Notice: This website is an unofficial Microsoft Knowledge Base (hereinafter KB) archive and is intended to provide a reliable access to deleted content from Microsoft KB. All KB articles are owned by Microsoft Corporation. Read full disclaimer for more details.
AOS loads AAD signing certificates during startup and doesn't refresh them afterwards. As a result, AOS stops trusting any authentication tokens when AAD switches to signing certificates that were not known when AOS started, and no users can login to AX.
This issue can be worked around by restarting all the AOS instances.
AOS binary update adds a process that regularly refreshes the list of trusted AAD certificates.