Sing-in Frequentcy-Azure AD

Subramanyam k 251 Reputation points
2020-07-08T06:18:25.533+00:00

Hi Team,

This is related to the question posted on the below link.

https://learn.microsoft.com/en-us/answers/questions/42663/configuring-session-token-refresh-token-timeout-of.html

We have configured the session timeout(1 Hour) for one of the Azure AD application.

How does the APS.NET/JAVA application know that the Azure AD session has been timed out.

Microsoft Entra ID
Microsoft Entra ID
A Microsoft Entra identity service that provides identity management and access control capabilities. Replaces Azure Active Directory.
19,639 questions
0 comments

2 answers

Sort by: Most helpful
Most helpful Newest Oldest
  1. AmanpreetSingh-MSFT 56,311 Reputation points
    2020-07-08T10:47:48.367+00:00

    Hello @Subramanyamk-9132

    Along with the token there are certain cookies set by by Azure AD for the application. With sign-in frequency setting configured, a session lifecycle cookie is issued at the expiry of this session cookie, users would need to re-authenticate. However, if application uses its own cookies to maintain session, this setting won't work. If you are using MSAL (Microsoft Authentication Library) to federate with Azure AD, it should be using the cookies issued by Azure for session lifetime.

    Please do not forget to "Accept the answer" wherever the information provided helps you. This will help others in the community as well.

  2. AmanpreetSingh-MSFT 56,311 Reputation points
    2020-07-10T10:39:22.6+00:00

    @Subramanyamk-9132

    After 1 hour, the application will reject access token with 401 unauthorized error. So your code needs to handle the refresh of the access token. At refresh of access token/ session cookie, login.microsoftonline.com can reject refresh token/session cookie with error: prompt required - handle that error and initiate a prompt for authentication. MSAL (Microsoft Authentication Library) does this out of the box. 3rd party libraries need exception handling.

    Please do not forget to "Accept the answer" wherever the information provided helps you. This will help others in the community as well.