MSAL refresh token expires after 24 hours for mobile and desktop app when using OTP

Question

Good afternoon,

We are using MSAL library to obtain an access token and refresh token for a mobile and desktop app. The refresh token expires after 24 hours if not used...due to inactivity... and we expect to last 90 days... according with documentation.

Is there a way to extend the expiration period ? Our users can shut down the PC or mobile devices and restart them after more than 24 hours...so we want to avoid asking them to login again.

Thank you,

Gabriel

Answer 1

Hi Gabriel Mihai

You're right to expect the refresh token to last up to 90 days based on Microsoft Identity Platform documentation, but there are important points tied to how refresh token lifetime and rotation work in modern applications using MSAL and the Microsoft Identity Platform.

By default, Microsoft enforces refresh token inactivity expiration, which causes the token to expire if it is not used within 24 hours. This is part of the Continuous Access Evaluation (CAE) model. For mobile and desktop applications (public clients), the refresh token is designed to last up to 90 days. However, this is a rolling window the token remains valid for up to 90 days as long as it is used at least once every 24 hours. If the token is not used within a 24-hour period, it becomes inactive and expires, requiring the user to re-authenticate.

So, if a refresh token is not used within 24 hours for example, if a user shuts down their device for more than a day, it will expire due to inactivity, and the user will need to sign in again.

Additionally, Conditional Access policies cannot be configured for public client applications (desktop/mobile). While there is an option to configure persistent session behavior via Conditional Access, it only applies to browser sessions and has no effect on mobile or desktop app token lifetimes.

Therefore, in your scenario, there is currently no supported way to extend the refresh token expiration period beyond the 24-hour inactivity window.

Hope this helps. Do let us know if you any further queries.

Please remember to "Accept Answer" if answer helped you. This will help us as well as others in the community who might be researching similar questions.

Answer 2

Hello Gabriel Mihai,

The default lifetime for the refresh tokens is 24 hours for single page apps (SPA) and 90 days for all other scenarios. Refresh tokens sent to a redirect URI registered as spa expire after 24 hours.

Additional refresh tokens acquired using the initial refresh token carry over that expiration time, so apps must be prepared to rerun the authorization code flow using an interactive authentication to get a new refresh token every 24 hours. Users don't have to enter their credentials and usually don't even see any related user experience, just a reload of your application. (More information https://learn.microsoft.com/en-us/entra/identity-platform/refresh-tokens)

So your app is probably defined as a SPA application, and when user shut down the PC or mobile devices and restart them after more than 24 hours (inactivity), the token will be expired. You can check if the app is created as a SPA.

Other option is you can try to use sign-in frequency in conditional access policy, please check: https://learn.microsoft.com/en-us/entra/identity/conditional-access/howto-conditional-access-session-lifetime

Kindly let me know if this work for you and please let me know if you have any further questions.

If I have answered your question, please accept this answer as a token of appreciation and don't forget to give a thumbs up for "Was it helpful"!

Best regards,

Answer 3

The refresh token life and use is controlled by configuration of the host returning the tokens. For Entra Id, the default for a SPA app is 24 hours else 90 days. So your app is probably defined as a SPA application:

https://learn.microsoft.com/en-us/entra/identity-platform/refresh-tokens

other config options

https://learn.microsoft.com/en-us/entra/identity/conditional-access/howto-conditional-access-session-lifetime

there is also:

https://learn.microsoft.com/en-us/entra/identity-platform/security-best-practices-for-frontline-workers