I am generating a JWT token by making a post to this URL to log in to Microsoft: https://login.microsoftonline.com/{{TENANT_ID}}/oauth2/v2.0/token I am doing some integration tests and I want to test the authentication of my API, for this I need to generate a token that lasts very little time, something like 5 minutes or less, and the defaults last 1 hour. I have not found information about this in the documentation.
I hope to be able to set an exact expiration time.
The minimum duration of Access Token Lifetime is 10minutes.
To configure accessTokenLifetimePolicy
, you should have atleast Microsoft Entra ID P1 license.
Initially, I registered Microsoft Entra ID application, gave necessary API permission and granted admin consent like below:
Now, generated access token using client credential flow using below code snippet:
GET https://login.microsoftonline.com/<tenant_id>/oauth2/v2.0/token
client_id=<app_id>
client_secret = <client_secret>
grant_type = client_credentials
scope= https://graph.microsoft.com/.default
After generating access token, I tried to configure AccesstokenLifeTimePolicy
for 5 minutes using below code snippet but get error like below:
Authorization : Bearer token
Body : raw
POST https://graph.microsoft.com/v1.0/policies/tokenLifetimePolicies
{
"definition": [
"{\"TokenLifetimePolicy\":{\"Version\":1,\"AccessTokenLifetime\":\"00:05:00\"}}"
],
"displayName": "New token lifetime policy for application",
"isOrganizationDefault": false
}
Using same access token, I successfully configured AccesstokenLifeTimePolicy
for 10 minutes using below code snippet :
Authorization : Bearer token
Body : raw
POST https://graph.microsoft.com/v1.0/policies/tokenLifetimePolicies
{
"definition": [
"{\"TokenLifetimePolicy\":{\"Version\":1,\"AccessTokenLifetime\":\"00:10:00\"}}"
],
"displayName": "New token lifetime policy",
"isOrganizationDefault": false
}
Now, assigning tokenLifetimePolicies
to application using below parameters:
Authorization : Bearer Token
Body: raw
POST https://graph.microsoft.com/v1.0/servicePrincipals/<ServicePrincipalID/tokenLifetimePolicies/$ref
{
"@odata.id":"https://graph.microsoft.com/v1.0/policies/tokenLifetimePolicies/<policy-id>"
}
So, when I generated the access token with resource API scope of assigned application, it will give the access token having 10 minutes
lifetime successfully as below:
Reference:
Minimum duration token lifetimes
Set lifetimes for tokens - Microsoft identity platform | Microsoft Learn