Timeout issue getting Communication Identity access token in Azure Comms

Question

Hi,

I have built an a web app for my client, a clinical trials company, which incorporates the Azure Comms phone calling service. This aspect of the app had been working fine in production for many months. However, as of recently, there have been timeout issues getting Communication Identity access tokens for users.

I'm using the C# packages in my .net API application:

Azure.Communication.Common

Azure.Communication.Identity

Azure.Communication.CallAutomation

The issue is that lately, the C# GetTokenAsync function seems to be hanging, and the lack of a prompt response is causing my API application to return a timeout error. Like I said, it had been working fine in production for several months up until now.

It's weird in that users are reporting that they can still make calls. I'm wondering how this is possible if the the request to get the token required to set up their front-end call agent is timing out.

Any advice, information or help would be greatly appreciated,

Your truly,

Dylan Olney.

Software Developer, Nimbus Research Center, MTU, Ireland.

Answer 1

Hi @Dylan Olney

Thank you for reaching us regarding the issue.

For Azure Communication Services (ACS), the GetTokenAsync method on CommunicationIdentityClient issues user access tokens with a default lifetime of 24 hours (maximum 1,440 minutes, minimum 60 minutes when customized).

Why Calls Can Still Work Despite Token Issuance Timeouts

Access tokens are short-lived credentials but remain valid for their full expiration period once successfully issued. Once the front-end receives a valid token (with scopes like VoIP), the Calling SDK or CallAutomation can continue to function for the token's lifetime without needing immediate re-issuance. Timeouts only impact new token generation or refresh scenarios.

Token Lifetime and Customization:

Microsoft recommends adjusting token expiration based on your use case:

• Use shorter lifetimes (e.g., 60–120 minutes) for one-off or time-limited sessions.
• Use longer lifetimes (up to 24 hours) for users/agents who stay in the app longer.

You can set a custom expiration using the overload that accepts expiresInMinutes:

// Example from Microsoft documentation
var tokenResponse = await client.GetTokenAsync(
    identity, 
    scopes: new[] { CommunicationTokenScope.VoIP }, 
    expiresInMinutes: 1440);  // 24 hours (default if omitted)
var token = tokenResponse.Value.Token;
var expiresOn = tokenResponse.Value.ExpiresOn;

Recommended Best Practices for Reliability:

Microsoft's Credentials best practices emphasize reducing roundtrips to the Identity service:

1. Use CommunicationTokenCredential on the client side - It supports built-in proactive token refreshing (automatically refreshes before expiry when you provide a callback).
2. Implement token caching and refresh logic - Issue tokens server-side from your .NET API and reuse them. For long sessions, provide a refresh callback to your front-end SDK.
3. Customize expiration as shown above to balance security and performance.

Handling Transient Issues with GetTokenAsync:

The Azure SDK for .NET includes built-in retry logic (exponential backoff) for transient failures.

For production:

• Wrap GetTokenAsync with additional retries or use a longer CancellationToken (e.g., 60–90 seconds) to handle your API’s request timeout limits.
• Enable diagnostics logging on the client to capture detailed traces and MS-CV correlation ID.

Reference:
https://learn.microsoft.com/en-us/azure/communication-services/concepts/identity-model#microsoft-entra-id-integrating-with-entra-id
https://learn.microsoft.com/en-us/dotnet/api/overview/azure/communication.identity-readme?view=azure-dotnet
 Please do not forget to click "Accept the answer” and Yes, this can be beneficial to other community members.

If you have any other questions, let me know in the "comments" and I would be happy to help you

Answer 2

Issue is now resolved.