Why did refresh tokens expire after 12 hours in Microsoft Entra External ID?

MN-2964 0 Reputation points
2025-03-18T02:36:01.8733333+00:00

Background

I'm developing a React Native Expo mobile app (running on both Android and iOS) that uses Microsoft Entra External ID for browser-delegated authentication via the expo-auth-session library.

  • Users authenticate using email with password.
  • The app registration is configured as a "mobile and desktop application" in platform settings.
  • It has permission to access my web API app registration's scope.

Problem

I occasionally received the AADSTS700082 error when trying to refresh tokens, specifically:

"The refresh token has expired due to inactivity. The token was issued on {issueDate} and was inactive for 12:00:00."

Others have reported the same issue here.

After making several configuration changes, the error no longer occurs. However, I'm not sure which change fixed it, and I can't reproduce the error for further testing.

Configuration Changes Made

These are the configurations I remember making (mainly to add claims to the ID token):

  • Modified token configuration settings
  • Updated API permissions
  • Made changes to the application manifest
  • Modified user flow to include custom attributes

Questions

  1. Why was I receiving that error message, when according to this documentation, refresh tokens should last 90 days for mobile apps?
  2. Which of my configuration changes likely resolved the issue?
  3. Are there known circumstances where mobile app refresh tokens expire after 12 hours of inactivity despite the documented 90-day lifetime?
Microsoft Entra External ID
Microsoft Entra External ID
A modern identity solution for securing access to customer, citizen and partner-facing apps and services. It is the converged platform of Azure AD External Identities B2B and B2C. Replaces Azure Active Directory External Identities.
3,130 questions
{count} votes

Your answer

Answers can be marked as Accepted Answers by the question author, which helps users to know the answer solved the author's problem.