Is it possible to adjust session/token lifetime?

Question

Hello,

I'm currently working with Entra External ID and have a requirement to adjust the session and token lifetimes for our applications.

Background:

• In Azure AD B2C, we could easily set session and token lifetimes within the properties of a user flow or by using custom policies.

Issue:

• In Entra External ID, I can't find any settings or configurations to adjust these session or token lifetimes.
• The portal doesn't seem to offer the same options as Azure AD B2C.
• Our applications require custom token lifetimes to meet specific security and compliance requirements.

Questions:

Is it possible to adjust the session and token lifetimes in Entra External ID?

• If yes, where can I find these settings?
  • Are there equivalent configurations to those in Azure AD B2C user flows or custom policies?
  If direct configuration isn't available:

  - What is the recommended approach to manage or customize session and token lifetimes in Entra External ID?
  
     - Are there any workarounds or best practices for achieving similar functionality?
  

Attempts to Resolve:

• Reviewed the Entra External ID documentation but didn't find relevant information on adjusting token lifetimes.
• Explored the portal settings for user flows and custom policies but couldn't locate any options related to session or token lifetimes.
• Searched for any updates or announcements that might indicate changes in how Entra External ID handles these settings.

Goal:

• To understand how we can control session and token lifetimes in Entra External ID, similar to how it's done in Azure AD B2C.
• Ensure that our applications comply with our organization's security policies regarding authentication session management.

We are using standard OpenID Connect and OAuth 2.0 protocols for authentication.

Our applications are a mix of web and mobile platforms that require consistent session management.

Thank you for your assistance!

Answer 1

Hi @Manuel T , Entra External ID does not provide the same direct configuration options for session and token lifetimes as Azure AD B2C but you can manage these settings in other ways.

Entra External ID does not expose token lifetime settings directly in the portal. Instead, you can manage session and token lifetimes using Sign-In Frequency (SIF) and Continuous Access Evaluation (CAE). These mechanisms allow you to control how often users need to re-authenticate and how tokens are validated in real-time.

• https://learn.microsoft.com/en-us/entra/identity/conditional-access/concept-continuous-access-evaluation
• https://learn.microsoft.com/en-us/entra/identity/conditional-access/howto-conditional-access-session-lifetime

For adjusting the refresh token lifetime, you should use Sign-In Frequency (SIF). This setting can be configured to specify how often users need to sign in again.

Continuous Access Evaluation (CAE) is recommended for applications that require token agility. CAE allows tokens to be validated in real-time, ensuring that any changes in user access or security policies are immediately enforced. This approach helps maintain security and compliance without the need for frequent token refreshes.

If you need to set specific token lifetimes, you can use PowerShell or REST APIs to configure these settings.

Please let me know if you have any questions and I can help you further.

If this answer helps you please mark "Accept Answer" so other users can reference it.

Thank you,

James