Microsoft Graph API Refresh Token Expired

Question

I have a web application integrated to Office 365 using Microsoft graph API. I have using the application for more than a year now. Lately I have been receiving an error stating the refresh token has expired due to inactivity hence I am not able to update that users subscription by 3 days.

Now whenever an email hits the users inbox there is an exception in the listen state.

below is the error message

Error validating credentials. AADSTS70008: The refresh token has expired due to inactivity. The token was issued on 2017-02-16T19:08:12.3388232Z and was inactive for 90.00:00:00.

snippet of the error message

Please help on how to fix this error

Solution

Check out this document on default and configurable token lifetimes.

In general, the default lifetime of a refresh token is 14 days, and that can be renewed for new access + refresh token pairs for up to 90 days. After 90 days, with the default configuration, a user will have to interactively sign into your application again.

I believe the error you are seeing is a result of this "Refresh Token Max Age". You have the ability to configure this setting so that it will never expire, but the safer practice here would be to catch this error, and have the user sign-in again.

Comments

[Claude]

Things may have changed since this answer was written. Link is still valid. However, refresh tokens (may) remain valid forever, even though there is a "Refresh Token Max Inactive Time".

[Alvindra Dutt]

On the date of this question asked. I had developed a way to refresh the token using a API call upon expiry as a work around and seems to be working till date. Hoping there is new documentation out now.

[Konrad]

Hello @Claude could you explain how to set refresh tokens so they are valid forever? Is this something the client asking for permissions can do, or is it something that is configured in the user's tenant? Many thanks

[kcollignon]

Hi, did anyone figure out how to configure the Refresh Token to be valid forever and not 90 days?

[perustaja]

@kcollignon "As of January 30, 2021 you can not configure refresh and session token lifetimes" from the linked document in the answer currently. Doesn't seem possible now.