the “Connection lost” error that occurs when you are logged out of Microsoft Copilot for Sales. This issue typically arises due to an expired or invalid session with Salesforce or an issue with the underlying OAuth authentication tokens. Understanding the root causes and implementing the correct resolution steps are essential for restoring functionality and ensuring a smooth sales operation.

It is important to note that Microsoft Sales Copilot was rebranded as Microsoft Copilot for Sales in January 2024. While the core functionality remains consistent, you may still encounter references to the previous name in older documentation or interface elements until all updates are propagated. This article reflects the current branding for clarity and consistency.

Who is Affected?¶

Understanding the scope of this issue helps in pinpointing potential areas of concern and tailoring troubleshooting efforts. The “Connection lost” error in Copilot for Sales can impact a broad spectrum of users and system configurations, primarily those relying on its integration with Salesforce. This section details the specific requirements and user groups that are most susceptible to these connection challenges.

Requirement Type	Description
Client app	The primary client affected is the Copilot for Sales Outlook add-in. This add-in serves as the direct interface for users to interact with Copilot for Sales functionalities within their Outlook environment, making its connection status paramount. Any disruption here directly translates to an inability to use the integrated sales tools effectively.
Platform	Both web and desktop clients of Outlook are susceptible to these connection issues. Whether you access Outlook through a web browser (Outlook on the web) or via the dedicated desktop application on Windows or Mac, the underlying connection mechanisms to Copilot for Sales and Salesforce are similar, and thus prone to the same types of authentication and session problems. Consistency in troubleshooting across platforms is therefore often applicable.
OS	Users operating on both Windows and Mac operating systems can experience this error. The operating system itself generally does not cause the connection issue, but how the Outlook client and its add-ins manage network access, security certificates, or local storage can sometimes play a minor role. The core problem usually resides in the authentication handshake with Salesforce, independent of the OS.
Deployment	This issue can affect both user-managed and admin-managed deployments of Copilot for Sales. In user-managed scenarios, individual users install and configure the add-in, while admin-managed deployments involve IT administrators pushing the add-in across the organization. The method of deployment does not inherently prevent or cause the “Connection lost” error; the authentication logic remains consistent regardless of how the add-in was provisioned.
CRM	The Customer Relationship Management (CRM) system specifically affected by these connection errors is Salesforce. Copilot for Sales is designed to integrate with various CRM platforms, but this particular troubleshooting guide focuses on scenarios where Salesforce is the connected CRM. The unique authentication and session management protocols of Salesforce are central to understanding and resolving these specific connection problems.
Users	All users who perform any action that requires a live connection to Salesforce through Copilot for Sales are affected. This includes tasks such as logging emails, updating contact information, creating new leads, accessing opportunity details, or synchronizing sales activities. Essentially, any operation that involves reading from or writing to Salesforce data via Copilot for Sales will trigger the connection requirement and expose the user to this error if the link is compromised.

Symptoms¶

The primary symptom of an expired session or a bad OAuth token in Copilot for Sales is a sudden interruption in functionality, preventing users from performing their sales-related tasks. When you attempt to execute any action within the Copilot for Sales interface that necessitates interaction with Salesforce, the system will fail to connect. Instead of processing your request, it will log you out of Copilot for Sales.

Upon logging out, a distinct error message will be prominently displayed within the Copilot for Sales pane. This message is concise and direct, indicating a fundamental breakdown in communication. The error you will encounter is:

“Connection lost.”

This specific message is a clear indicator that Copilot for Sales has failed to establish or maintain a secure and authenticated link to your Salesforce instance. It signifies that the system can no longer verify your identity or authorize your actions against the Salesforce data. Experiencing this symptom effectively halts all Salesforce-integrated activities within Copilot for Sales, requiring immediate attention to restore connectivity.

Understanding Authentication and Sessions¶

Before diving into the specific causes, it’s beneficial to grasp the fundamental concepts of authentication and session management in cloud applications. When Copilot for Sales integrates with Salesforce, it establishes a secure communication channel, allowing the two systems to exchange data on your behalf. This process relies on two key elements: authentication tokens and user sessions.

Authentication tokens, particularly OAuth tokens, are essentially digital credentials that prove your identity and grant Copilot for Sales specific permissions to act within Salesforce. These tokens are issued after you successfully log in and authorize Copilot for Sales to access your Salesforce data. User sessions, on the other hand, represent a period of continuous interaction between your client (Copilot for Sales) and the Salesforce server after successful authentication. Both elements work in tandem to ensure secure and seamless operations.

Copilot for Sales Connection Flow with Salesforce¶

The integration between Copilot for Sales and Salesforce leverages a sophisticated authentication and authorization flow, typically based on OAuth 2.0. When you first connect Copilot for Sales to Salesforce, you are redirected to Salesforce for authentication, where you grant Copilot for Sales the necessary permissions (scopes) to access your data. Upon successful authorization, Salesforce issues an access token and often a refresh token.

The access token is used by Copilot for Sales to make API calls to Salesforce on your behalf. It typically has a short lifespan for security reasons. The refresh token, with a longer lifespan, is used by Copilot for Sales (or more specifically, the Salesforce connector component) to obtain new access tokens without requiring you to log in again. This mechanism ensures continuous, secure access without repetitive authentication. A session then represents the active period during which these tokens are valid and being used.

```mermaid
graph TD
A[User attempts action in Copilot for Sales] → B{Copilot for Sales Requires Salesforce Connection};
B – Initial Connection / Re-authentication → C[Redirect to Salesforce Login];
C – User Authenticates & Authorizes → D[Salesforce Issues OAuth Tokens (Access & Refresh)];
D → E[Copilot for Sales Stores Tokens & Establishes Session];
E – Subsequent Actions (within session) → F[Copilot for Sales Uses Access Token for API Calls to Salesforce];
F → G[Salesforce Processes Request & Returns Data];
G → H[Action proceeds successfully];
E – Access Token Expired → I{Copilot for Sales Uses Refresh Token};
I – Refresh Token Valid → D;
I – Refresh Token Invalid/Expired → J[Connection Lost Error - User Requires Re-authentication];
E – Salesforce Session Expired → J;

subgraph Error Scenarios
    J;
end

```

Cause 1: Bad OAuth Token¶

A “bad OAuth token” is a common cause for connection failures between Copilot for Sales and Salesforce. This error fundamentally indicates that the authentication tokens, which are crucial for Copilot for Sales to communicate with Salesforce, are no longer valid or usable. The Salesforce connection, established and managed by the Salesforce connector within Copilot for Sales, is responsible for maintaining and renewing these authentication tokens.

When the Salesforce connector is unable to successfully renew the authentication tokens, the system deems them “bad,” leading to the “Connection lost” error. Several scenarios can contribute to an OAuth token becoming invalid:

• Token Expiration: While refresh tokens are designed to have a long lifespan, they are not immortal. If a refresh token itself expires or is not used to obtain a new access token within a specified period, it becomes invalid. This often happens if the user hasn’t accessed Copilot for Sales for an extended duration.
• Token Revocation: Tokens can be explicitly revoked. This might occur if a user or an administrator revokes access for Copilot for Sales from within Salesforce’s “Connected Apps OAuth Usage” settings. Security incidents or policy changes can also trigger automated token revocation.
• Security Policies: Salesforce security settings or broader organizational security policies (e.g., Conditional Access policies in Azure AD if Copilot for Sales is integrated with Azure AD for identity management) can invalidate tokens. For instance, if a user’s IP address changes drastically, or if they log in from an untrusted device, existing tokens might be deemed insecure and invalidated.
• Mismatched Scopes/Permissions: Although less common after an initial successful connection, if the required permissions (scopes) for Copilot for Sales to access Salesforce data are altered or reduced on the Salesforce side, existing tokens might become “bad” as they no longer grant sufficient authorization.
• Network or System Glitches: Temporary network interruptions or issues within the Salesforce connector itself can sometimes prevent the successful renewal of tokens, even if the tokens are technically valid. While often transient, these can temporarily manifest as a “bad token” error.
• User Account Status Changes: If the user’s Salesforce account is deactivated, locked, or undergoes significant permission changes, the associated OAuth tokens will likely become invalid as the underlying identity or authorization no longer exists.

When an OAuth token goes “bad,” Copilot for Sales loses its credentialed access to Salesforce APIs. This means it can no longer fetch data, log activities, or perform any actions requiring Salesforce interaction, thereby triggering the “Connection lost” error.

Cause 2: Expired or Invalid Session¶

Distinct from a “bad OAuth token,” an expired or invalid session directly relates to the active user session established within Salesforce itself. While OAuth tokens manage the application’s ability to act on your behalf, sessions manage your continuous interaction with Salesforce. This issue arises when the Salesforce session, which is governed by specific configuration settings in Salesforce, reaches its expiration time or becomes otherwise invalid.

Salesforce administrators can configure various session settings to enhance security and manage resource usage. These settings directly impact how long a user’s session remains active and under what conditions it might be terminated:

• Session Timeout: This is the most common reason for an expired session. Salesforce allows administrators to set a specific timeout duration (e.g., 2 hours, 8 hours, 12 hours) after which an inactive user session is automatically terminated. If you leave Copilot for Sales open without interacting with Salesforce through it for longer than the configured timeout, your session will expire.
• IP Range Restrictions: Salesforce can be configured to restrict user sessions to specific IP address ranges. If your IP address changes (e.g., moving from office Wi-Fi to mobile hotspot, or due to a dynamic IP address assignment), your existing session might be immediately invalidated as it no longer originates from an authorized location.
• Concurrent Sessions: Some Salesforce editions or configurations might limit the number of active concurrent sessions a user can have. If you log into Salesforce directly from another browser or device and exceed this limit, an older session (potentially the one used by Copilot for Sales) might be terminated.
• Security Level and Policies: Salesforce allows defining different session security levels. If a user’s session drops below a required security level for certain actions, or if specific security policies are triggered (e.g., multi-factor authentication requirements not met), the session could be invalidated.
• Browser/Client-Side Issues: Although less common, issues with browser cookies, local storage, or security settings can sometimes interfere with session management, leading to premature session termination or an inability to maintain the session.

When a Salesforce session expires or becomes invalid, Copilot for Sales effectively loses its established direct link to your Salesforce instance, even if the underlying OAuth tokens might still technically be valid. The “Connection lost” error then prompts you to re-establish this active user session by signing in again.

Resolution¶

Resolving the “Connection lost” error is typically straightforward, as the issue often stems from a need to re-authenticate or refresh your session with Salesforce. The primary solutions involve prompting Copilot for Sales to re-initiate the authentication flow.

To solve this issue, perform one of these recommended steps:

1. Sign in Again via the Error Message¶

This is the quickest and most direct approach. When the “Connection lost” error message appears in the Copilot for Sales pane, it usually includes an interactive prompt to resolve the issue.

• Select “Sign in again” directly within the error message displayed in the Copilot for Sales pane.
• You will then be redirected to the Salesforce login page in a new browser window or tab. This redirection is critical as it allows Copilot for Sales to re-initiate the secure authentication handshake with Salesforce.
• Enter your Salesforce credentials (username and password) as prompted. If your organization uses multi-factor authentication (MFA), complete any additional verification steps required.
• Upon successful login, Salesforce will issue new authentication tokens and establish a fresh session. Copilot for Sales will then automatically detect these new credentials and re-establish its connection to Salesforce.
• Once the connection is restored, you should be able to resume your activities in Copilot for Sales without further interruption.

This method is efficient because it leverages the existing error context to guide you directly to the re-authentication process, minimizing manual steps.

2. Sign Out of Copilot for Sales and Sign In Again¶

If clicking “Sign in again” from the error message does not resolve the issue, or if you prefer a more complete refresh of the connection, you can manually sign out of Copilot for Sales and then sign back into Salesforce. This ensures that any cached credentials or session information within Copilot for Sales are fully cleared before attempting a new connection.

• Locate the “More Options” or “Settings” menu within the Copilot for Sales pane in Outlook. This is typically represented by an ellipsis (…) or a gear icon.
• From the menu, select the “Sign out” option. This action will disconnect Copilot for Sales from your current Salesforce instance and clear its internal session state.
• After signing out, the Copilot for Sales pane will likely prompt you to sign in. Choose to sign in to Salesforce again when prompted.
• Similar to the previous method, you will be directed to the Salesforce login page. Enter your Salesforce credentials and complete any required multi-factor authentication.
• Once authenticated, Copilot for Sales will acquire new tokens and establish a new session, resolving the “Connection lost” error.

This method is particularly useful if you suspect any residual cached data might be interfering with the connection. It provides a clean slate for re-establishing the link between Copilot for Sales and Salesforce.

Advanced Troubleshooting Steps¶

While the primary resolution steps often resolve most connection issues, there are instances where deeper investigation or additional actions might be necessary. If the simple sign-in procedures do not restore your connection, consider the following advanced troubleshooting steps:

1. Clear Browser Cache and Cookies¶

For users accessing Outlook via a web client, or if the Copilot for Sales add-in leverages browser components, clearing the browser’s cache and cookies can eliminate corrupted or outdated session data.

• Close all instances of Outlook (web client) and Copilot for Sales.
• Clear your browser’s cache and cookies. Be mindful that this will log you out of other websites.
• Restart your browser and try signing into Outlook and Copilot for Sales again.

2. Verify Salesforce Account Status¶

Ensure that your Salesforce user account is active and not locked. If your account is suspended, locked due to too many failed login attempts, or deactivated, no amount of re-signing in from Copilot for Sales will work.

• Attempt to log into Salesforce directly through a web browser (e.g., login.salesforce.com). If you cannot log in there, the issue lies with your Salesforce account, not Copilot for Sales.
• Contact your Salesforce administrator if you suspect your account is locked or has been altered.

3. Check Salesforce Connected Apps OAuth Usage¶

Salesforce administrators have control over connected applications and their OAuth tokens. It’s possible that Copilot for Sales’ access has been inadvertently revoked or restricted.

• For Administrators: Navigate to Setup in Salesforce. In the Quick Find box, search for “Connected Apps OAuth Usage.”
• Review the entry for “Microsoft Copilot for Sales” (or “Microsoft Sales Copilot”).
• Ensure that the access is not revoked for the affected user. If it is, re-authorize the application or guide the user to sign in again to trigger re-authorization.

4. Review Salesforce Session Settings¶

If sessions are expiring too quickly, or if there are restrictive IP range policies, these Salesforce settings can cause frequent “Connection lost” errors.

• For Administrators: In Salesforce Setup, search for “Session Settings.”
• Review the “Timeout Value” for sessions. A very short timeout can lead to frequent re-authentication.
• Check “IP Range Restrictions” under Network Access. Ensure that users can access Salesforce from their expected network locations. Consider if users are frequently changing networks (e.g., remote work, VPNs).

5. Inspect Network Connectivity and Firewall Rules¶

While less common for session/token issues, local network problems or restrictive firewall settings can impede the communication between Copilot for Sales and Salesforce.

• Perform a basic network connectivity test. Can you access other external websites? Can you ping login.salesforce.com?
• Check local firewall or proxy settings that might be blocking outbound connections from Outlook or the Copilot for Sales add-in.
• Consult your IT department if you suspect corporate network policies or firewalls are interfering with cloud service connectivity.

6. Examine Azure AD Conditional Access Policies¶

If your organization uses Azure Active Directory (Azure AD) for user identity and leverages Conditional Access policies, these policies can impact access to connected apps like Copilot for Sales or Salesforce.

• For Administrators: Review Conditional Access policies in the Azure portal. Look for policies that apply to “Office 365” or “Salesforce” (if Salesforce is integrated with Azure AD for SSO).
• Policies enforcing specific device compliance, location, or MFA requirements could be blocking the connection if not met by the user’s current context.

7. Consult Copilot for Sales Logs (if available)¶

In some enterprise environments, administrators might have access to more detailed logging for add-ins or associated services. While not typically user-facing, these logs can provide granular error details.

• For Administrators: Check application logs or diagnostic tools provided by Microsoft for Office add-ins or Copilot for Sales. These can sometimes reveal specific API error codes from Salesforce or authentication failures.

Preventative Measures¶

To minimize the occurrence of “Connection lost” errors, both users and administrators can adopt best practices:

For Users:

• Regular Interaction: If possible, interact with Copilot for Sales and Salesforce regularly to keep sessions active and refresh tokens implicitly.
• Avoid Force-Quitting Applications: Improperly closing Outlook or your browser might not gracefully terminate sessions or save token information, potentially leading to issues on next launch.
• Understand Organizational Policies: Be aware of your organization’s Salesforce session timeout settings and any network restrictions that might affect your connectivity.

For Administrators:

• Review Session Settings: Periodically review Salesforce Session Settings to strike a balance between security and user convenience. Avoid overly aggressive timeouts unless strictly necessary.
• Monitor Connected Apps: Regularly monitor “Connected Apps OAuth Usage” in Salesforce to identify any unusual activity or revoked access for critical applications like Copilot for Sales.
• Communicate Policy Changes: Clearly communicate any changes to Salesforce security policies, session timeouts, or network restrictions to users, explaining how these might impact their Copilot for Sales experience.
• Ensure SSO/MFA Configuration is Robust: If using Single Sign-On (SSO) with Azure AD and Multi-Factor Authentication (MFA), ensure the configurations are robust and properly integrated to avoid authentication loops or failures.

By proactively managing these aspects, organizations can significantly reduce the incidence of connection errors, ensuring that sales teams can leverage Copilot for Sales without unnecessary disruptions.

Connection Troubleshooting Flow¶

Here’s a simplified visual flow summarizing the troubleshooting process:

```mermaid
graph TD
A[User experiences “Connection lost” error in Copilot for Sales] → B{Does the error prompt “Sign in again”?};
B – Yes → C[Click “Sign in again”];
B – No / Fails → D[Manually Sign out of Copilot for Sales];
C → E[Sign in to Salesforce in browser];
D → E;
E – Successful Login? → F{Connection Restored?};
E – Failed Login → G[Cannot access Salesforce directly. Contact Salesforce Admin.];
F – Yes → H[Issue Resolved.];
F – No → I[Advanced Troubleshooting Steps];

I --> J[Clear Browser Cache/Cookies (Web Client)];
I --> K[Verify Salesforce Account Status];
I --> L[Check Salesforce Connected Apps OAuth Usage (Admin)];
I --> M[Review Salesforce Session Settings (Admin)];
I --> N[Inspect Network/Firewall Rules];
I --> O[Examine Azure AD Conditional Access Policies (Admin)];
I --> P[Consult Copilot for Sales Logs (Admin)];
J & K & L & M & N & O & P --> Q[If still unresolved, engage experts.];

```

More Information¶

If your issue remains unresolved after attempting the steps outlined in this article, it is highly recommended to seek further assistance. The Microsoft Community Hub provides a platform to engage with experts, share your experiences, and find solutions from a broader knowledge base.

You can visit the dedicated Copilot for Sales - Microsoft Community Hub to interact with support professionals and fellow users:
How to Resolve Connection Issues in Copilot for Sales (Video Guide)

This community is an invaluable resource for complex or persistent issues, offering a collaborative environment for problem-solving.

---

Third-party information disclaimer

The third-party products, such as Salesforce, that this article discusses are manufactured by companies that are independent of Microsoft. Microsoft makes no warranty, implied or otherwise, about the performance or reliability of these products. This article serves as a guide for integrating and troubleshooting Microsoft products with specified third-party services.

---

We hope this comprehensive guide has helped you understand and resolve the “Connection lost” error in Copilot for Sales. Have you encountered this issue before, and what steps worked best for you? Share your experiences and insights in the comments below! Your feedback helps the community grow and improves troubleshooting for everyone.