Azure SCIM User provisioning - Long lived bearer token standard validity

Question

Hi Team,

For our enterprise's user provisioning SCIM application, we are planning to use Long lived bearer token for application authentication. Could you please suggest the standard approach for the token expiry duration. Is it allowed to generate a never expire bearer token?

Answer 1

For tokens issued by your application for use in accessing the app's SCIM server endpoints, it is allowable to issue non-expiring bearer tokens, or tokens with expiration dates so far in the future that they are functionally non-expiring. This doesn't align with best practices from a security standpoint, however.

If this is an internal application only used by your company, then right now bearer tokens are your only option. If this is an application intended to be added to the Enterprise App gallery, then I'd instead suggestion implementing OAuth 2.0 Authorization Code Grant or Client Credential Grant flows.

Answer 2

@Ruchi

Thank you for posting your question in Microsoft Q&A.

Creating a never expire token for application in Azure is not possible.

However, you can configure the lifetime for an access token.

You can refer below articles to know more about the default lifetime of tokens and also configuring lifetime of tokens,

https://learn.microsoft.com/en-us/azure/active-directory/develop/configurable-token-lifetimes

https://learn.microsoft.com/en-us/azure/active-directory/develop/configure-token-lifetimes

Let me know if you have any further questions.

Please "Accept the answer" if the information helped you. This will help us and others in the community as well.