We are currently using Cognos Analytics 11.2.4 with Microsoft Entra ID (formerly Azure AD) as the authentication provider — configured using the Microsoft Identity integration. All users authenticate through MFA, in accordance with corporate policy.
We’re encountering a persistent issue where scheduled jobs (such as report generation) fail due to expired refresh tokens.
This typically happens within 1–4 weeks, depending on token lifetime policies, and is accompanied by errors like:
CM-REQ-4159 Content Manager returned an error in the response header.
cmAuthenticateFailed CM-CAM-4005 Unable to authenticate.
CAF-WRN-2082 An error has occurred. Please contact your administrator.
We’ve reviewed existing forum posts and IBM documentation, and understand this is expected behavior when using MFA with refresh_token authentication strategy.
We also tested switching to the id_token strategy, but this is not supported in combination with MFA, and leads to login failures.
Business context:
-
We cannot disable MFA due to corporate security policies.
-
We need scheduled jobs to run reliably, even if a user's token has expired — since these jobs don’t require interactive access or live user credentials to retrieve data.
We understand that Cognos enforces token checks for security reasons (e.g., to ensure the account is still valid and hasn’t been deactivated).
However, we’re looking for a supported or practical way to run scheduled jobs in the background, without being blocked by token expiration.
We have considered creating a separate authentication provider with service accounts, but this is a workaround and introduces complexity for users.
We are hoping to find a more integrated and secure solution.
Question:
Is there any supported way in Cognos to allow scheduled jobs to run independently of token expiration, or to decouple job execution from interactive token checks — especially in an MFA environment?
Any suggestions or insights would be greatly appreciated.