Quick answer: On resume, refresh the user via XalUserGetGamerPicture / XalUserGetId. Acquire a fresh XSTS token before calling any Xbox Live service.

An Xbox Series X game suspends during a multiplayer match. On resume 10 minutes later, all online services fail. Leaderboards, stats, voice chat — nothing works. Cached tokens expired during suspend.

Listen for Resume

winrt::Windows::ApplicationModel::Core::CoreApplication::Resuming([](IInspectable const&, IInspectable const&) {
    RefreshXboxLiveServices();
});

UWP/GDK lifecycle. On Resuming, refresh state.

Refresh User and Token

void RefreshXboxLiveServices() {
    XUserHandle user = nullptr;
    HRESULT hr = XalUserGetByLocalId(&localUserId, &user);
    if (FAILED(hr) || !user) {
        PromptSignIn();
        return;
    }
    // fetch fresh XSTS token
    XAsyncBlock* asyncBlock = new XAsyncBlock{};
    asyncBlock->callback = [](XAsyncBlock* a) {
        OnTokenRefreshed(a);
        delete a;
    };
    XalUserGetTokenAndSignatureSilentlyAsync(user, &args, asyncBlock);
}

XAL silent token refresh: gets a new XSTS without prompting the user.

Reconnect Services

void OnTokenRefreshed(XAsyncBlock* async) {
    // recreate XblContext with fresh token
    XblContextCreateHandle(currentUser, &xblContext);
    // reconnect multiplayer / stats / etc.
    RejoinMatchSession();
}

Rebuild any context derived from the user. Multiplayer sessions need rejoin; matchmaking re-register.

Handle Sign-Out Mid-Suspend

The user might have signed out while your game was suspended. XalUserGetByLocalId returns failure; in that case, return to title or show sign-in prompt:

if (FAILED(hr)) {
    ShowGameOverPrompt("User signed out. Return to title.");
    TransitionToTitleScreen();
}

Verifying

Sign in, start online match, suspend (Xbox button → Quick Resume), wait 10 minutes, resume. Game should restore service connection without user friction. Multiplayer session rejoins or politely fails with retry option.

“Suspend/resume is a network state change. Treat it as ‘you were offline; reconnect’ and your code stays robust.”

For TCR compliance, suspend/resume robustness is a checklist item. Test thoroughly — it’s the most common cert failure for online games.