azure ad refresh-token flow

Question

azure ad refresh-token flow

testuser7 286

Hello,

I have a BASIC , binary question.

When any client-app (could be web-app, SPA or desktop app) sends a request to AAD with a valid Refresh-token to get new refresh and access token, will such request go through the Conditional Access Policy evaluation (just like any fresh request sent on browser for authorization-code-flow) ??

for eg., would following req. pass through all applicable CA policies ??

POST /{tenant}/oauth2/v2.0/token HTTP/1.1
Host: https://login.microsoftonline.com

client_id=6731de76-14a6-49ae-97bc-6eba6914391e
&scope=https://abc.com/myscope
&refresh_token=OAAABAAAAiL9Kn2Z27UubvWFPbm0gLWQJVzCTE9UkP3pSx1aXxUjq...
&grant_type=refresh_token
&client_secret=JqQX2PNo9bpM0uEihUPzyrh

Thanks.

Shweta Mathur 30,456 Reputation points Microsoft Employee Moderator

2022-05-31T12:59:33.347+00:00

Hi @testuser7 ,

Just checking in to see if the below answer helped. If this answers your query, please don’t forget to click "Accept the answer" and Up-Vote for the same, which might be beneficial to other community members reading this thread. And, if you have any further query do let us know.

Thanks,
Shweta

1 answer

Your answer

Shweta Mathur 30,456 Reputation points Microsoft Employee Moderator

2022-05-31T12:59:33.347+00:00

Hi @testuser7 ,

Just checking in to see if the below answer helped. If this answers your query, please don’t forget to click "Accept the answer" and Up-Vote for the same, which might be beneficial to other community members reading this thread. And, if you have any further query do let us know.

Thanks,
Shweta

Answer 1

Alfredo Revilla - Upwork Top Talent | IAM SWE SWA 27,551 Moderator

Hello @testuser7 , yes it will go trough CA evaluation and policy will get applied depending on the sign-in frequency settings. If the refresh token max lifetime has been exceeded a AADSTS70043 error response will be returned.

For more information about refresh token lifetime take a look to token lifetime policy and token timeouts.

Let us know if this answer was helpful to you. If so, please remember to accept it so that others in the community with similar questions can more easily find a solution.

testuser7 286 Reputation points

2022-05-13T12:20:54.473+00:00

Thanks @Alfredo Revilla - Upwork Top Talent | IAM SWE SWA

Yes, I totally agree that AAD needs to evaluate sign-in frequency (SIF) which is part of CA-policy.

**But what about all other constructs of CA-policy eg., location, client-app etc.
I believe this call can NOT evaluate all those conditions of CA-polices because this is programmatic call from the client-code (may be from its backend) **

So the logical understanding is , AAD will pull out all the CA-policy which are matching from Users and Cloud-resource point of view and enforce the strictest sign-in frequency (SIF) setting among those filtered policies.

Is it correct ?

Thanks.
Alfredo Revilla - Upwork Top Talent | IAM SWE SWA 27,551 Reputation points Moderator

2022-05-28T08:49:15.31+00:00

Hi @testuser7 , all other constructs will be evaluated. And yes, the strictest sign-in frequency will get applied.

Share via

azure ad refresh-token flow

1 answer

Your answer