Azure AD Application proxy session timeout

Question

Azure AD Application proxy session timeout

Jochen 151

We are using Azure AD Application proxy to access "legacy" applications in our datacenter.
The system works as expected for the most part. However, every XX(60?) minutes the session expires and the user is taken to logon.microsoft.com and than redirected back the the application behind the application proxy.

Some of the applications behind the proxy ask for user input. A user might be typing a form for 10 minutes, he presses apply, is redirect... en taken back and just lost 10 minutes of work.
Can we change the time a session has to reauthenticate? (does a feature request or roadmap exist?)

Accepted answer

4 additional answers

Your answer

Answer 1

Chris Hill 206

Hi @Jochen I think what you're after is the 'access token lifetime' which is set to 1 hour by default. You should be able to increase it up to 1 day for your app as follows:
https://learn.microsoft.com/en-us/azure/active-directory/app-proxy/application-proxy-understand-cors-issues#option-5-extend-the-lifetime-of-the-access-token
https://learn.microsoft.com/en-us/azure/active-directory/develop/active-directory-configurable-token-lifetimes

JayBee2 6 Reputation points

2022-06-08T11:27:20.187+00:00

Hi @ChrisHill-9515,

I believe your are correct.

However, in the case of AzureAD Application Proxy.
I'm unable to Apply the policy with the longer timeout.

The Azure AD Enterprise application are not listed when running
Get-AzureADServicePrincipal | fl DisplayName
So I'm unable to apply it.

All other enterprise applications are listed hower.
I'll try to confirm this with Microsoft again.

Thanks, best regards.

Chris Hill 206

In case anyone comes here in future, the second page appears to have lost the instructions - so here's what to do - update the two DisplayNames to reflect the app you want to change e.g. first is for Jira, second is for Confluence.

Also NB this increases the AccessTokenLifetime to 24 hours (or one second less than that actually but that appears to be the max value). Make sure you review the documentation above to be aware of the security implications of this.

Connect-AzureAD
$policy = New-AzureADPolicy -Definition @('{"TokenLifetimePolicy":{"Version":1,"AccessTokenLifetime":"23:59:59"}}') -DisplayName "JiraTokenLifetimePolicy" -IsOrganizationDefault $false -Type "TokenLifetimePolicy"
$sp = Get-AzureADServicePrincipal -Filter "DisplayName eq 'Jira'"
Add-AzureADServicePrincipalPolicy -Id $sp.ObjectId -RefObjectId $policy.Id

Connect-AzureAD
$policy = New-AzureADPolicy -Definition @('{"TokenLifetimePolicy":{"Version":1,"AccessTokenLifetime":"23:59:59"}}') -DisplayName "ConfluenceTokenLifetimePolicy" -IsOrganizationDefault $false -Type "TokenLifetimePolicy"
$sp = Get-AzureADServicePrincipal -Filter "DisplayName eq 'Confluence'"
Add-AzureADServicePrincipalPolicy -Id $sp.ObjectId -RefObjectId $policy.Id

Answer 2

James Hamil 27,211 Microsoft Employee Moderator

Hi @Jochen , you can configure Azure AD Application proxy timeout here. Please let me know if you have any questions.

Best,
James

JayBee2 6 Reputation points

2021-02-08T13:07:52.84+00:00

Hi James,

That's the timeout on the backend webserver. Let's say if you have a long running request, how long does the Application proxy wait for the server to respond.
I need something differend.
Aneesh Paul 1 Reputation point

2022-02-10T04:23:03.723+00:00

hi @James Hamil we are have configured Backend Application Timeout to long 180 seconds , is there a way we can increase this? as we experience gateway timeout ,
ABDULRAHMAN ABDULAAL 0 Reputation points

2023-03-02T10:56:55.9333333+00:00

The link is not working.

I have same issue when I'm running some large report more than 3 mins.

Answer 3

John Haller 1

@Jochen This is just a workaround, but multiple connections to the same application appear to reset the timer. So, opening a second browser tab to the same application before pressing apply will generally avoid losing the data in the first tab. I've used this approach with Jira and Confluence.

Vinay Shekar S 0 Reputation points

2023-02-22T14:51:15.5133333+00:00

Hi @John Haller @Jochen Did anyone of you find resolved the issue? We are also facing similar issue for Confluence and would like to hear the cause and solution fro you.
Vinay Shekar S 0 Reputation points

2023-02-22T14:53:12.87+00:00

Hi @John Haller @Jochen May I know if you are able to resolve the issue? We are facing similar issue with Confluence and woul like to hear from you.
Jochen 151 Reputation points

2023-02-22T15:47:04.94+00:00

I've applied the solution posted by Chris Hill. (Access Token Lifetime)
I think it's better, it's definitly not solvedfor us.

Your problem can also be caused if you use multiple application proxies though. If you have multiple, try the application if only one is online.

Answer 4

Chris Hill 206

Hi @JayBee2 ,
Try Get-AzureADServicePrincipal -All | fl DisplayName

Answer 5

JayBee2 6

Hi @ChrisHill-9515,

You are right. I'm Currently I'm testing this.
Thanks a lot!

Danny Puckett 1 Reputation point

2022-09-13T21:11:55.357+00:00

Did this work? We are having a similar issue.
JayBee2 6 Reputation points

2022-09-14T06:35:18.69+00:00

Hi,

This definitely solved most of the issues for us.
When having multiple taps open to the application we still experience the behaviour, but it's much improved!

Share via

Azure AD Application proxy session timeout

4 additional answers

Your answer