Lifetime of login token - Azure Managed Grafana

@Bart van Dooren , Please find below details of the token/access management as used in Azure Managed Grafana

1. We keep a login session cookie for 24 hours so that user doesn't need to log in frequently. If the session cookie times out, the client (normally browser) will automatically be redirected to AAD for login. Once the user logs in, the browser will be automatically redirected back to the previous location of the Grafana instance (together with user's access token/refresh token). Since it's based on single-signon, as long as the client has been logged into AAD, typically user doesn't need to do anything explicitly or even notice it.
2. Once the user logs into Grafana, we will do Azure RBAC to check user's permission. This permission check result is normally cached for 5min only, i.e., if the user is granted different permission, there may be delay of up to 5min for the new role to be effective.
3. We use some of the information in the user's access token for Azure RBAC check-in as mentioned in point 2. From Managed Grafana standpoint, there are no changes with token lifetime, so it accepts whatever lifetime is received for the token from Azure Active Directory, and this is stored in a cookie. Managed Grafana instance refreshes the token when it’s less than 30 sec from expiration and the new token gets put back into the cookie. This is done only if a refresh token is available in the cookie which was available in the very first original authentication process.

Therefore, from usage of view, two time matters here:

1. session cookie for Azure Grafana instance times out after 24 hours. There will be automatic re-login
2. Role assignment change may take up to 5min to be effective (once it's propagated by Azure RBAC, which is normally fast but could take longer)

Hope this helps.

If the answer did not help, please add more context/follow-up question for it, and we will help you out. Else, if the answer helped, please click Accept answer so that it can help others in the community looking for help on similar topics.