Microsoft started to turn of basic authorization for Exchange Online and we must move to modern one.
We chose auhtorization code flow. User process authorization, we get auth code in url send it to server and get access/refresh token. Unfortunately default refresh token lifetime for SPA is 24 hours. Thats problem because we want to use refresh token later (e.g. days, months) in webjobs/api.
Our scenario:
- User process authorization, scope is mail.send offline_access
- We get auth code and send it to server
- Server use auth code to get tokens
- Tokens are valid and saved to database
- Several days ago we use refresh token to gen new access token but request ends with exception (24 hour lifetime exceeded)
Our requirements in nutshell: Users allow us to send mail. Server save tokens and use them later in webjobs, api etc.
Can someone give us advice what is the proper way to get refresh token for long term use?