Azure AD - Setting the accessTokenAcceptedVersion

Question

In our Azure AD instance, we were using auth code to request a token. Looking at the JWT, it's returning ver: 1.0.

Examining the manifest, we found that it had
accessTokenAcceptedVersion: null

So we changed to:
accessTokenAcceptedVersion: 2

However, even an hour later, we're still getting 1.0 tokens.

Is there another setting here? Might it take longer than an hour for this setting change to propagate?

Answer 1

Hi @Maddock, Geoffrey ,

Following up on the previous comment, the official documentation about the accessTokenAcceptedVersion is Understanding the Azure Active Directory app manifest - Microsoft Entra | Microsoft Learn and Microsoft identity platform access tokens - Microsoft Entra | Microsoft Learn The setting does not force Azure AD to issue a V2 token, but is a setting on a resource app (Web API):

"Resources need to explicitly configure accesstokenAcceptedVersion to indicate the supported access token format."

So for some non-customer-owned resource apps, a client app cannot adjust this setting and has to accept whichever version of token is supported by the resource app. The accessTokenAcceptedVersion is a setting for a resource app, instead of for a client app to force a V2 token.

-

If the information helped you, please Accept the answer. This will help us and other members of the community who might be researching similar information.