Azure AD Single sign on Token lifetime

Question

Hi Team,

We have an app which uses the OAuth auth Code grant type. We are trying to restrict session tokens and limiting to 10 minutes however after applying the policy it is not working and users stayed logged in on browsers.

Can you please suggest If we missing something, we are using the below policy :

$policy = New-AzureADPolicy -Definition @('{"TokenLifetimePolicy":{"Version":1,"MaxAgeSessionSingleFactor":"00:10:00","MaxAgeSessionMultiFactor":"00:10:00"}}') -DisplayName $policyName -IsOrganizationDefault $false -Type "TokenLifetimePolicy"

Thanks in advance

Answer 1

Hi,

Try to follow this documentation to see if that helps.

https://learn.microsoft.com/en-us/azure/active-directory/develop/active-directory-configurable-token-lifetimes#example-manage-an-organizations-default-policy

Answer 2

You can also configure this by Conditional Access if you will use GUI.

https://learn.microsoft.com/en-us/azure/active-directory/conditional-access/howto-conditional-access-session-lifetime

Answer 3

Hi Sunny987

Hi Sunny987

Did you set the <“LastPasswordChangeTimestamp”> and sync it ?

Also Set-AzureADPolicy -Id $policy.Id -DisplayName $policy.DisplayName -Definition @('{"TokenLifetimePolicy":{"Version":1,"MaxAgeSingleFactor"00:10:00"}}') As of example to update it for 10 minutes

1Federated users who have insufficient revocation information include any users who do not have the "LastPasswordChangeTimestamp" attribute synced. These users are given this short Max Age because AAD is unable to verify when to revoke tokens that are tied to an old credential (such as a password that has been changed) and must check back in more frequently to ensure that the user and associated tokens are still in good standing. To improve this experience, tenant admins must ensure that they are syncing the “LastPasswordChangeTimestamp” attribute (this can be set on the user object using Powershell or through AADSync).

Answer 4

You can also look to set the policy for each specific Web Application and Ressource separately , If the client stay logged.

I hope it will help you,

Regards, Armand B.

Answer 5

Hi , you should be able to provide the log please ?

We can't determine a error code while guessing here and there.

I do read your reply to Daniel, and it seem that you ask the workaround solution for 10 minute display policy.

If you Read the message i have posted for you, the solution is present in the message.

Again, you need to set different set of policy for each api or function, the token will not refresh and will remain log in.

What you could do also is to revote the token by killing the token with revocation and syncing your network VM machine. There is many way to do this, up to you to choose which one fit better in your case, since you does not provide any details or log of the actual problem.

Please, Review your question and answer provided

Please "Accept as answer" wherever the information provided helps you to help others in the community.