Mismatch in Azure B2C Token Expiry with Configured Session Lifetime in API Management

hawthorne91 230 Reputation points
2025-01-21T20:39:17+00:00

I have B2C integrated with my Azure API Management service for authorization. I've been trying to adjust the session behavior in my user flow, setting the Web app session lifetime (minutes) to 15 minutes. In the token lifetime, I've also set the Access & ID token lifetimes (minutes) to 15. However, when I inspect the page and look at the token's headers, I see that the Set-Cookie header for the token states that it's going to expire in a hour. Why is this issue arising?

I've done some research into the issue, and found this post about this issue: https://stackoverflow.com/questions/58835708/changing-azure-ad-b2c-access-token-lifetime-doesnt-work They are encountering the same issue as me, however it hasn't been updated - I was wondering if this issue may have already been fixed as it was an issue back in 2019.

Microsoft Entra External ID
Microsoft Entra External ID
A modern identity solution for securing access to customer, citizen and partner-facing apps and services. It is the converged platform of Azure AD External Identities B2B and B2C. Replaces Azure Active Directory External Identities.
2,994 questions
Microsoft Entra ID
Microsoft Entra ID
A Microsoft Entra identity service that provides identity management and access control capabilities. Replaces Azure Active Directory.
22,935 questions
0 comments No comments
{count} votes

Your answer

Answers can be marked as Accepted Answers by the question author, which helps users to know the answer solved the author's problem.