Ignoring the SAS token, there are a number of people who ran into Oauth token errors that were generated because the session key ring was not propagated/shared in the expected way. The workaround for this (other than using a SAS token), is to switch to a named session key ring instead of the default:
Check your AzCopy Key:
keyctl show
Switch to a named session key ring:
keyctl session workaroundSession
After this, AzCopy should work as normal.
Reference: