Share via

Azure AD Single sign on Token lifetime

Rahul Kaim 21 Reputation points
2020-05-05T18:58:41.943+00:00

Hi Team,

We have an app which uses the OAuth auth Code grant type. We are trying to restrict session tokens and limiting to 10 minutes however after applying the policy it is not working and users stayed logged in on browsers.

Can you please suggest If we missing something, we are using the below policy :

$policy = New-AzureADPolicy -Definition @('{"TokenLifetimePolicy":{"Version":1,"MaxAgeSessionSingleFactor":"00:10:00","MaxAgeSessionMultiFactor":"00:10:00"}}') -DisplayName $policyName -IsOrganizationDefault $false -Type "TokenLifetimePolicy"

Thanks in advance

Microsoft Entra ID
Microsoft Entra ID
A Microsoft Entra identity service that provides identity management and access control capabilities. Replaces Azure Active Directory.
19,994 questions
0 comments

5 answers

Sort by: Most helpful
Most helpful Newest Oldest
  1. Daniel Aldén 156 Reputation points
    2020-05-06T06:00:14.997+00:00
    0 comments
  2. Daniel Aldén 156 Reputation points
    2020-05-06T06:01:50.117+00:00
  3. Armand Brunelle 491 Reputation points
    2020-05-06T10:13:01.613+00:00

    Hi Sunny987

    Hi Sunny987

    Did you set the <“LastPasswordChangeTimestamp”> and sync it ?

    Also Set-AzureADPolicy -Id $policy.Id -DisplayName $policy.DisplayName -Definition @('{"TokenLifetimePolicy":{"Version":1,"MaxAgeSingleFactor"00:10:00"}}') As of example to update it for 10 minutes

    1Federated users who have insufficient revocation information include any users who do not have the "LastPasswordChangeTimestamp" attribute synced. These users are given this short Max Age because AAD is unable to verify when to revoke tokens that are tied to an old credential (such as a password that has been changed) and must check back in more frequently to ensure that the user and associated tokens are still in good standing. To improve this experience, tenant admins must ensure that they are syncing the “LastPasswordChangeTimestamp” attribute (this can be set on the user object using Powershell or through AADSync).

  4. Armand Brunelle 491 Reputation points
    2020-05-06T10:16:04.757+00:00

    You can also look to set the policy for each specific Web Application and Ressource separately , If the client stay logged.

    I hope it will help you,

    Regards, Armand B.

    0 comments
  5. Armand Brunelle 491 Reputation points
    2020-05-07T17:24:37.59+00:00

    Hi , you should be able to provide the log please ?

    We can't determine a error code while guessing here and there.

    I do read your reply to Daniel, and it seem that you ask the workaround solution for 10 minute display policy.

    If you Read the message i have posted for you, the solution is present in the message.

    Again, you need to set different set of policy for each api or function, the token will not refresh and will remain log in.

    What you could do also is to revote the token by killing the token with revocation and syncing your network VM machine. There is many way to do this, up to you to choose which one fit better in your case, since you does not provide any details or log of the actual problem.

    Please, Review your question and answer provided

    Please "Accept as answer" wherever the information provided helps you to help others in the community.