Why did refresh tokens expire after 12 hours in Microsoft Entra External ID?

Question

Why did refresh tokens expire after 12 hours in Microsoft Entra External ID?

MN-2964 0

Background

I'm developing a React Native Expo mobile app (running on both Android and iOS) that uses Microsoft Entra External ID for browser-delegated authentication via the expo-auth-session library.

Users authenticate using email with password.
The app registration is configured as a "mobile and desktop application" in platform settings.
It has permission to access my web API app registration's scope.

Problem

I occasionally received the AADSTS700082 error when trying to refresh tokens, specifically:

"The refresh token has expired due to inactivity. The token was issued on {issueDate} and was inactive for 12:00:00."

Others have reported the same issue here.

After making several configuration changes, the error no longer occurs. However, I'm not sure which change fixed it, and I can't reproduce the error for further testing.

Configuration Changes Made

These are the configurations I remember making (mainly to add claims to the ID token):

Modified token configuration settings
Updated API permissions
Made changes to the application manifest
Modified user flow to include custom attributes

Questions

Why was I receiving that error message, when according to this documentation, refresh tokens should last 90 days for mobile apps?
Which of my configuration changes likely resolved the issue?
Are there known circumstances where mobile app refresh tokens expire after 12 hours of inactivity despite the documented 90-day lifetime?

Bandela Siri Chandana 3,075 Reputation points Moderator

2025-03-20T07:32:51.2266667+00:00

Hi @MN-2964
I understand that you are developing a React Native Expo mobile app (running on both Android and iOS) that uses Microsoft Entra External ID for browser-delegated authentication via the expo-auth-session library and users authenticate using email with password.

You are encountering AADSTS700082 error, and the issue is resolved. This issue will be resolved when you modify token configuration settings.

Yes, refresh tokens should last 90 days for mobile apps but refresh tokens expiring after 12 hours this is because there may be any conditional access policy applying on it and make sure you are not switching your network settings from public to private or vice versa.

Hope this helps. Do let us know if you have any further queries.
Bandela Siri Chandana 3,075 Reputation points Moderator

2025-03-21T05:07:52.6666667+00:00

Hi @MN-2964
Just checking in to see if above information was helpful. If you have any further updates on this issue, please feel free to post back.
Bandela Siri Chandana 3,075 Reputation points Moderator

2025-03-24T02:56:35.02+00:00

Hi @MN-2964
Just checking in to see if above information was helpful. If you have any further updates on this issue, please feel free to post back.
Michael Czeczot 5 Reputation points

2025-04-24T12:59:18.5366667+00:00

I would imagine he came back to you because the answer you have given is incorrect. You cannot control the refresh token with conditional access in Microsoft Entra External ID as that section is unavailable.
MCAR 5 Reputation points

2025-09-20T20:15:16.34+00:00

I have this issue right now and can't figure out how to fix it. The documentation for this, and how much garbage is held behind the scenes in Entra External ID is horrible. I really wish I had just gone with something like Firebase, Entra has been a terrible experience. Between MS branding having called B2C entra so much, that now their own people answer Tech Support with B2C answers when they are DIFFERENT PRODUCTS. This has just been a terrible experience and I'm so exhausted from dealing with it. Guess what, if OTP is going to have issues, let me turn it off and pull it out completely from my IdPs. Like this is not a finished product, and they should not be forcing people onto it.

Your answer

Bandela Siri Chandana 3,075 Reputation points Moderator

2025-03-20T07:32:51.2266667+00:00

Hi @MN-2964
I understand that you are developing a React Native Expo mobile app (running on both Android and iOS) that uses Microsoft Entra External ID for browser-delegated authentication via the expo-auth-session library and users authenticate using email with password.

You are encountering AADSTS700082 error, and the issue is resolved. This issue will be resolved when you modify token configuration settings.

Yes, refresh tokens should last 90 days for mobile apps but refresh tokens expiring after 12 hours this is because there may be any conditional access policy applying on it and make sure you are not switching your network settings from public to private or vice versa.

Hope this helps. Do let us know if you have any further queries.
Bandela Siri Chandana 3,075 Reputation points Moderator

2025-03-21T05:07:52.6666667+00:00

Hi @MN-2964
Just checking in to see if above information was helpful. If you have any further updates on this issue, please feel free to post back.
Bandela Siri Chandana 3,075 Reputation points Moderator

2025-03-24T02:56:35.02+00:00

Hi @MN-2964
Just checking in to see if above information was helpful. If you have any further updates on this issue, please feel free to post back.
Michael Czeczot 5 Reputation points

2025-04-24T12:59:18.5366667+00:00

I would imagine he came back to you because the answer you have given is incorrect. You cannot control the refresh token with conditional access in Microsoft Entra External ID as that section is unavailable.
MCAR 5 Reputation points

2025-09-20T20:15:16.34+00:00

I have this issue right now and can't figure out how to fix it. The documentation for this, and how much garbage is held behind the scenes in Entra External ID is horrible. I really wish I had just gone with something like Firebase, Entra has been a terrible experience. Between MS branding having called B2C entra so much, that now their own people answer Tech Support with B2C answers when they are DIFFERENT PRODUCTS. This has just been a terrible experience and I'm so exhausted from dealing with it. Guess what, if OTP is going to have issues, let me turn it off and pull it out completely from my IdPs. Like this is not a finished product, and they should not be forcing people onto it.