@Shanmukh -
This is marked as working again as of today, but Shanmukh’s question about resolution steps never got a real answer in this thread, and the same symptom showed up in a separate thread with a documented root cause and fix, worth capturing here in case the platform-side fix doesn’t hold for everyone.
The root cause SailPoint itself described in the ECA rollout announcement: Salesforce caps active refresh tokens at five per user per External Client App, and if a client tries to use a token that’s already been revoked or rotated out, Salesforce responds by invalidating every active refresh token and session for that user across all connected clients, not just the one that made the bad call. That lines up with Salesforce’s own documentation on refresh token rotation: with rotation enabled, every use of the refresh token issues a new one and immediately invalidates the previous one. So if ISC’s cached token ever falls even one rotation behind (a retry, overlapping aggregation runs, a second admin re-authorizing the same ECA), Salesforce can end up killing the whole session, and you’re back at the Authorize button.
The fix a SailPoint engineer posted in the parallel thread, “Salesforce ECA asking reauthenticate every time”: in Salesforce, go to Setup > External Client Apps > External Client App Manager, edit your ECA’s OAuth policy, confirm the scopes include refresh_token and offline_access, then disable “Enable Refresh Token Rotation” and save. Re-authorize from the ISC source afterward. This has to be done on the Salesforce side, not in ISC.
One snag reported in that same thread: a couple of admins found the refresh-token-rotation toggle greyed out, with Salesforce telling them those settings are hidden for installed apps. That tends to happen when the ECA was installed as a packaged app from AppExchange rather than set up as a standalone external client app. Nobody in that thread had a documented workaround for it, so it’s likely a case for Salesforce support or your AppExchange app owner rather than anything on the ISC side.
Since this thread reports the issue going away on its own, I’d read that as SailPoint having addressed something server-side, but I haven’t found a public confirmation of exactly what changed, so I wouldn’t assume it’s permanently fixed for every tenant configuration. If it comes back, the rotation setting above is the documented lever to pull.