OAuth device code flow refresh token expiration

Question

I have an application which uses the device flow to authenticate users. Everything was working fine until last fall - users could use their refresh tokens and stay connected for 90 days.

Now, users need to authenticate every 24h which is quite annoying for users.

I've checked sign-in logs and it is not a conditional access problem and the failure reason is quite vague :

Answer 1

Hi Frederic. See if this helps:

1. Check and modify the “Block device code flow” CA policy.
2. Use the What If tool to eliminate Conditional Access blockers.

Re-authenticate to generate a new refresh token after policy adjustments.

1. Evaluate switching to Authorization Code Flow with PKCE if long-lived tokens are required.