OAuth expires_in value is incorrect

Question

I registed an Azure app show as below

And get token following device code grant, https://learn.microsoft.com/en-us/azure/active-directory/develop/v2-oauth2-device-code .

Step 1.1 Get user_code and device_code

Step 1.2 After 300 seconds visit the https://microsoft.com/devicelogin in the browser , and login with test_oauth_graph@harsh.com .com account

Why does user_code become invalid after only 300 seconds?

Try another request.
Step 2.1 Get user_code and device_code

Step 2.2 After 600 seconds visit the https://microsoft.com/devicelogin in the browser , and login with ******@scarecrowkakashihotmail.onmicrosoft.com account

Why user_code is valid longer than 600 seconds in Step 2.1-2.2, but user_code is valid less than 300 seconds in Step 1.1-1.2?

Answer 1

Hello @scarecrow kakashi ,

• We were able to engage the product group and have identified this to be a bug.
• Thanks for highlighting this issue on consumer and common endpoints. Our dev team is now working on this.

Workaround:

• The code is not accepted whenever the request is routed to common endpoint.
• Like in first case /common endpoint is used which causes the issue.
• In 2nd case /organization endpoint is used which works fine with all Guest and wok accounts. I am yet to hear from the dev team on this. Will keep you posted with further updates here.

Let me know if you have any queries.

Thanks,
Akshay Kaushik

Please "Accept the answer" and "Upvote" if the suggestion works as per your business need. This will help us and others in the community as well.