Change device authorization token expiration time in AKS AD RBAC authentication - Microsoft Q&A (2024)

FAQs

How do I change my Azure token expiration time? ›

You can configure token lifetimes in the Azure portal. Go to the Azure portal. In "Azure Active Directory" > "Security" > "Authentication methods" > "Authentication methods blade" > "Token Lifetime Policies". you can configure the lifetime of access tokens, refresh tokens, and ID tokens.

Access and ID token lifetimes (minutes) - The lifetime of the OAuth 2.0 bearer token and ID tokens. The default is 60 minutes (1 hour).

The default lifetime for the refresh tokens is 24 hours for single page apps and 90 days for all other scenarios. Refresh tokens replace themselves with a fresh token upon every use.

Once expired, you need to re-authenticate to obtain a new token. Doing this prevents the same token from being used for an extended period of time, thereby reducing the risk of misappropriation. You can also use refresh tokens to renew new access tokens.

To verify that your expiration time is correct, you can look at the exp and iat claim of your access token. Then you can perform the following calculation: Token expiration (in seconds) = exp (Expiration time in seconds) - iat (Issued at in seconds)

Changing the default expiration time of user access tokens

User access tokens have an expiration time, which is set to 60 minutes by default. Add or update the user_access_token_validity value under the [oauth.

Best practice

Set the expiration time for refresh tokens in such a way that it is valid for a little longer period than the access tokens. For example, if you set 30 minutes for access token then set (at least) 24 hours for the refresh token.

When issued, an access token's default lifetime is assigned a random value ranging between 60-90 minutes (75 minutes on average). The default lifetime also varies depending on the client application requesting the token or if Conditional Access is enabled in the tenant.

What happens when access token expires? ›

In this article. When a token has expired or has been revoked, it can no longer be used to authenticate Git and API requests. It is not possible to restore an expired or revoked token, you or the application will need to create a new token.

Unfortunately, there is no option to find the expiration time for the refresh token, because it is depending on authorization server and the type of client application, and it is not communicated to the client. In the Microsoft identity platform, the default lifetime for refresh tokens is 90 days.

Refresh tokens extend the lifespan of an access token. Typically, they're issued alongside access tokens, allowing additional access tokens to be granted when the live access token expires. They're usually stored securely on the authorization server itself.

To refresh your access token and an ID token, you send a token request with a grant_type of refresh_token . Be sure to include the openid scope when you want to refresh the ID token. If the refresh token is valid, then you get back a new access token, a new ID token, and the refresh token.

Users can't change their individual timeout setting to a longer interval than the current option set by a Global Administrator. To enforce an idle timeout setting for all users of the Azure portal, sign in with a Global Administrator account, then select Enable directory level idle timeout to turn on the setting.

You can customize password expiration policy for cloud only users from M365 admin centers' Security & privacy tab or using Azure AD cmdlet Set-MsolPasswordPolicy which applies to all user accounts that are created and managed directly in Azure AD but unfortunately we cannot make a specific password expiration policy ...