[US/EU] Sandbox Apps - Microsoft 365 - Authentication Failures Using Nylas Shared Credentials

Update timeline

1. investigating Oct 22, 2026, 10:08 AM UTC

   We are investigating Microsoft / Office 365 authentication failures affecting Sandbox applications in the US and EU regions that use Nylas-provided shared credentials. Affected users may encounter errors when connecting new Microsoft accounts or re-authenticating existing accounts. Production applications, Sandbox applications using their own Microsoft Azure credentials, and existing active connections are not affected. Our Engineering team is actively working to restore normal authentication functionality.

2. investigating Oct 22, 2026, 11:07 AM UTC

   We have identified an expired credential affecting Microsoft / Office 365 authentication for Sandbox applications using Nylas-provided shared credentials. Replacement credentials have been deployed for newly created Sandbox applications. Our Engineering team is continuing work to restore authentication functionality for existing Sandbox applications that may still be affected. Production applications, applications using their own Microsoft Azure credentials, and existing active connections remain unaffected. We will provide additional updates as remediation progresses.

3. identified Oct 22, 2026, 11:58 AM UTC

   We have identified an expired credential affecting Microsoft / Office 365 authentication for Sandbox applications using Nylas-provided shared credentials. Updated credentials have been deployed for newly created Sandbox applications, and we are now deploying a fix for existing affected Sandbox applications. Once available, affected users may need to refresh their credentials in the Nylas Dashboard and re-authenticate any impacted Microsoft accounts. This issue is limited to Sandbox applications using Nylas shared Microsoft credentials. Production applications and applications using their own Microsoft Azure credentials are not affected. We will provide another update as the fix is rolled out.

4. identified Oct 22, 2026, 01:59 PM UTC

   Deployment of the fix for existing affected Sandbox applications is progressing, and our Engineering team is now completing final testing and validation. Once testing is complete, we will provide additional instructions for affected customers, including any steps required to restore Microsoft authentication. Production applications and applications using their own Microsoft Azure credentials remain unaffected.

5. identified Oct 22, 2026, 03:53 PM UTC

   Mitigated - We have deployed a fix for Microsoft / Office 365 authentication failures affecting Sandbox applications using Nylas-provided shared credentials. Affected customers can now restore authentication using the following steps: Step 1: Update your Sandbox credentials 1. Sign in to the Nylas Dashboard at https://dashboard.nylas.com. 2. Open your affected Sandbox application. 3. On the Overview or Connectors page, locate the expired Microsoft credential warning and click Update credential. 4. Confirm that the green "Microsoft credential updated" message appears. If you do not see the warning banner, navigate to Connectors, select your Microsoft connector, and save it without making any changes. This will also apply the updated credentials. Step 2: Reauthenticate affected Microsoft accounts (if needed) 1. Click View invalid Microsoft grants in the confirmation banner, or navigate to Grants and filter by Provider = Microsoft and Status = Invalid. 2. Reauthenticate any invalid grants using your application's normal Hosted Authentication flow. Existing valid connections do not require reauthentication, and new Microsoft accounts can connect normally once the credentials are updated. Additional remediation underway: We are also testing an automated bulk update for existing Sandbox applications to reduce the need for manual credential updates. Any grants that became invalid will still require reauthentication. Production applications and applications using their own Microsoft Azure credentials remain unaffected. We will provide a final update once the remaining remediation work is complete.