Share via

Facing Issue in TokenLifeTime Policy

Gagan Gupta 0 Reputation points
2025-04-21T09:51:15.0866667+00:00

Hi,

We're encountering issues while trying to set a 24-hour access token lifetime ("23:59:59") for a specific app using client credentials flow with the /oauth2/v2.0/token endpoint.

The TokenLifetimePolicy is created and assigned to the service principal.

It shows as assigned, but the token lifetime remains 1 hour.

  • If we set "isOrganizationDefault": true, it works — but applies to all apps in the tenant, which is a security concern because it overrides the token lifetime for all applications within the tenant, rather than being scoped to a specific app.

Is this a limitation we’re encountering, or is there something we’re missing?

Reference: https://learn.microsoft.com/en-us/graph/api/resources/tokenlifetimepolicy?view=graph-rest-1.0 https://learn.microsoft.com/en-us/graph/api/application-post-tokenlifetimepolicies?view=graph-rest-1.0&tabs=javascript

Thanks

Microsoft Graph
Microsoft Graph
A Microsoft programmability model that exposes REST APIs and client libraries to access data on Microsoft 365 services.
13,598 questions
0 comments

2 answers

Sort by: Most helpful
Most helpful Newest Oldest
  1. Andy David - MVP 155.9K Reputation points MVP Moderator
    2025-04-21T11:13:29.16+00:00

    Have you tried setting for a specific app following this?

    https://learn.microsoft.com/en-us/entra/identity-platform/configure-token-lifetimes

    Note that it is preview

  2. Andy David - MVP 155.9K Reputation points MVP Moderator
    2025-04-21T13:24:09.79+00:00
    0 comments

Your answer

Answers can be marked as Accepted Answers by the question author, which helps users to know the answer solved the author's problem.