I already added offline_access permission in my Entra ID app, but I cannot get the refresh token.

Question

I configured Google IAP to request refresh tokens from Entra ID. I set the Google IAP request offline_access to Entra ID, and I also gave admin consent to offline_access in Entra ID. But I see the Google IAP still cannot get refresh tokens from Entra ID.

https://learn.microsoft.com/en-us/entra/identity-platform/scopes-oidc#the-offline_access-scope

Answer 1

Hi Qingshan,

That's really frustrating when you've configured everything correctly but still can't get those refresh tokens from Entra ID )) the offline_access scope can be tricky because it requires several conditions to be met simultaneously.

Verify your authorization request includes both the offline_access scope AND prompt=consent or includes consent in some form. The offline_access scope requires explicit user consent each time, even with admin consent granted. Your request should look like this in the authorization URL:

&scope=openid%20profile%20offline_access&prompt=consent

For refresh tokens, you typically need response_type=code for the authorization code flow. The implicit flow (response_type=token) doesn't return refresh tokens.

The Entra ID token configuration documentation has specific requirements for refresh tokens https://learn.microsoft.com/en-us/entra/identity-platform/v2-oauth2-auth-code-flow.

Another common issue is the app registration's authentication platform configuration. Make sure your app is registered as a web app rather than a single-page application if you're using server-side code. SPA registrations have different token behaviors.

Verify that your app has the necessary API permissions beyond just offline_access. The refresh token won't be issued if the overall permission set isn't valid or lacks admin consent for other required permissions. Check your token endpoint request as well. When exchanging the authorization code for tokens, you need to include the same offline_access scope in the token request, not just the initial authorization request. The redirect URI configuration can also affect this. Make sure your redirect URI exactly matches what's registered in your app registration, including trailing slashes and HTTP/HTTPS schemes.

If you're still not getting refresh tokens after checking these items, try using the Microsoft identity platform token endpoint directly with a tool like Postman to isolate whether the issue is with your configuration or the Google IAP integration.

regards,

Alex

and "yes" if you would follow me at Q&A - personaly thx.
P.S. If my answer help to you, please Accept my answer

https://ctrlaltdel.blog/