Response from /oauth2/v2.0/token does not include Refresh Token

Question

Hello,

we're currently gettin our access & refresh tokens via ADAL 4J but want to transition to the Auzre AD Rest APIs. Unfortunately, unlike stated in the documentations, the endpoint which yields an access token does not include a refresh token. We are calling the followung URL:

POST https://login.microsoftonline.com/{tenantId}/oauth2/v2.0/token

with the following parameters:

• client_id, client_secret of the application
• grant_type: password
• scope: user.read

why is the refresh token missing? Unfortunately the refresh token is very important for our frontends.

Answer 1

You need to explicitly request the refresh token, by including the offline_access scope. It's detailed for example here: https://learn.microsoft.com/en-us/azure/active-directory/azuread-dev/azure-ad-endpoint-comparison#offline-access