How to Increase Access Token Lifetime to 24 Hours?

Question

I’m using the following URL to generate an Azure AD access token via Python:

https://login.microsoftonline.com/{tenant_id}/oauth2/v2.0/token

The token I get has a lifetime of 3600 seconds (1 hour), but I need it to last for 24 hours.

Is there any way to increase the access token lifetime using the Azure Portal or any other method?

Thanks!

Answer 1

Hello @Tushar Lakhotia,

Based on your description, I understand that you're looking to extend the access token lifetime for a specific registered application in your tenant—ideally making the token valid for 24 hours instead of the default 1 hour.

It's possible and this can be achieved by configuring a token lifetime policy and assigning it to your application. Please note that this policy will apply only to the specific application and not at the tenant level. For example, if you assign a token lifetime policy with a 22-hour duration to App1, then all access, ID, or SAML tokens issued for App1 will respect that duration. All other applications in the tenant will continue using the default 1-hour (3600 seconds) lifetime.

For detailed steps, refer to the official documentation below. I’ve also included screenshots from my test tenant:

Configure token lifetime policies (preview)

Step 1: Create the Token Lifetime Policy

You can create the policy using Graph Explorer:

Request:

POST https://graph.microsoft.com/v1.0/policies/tokenLifetimePolicies
Content-Type: application/json

Request Body:

{
    "definition": [
        "{\"TokenLifetimePolicy\":{\"Version\":1,\"AccessTokenLifetime\":\"23:59:00\"}}"
    ],
    "displayName": "Contoso token lifetime policy",
    "isOrganizationDefault": false
}

Paste this JSON into the "Request Body" section of Graph Explorer.

In the "Request Headers," set: Content-Type: application/json

Under "Modify permissions," grant Policy.ReadWrite.ApplicationConfiguration

Click Run query to create the policy. You’ll get a response containing the policy ID.

Step 2: Assign the Policy to the Application

Next, assign this policy to the service principal of your app.

Request:

POST https://graph.microsoft.com/v1.0/servicePrincipals/{sp-object-id}/tokenLifetimePolicies/$ref
Content-Type: application/json

Request Body:

{

  "@odata.id":"https://graph.microsoft.com/v1.0/policies/tokenLifetimePolicies/00aa00aa-bb11-cc22-dd33-44ee44ee44ee"

}

Replace {sp-object-id} with the object ID of your app’s service principal (available in the Enterprise Applications blade).

Replace {policy-id} with the ID returned when you created the policy.

Ensure you’ve granted Application.ReadWrite.All permissions.

Run the query. A successful response confirms the policy has been assigned.

Step 3: Validate the Token

Now, generate an access token for your application and check its expiration (exp claim) and audience (aud claim). The token should now reflect the configured lifetime (e.g., 23 hours 59 minutes).

In my case, I configured the policy for 23 hours and 59 minutes, and I was able to successfully obtain a token with the expected validity period, as defined by my policy.

If you observe the screenshot above, you’ll see that I have assigned my token lifetime policy to my application with client ID 1158b426-d00d-4327-8a3b-2a8907d7650c, and the token was indeed issued for my app (as indicated by the aud claim).

The audience claim plays a crucial role when testing token lifetime policy scenarios. This is because if your application requests a token using Microsoft Graph as the resource, the issued token will have a default lifetime of 1 hour, regardless of the custom policy applied.

This is expected behavior. The token lifetime policy was applied to your web application, not to Microsoft Graph, which is a first-party resource. It is not recommended to assign custom token lifetime policies to first-party resources like Microsoft Graph, as it acts as an aggregator for multiple services across Azure and Microsoft 365. Modifying its token settings could inadvertently impact the behavior of other Microsoft services.