How to inspect a refresh token obtained from Azure in a code grant flow?

Question

I successfully implemented the code grant flow against Azure AAD according to this document Now I want to fiddle with the expiration of the refresh token I obtain.

The default expiration is 90 days and I want to lower it to 7. I want to verify that I succeeded without having to wait 7 days. The expriation of the refresh token is not returned in the API and I am unable to decode it as a JWT token (is it even a JWT?).

Any suggestions?

user_10521739 · Answer

I assume that you use New-AzureADPolicy or Microsoft Graph API Create Policy to set the lifetime of the refresh token.

Then you could use Microsoft Graph API Get Policy to see details of the the policy.

GET https://graph.microsoft.com/beta/policies/tokenLifetimePolicies

In the response you will see the MaxInactiveTime property which is the lifetime of the refresh token.

How to inspect a refresh token obtained from Azure in a code grant flow?

1 Answers