Why did refresh tokens expire after 12 hours in Microsoft Entra External ID?
Background
I'm developing a React Native Expo mobile app (running on both Android and iOS) that uses Microsoft Entra External ID for browser-delegated authentication via the expo-auth-session
library.
- Users authenticate using email with password.
- The app registration is configured as a "mobile and desktop application" in platform settings.
- It has permission to access my web API app registration's scope.
Problem
I occasionally received the AADSTS700082 error when trying to refresh tokens, specifically:
"The refresh token has expired due to inactivity. The token was issued on {issueDate} and was inactive for 12:00:00."
Others have reported the same issue here.
After making several configuration changes, the error no longer occurs. However, I'm not sure which change fixed it, and I can't reproduce the error for further testing.
Configuration Changes Made
These are the configurations I remember making (mainly to add claims to the ID token):
- Modified token configuration settings
- Updated API permissions
- Made changes to the application manifest
- Modified user flow to include custom attributes
Questions
- Why was I receiving that error message, when according to this documentation, refresh tokens should last 90 days for mobile apps?
- Which of my configuration changes likely resolved the issue?
- Are there known circumstances where mobile app refresh tokens expire after 12 hours of inactivity despite the documented 90-day lifetime?