How to reduce SPA web session lifetime Angular + Azure AD B2C

Question

I want to reduce the web session duration for our Angular SPA from the default 24 hours to 10 hours. I’ve already configured it as shown in the screenshot below, but the session still lasts 24 hours. What should I do?

Answer 1

Hi Mahmoud Parandeh

Thanks for using the Q&A platform.

Azure B2C uses long-lived refresh tokens typically valid for 24hr even if the session expires on the server, your Angular app may silently renew tokens unless explicitly restricted via RefreshTokenLifetime settings, which is only configurable in custom policies.

To fully enforce a 10-hour session lifetime for your Angular SPA with Azure AD B2C, my recommendation would be to use custom policies.

Kindly find Microsoft documentation: https://learn.microsoft.com/en-us/azure/active-directory-b2c/session-behavior?pivots=b2c-custom-policy#configure-the-custom-policy

Ensure refresh token issuance respects session expiry, avoid localStorage, and disable “Keep me signed in.” If a user checks “Keep me signed in”, the session becomes persistent, which overrides the session lifetime you’ve defined.

If the response was helpful, please feel free to mark it as “Accepted Answer” and consider giving it an upvote. This helps others in the community as well.

Regards,

Obinna.