Refresh tokens expire after 12 hours using Microsoft Entra External ID native authentication with OTP

Thank you for your engagement here Sasha!

Thank you very much for your answer!

I have a SPA site where I use Microsoft Entra External ID together with MSAL. When I use one-time passcode, users have to log in every day with a new one-time passcode. If I use password, they don't have to type the their password again, the next day.

But if I create a policy in Microsoft Entra External ID, where Sign-in frequency is set to 365 days, users created with one-time passcode don't have to log in with a new one-time passcode every day, have I understood correctly?

Thanks a lot @Sasha Mars for your reply! I verified it and noticed it works.
I have turned it into a step/step blog post, mean while: https://dev.to/samvanhoutte/fixing-aadsts700082-refresh-tokens-expiring-after-12-hours-in-azure-entra-external-id-1mj0

My site is a SPA site. I created a policy with a login frequency of 90 days. It still doesn't help. For OTP users I get a refresh token that lasts 24 hours and after the 24 hours I have to enter a new passcode, which is sent by email.

Hey @Martin May ,

No unfortunately no answer that works yet. Check the comments on James's Hamil's answer for a continuation of the discussion.

The reason the proposed suggestions don't apply is because the suggestions are for Azure B2C, whereas I'm looking for an answer for Azure Entra External ID.

I suspect that this can't be changed for email OTP authentication as the documentation says that the maximum length of the session is 24 hours; it's logical that the lifetime of the refresh token is shortened to 12 hours.
https://learn.microsoft.com/en-us/entra/external-id/one-time-passcode#:~:text=One%2Dtime%20passcodes%20are,no%20longer%20needs%20access.
This seems to be hardcoded for quest accounts with OTP authentication.

I believe only using Entra B2C with email/password authentication can have longer sessions.

I don't think that documentation applies to Entra External ID native auth with OTP because:

• it discusses workforce tenants instead of external tenants
• it discusses guest users, whereas the users i see in azure entra external id that signed up with native auth and OTP are members

The closest statement that i've found relating to refresh tokens for the external ID platform is this one: https://learn.microsoft.com/en-us/entra/identity-platform/refresh-tokens#token-lifetime

So i'll take microsoft on their word when they state:

The default lifetime for the refresh tokens is 24 hours for single page apps and 90 days for all other scenarios.

In the Azure AD B2C tenant, the token lifetime could be configured as part of "user flows" - but it seems to have been removed in Entra External ID.

Hi @Martin May , so sorry for the delay in response. I'm going to open a support ticket to look into this further.

Best,

James

Hi @James Hamil ,

Your suggestion mentions Azure AD B2C, though I'm looking for a solution for refresh tokens using Entra External ID. As far as I know B2C is a separate offering from Entra External ID, unless setting policies in B2C somehow affects policies in Entra External ID?

In any case if I attempt to do the equivalent of what you suggested in Entra External ID I can only set AccessTokenLifetime. Any refresh token related properties (rolling_refresh_token_lifetime, refresh_token_lifetime) will result in this error response for the tokenPolicy endpoint. If you see mistakes in formatting or syntax in the request please let me know.

Request: 
POST https://graph.microsoft.com/v1.0/policies/tokenLifetimePolicies
Authorization: Bearer <accessToken>
{
    "definition": [
        "{\"TokenLifetimePolicy\": {\"Version\": 1, \"AccessTokenLifetime\": \"23:59:59\"\"RefreshTokenLifetime\": \"90:00:00:00\",\"RollingRefreshTokenLifetime\": \"90:00:00:00\"}}"
    ],
    "displayName": "default-refresh-token-policy",
    "isOrganizationDefault": true
}

Response: 
400: Bad Request
{
    "error": {
        "code": "Request_BadRequest",
        "message": "Property definition has an invalid value.",
        "details": [
            {
                "code": "InvalidValue",
                "message": "Property definition has an invalid value.",
                "target": "definition"
            }
        ],
        "innerError": {
            "date": "2024-10-03T08:00:16",
            "request-id": "<uuid>",
            "client-request-id": "<uuid>"
        }
    }
}

The inability to set refresh token related values seems to be confirmed by this statement:

As of January 30, 2021 you cannot configure refresh and session token lifetimes

What should i do instead to configure refresh token lifetime longer than 12 hours for Entra External ID?

@Niek Bijman Oops! Sorry about that. Misread your question. For External ID you would have to use Sign-In Frequency control: https://learn.microsoft.com/en-us/entra/identity/conditional-access/howto-conditional-access-session-lifetime

Please let me know if you have any questions!

Hey James Hamil,

No worries thanks for helping out! Regarding Sign-In Frequency control I run into this issue which is on this thread where I added a comment.

The main issue i reference here

Hi @James Hamil The Session option in Conditional Access policy is disabled in Entra External ID (as @rosskoes05 & @Ryan Buening have mentioned), which prevents us from configuring the Sign-In Frequency in the way you suggested

So basically we can't configure Sign-In Frequency in Entra External ID because the Session option states 'Not Available' (see screenshot). Sign-in Frequency is defined under the session options, so since it's not available we can't change any Sign-In settings

Hi @James Hamil , would you be able to help or share it with someone who can help? If the answer is that External ID has 0 options to solve this problem then I can just move on and switch to B2C or other platforms.

As a last attempt we tried the browser delegated example to check whether it was the Native Authentication flow that was problematic.

Sample
ms-identity-ciam-browser-delegated-android-sample

However with the browser delegated sample we into the same refresh token limit of 12:00:00

We've decided to switch to Azure B2C to avoid dealing with this problem.