Configurable Token Lifetime policy is not working

[kamranbashir]

Purpose is setup an inactive user's session timeout after 15 mins of inactivity.
We have two web apps running on local IIS (it should/must behave same in ms azure cloud)

No.1 MVC web application (here we need inactive user's timeout to be happen after 15 mins)
No.2 MVC rest api

What we have to do create a new policy and assign to a Service principal object.

Use below mentioned steps 1-6 and it creates required object in azure.

1.Download the latest Azure AD PowerShell Module Public Preview release.

2.Run the Connect command to sign in to your Azure AD admin account. Run this command each time you start a new session.
Connect-AzureAD -Confirm

3. Create new policy
   New-AzureADPolicy -Definition @('{"TokenLifetimePolicy":{"Version":1, "AccessTokenLifetime":"00:15:00","MaxInactiveTime":"00:15:00","MaxAgeSingleFactor":"01:00:00", "MaxAgeSessionSingleFactor":"01:00:00"}}') -DisplayName "KBTokenLifetimePolicy" -IsOrganizationDefault $true -Type "TokenLifetimePolicy"

4.Find desired Azure AD B2C - Applications (Service principal object) ObjectId
Get-AzureADServicePrincipal -Filter "DisplayName eq 'MultitenentPortal'"
ObjectId AppId DisplayName

---

5.List polices and get ObjectId for KBTokenLifetimePolicy policy
Get-AzureADPolicy
Id DisplayName Type IsOrganizationDefault
– ----------- ---- ---------------------

6.To add policy to web Azure AD B2C - Applications(Service principal object) :
Add-AzureADServicePrincipalPolicy -Id -RefObjectId

Result : so far application doest not timeout. after 15 mins inactive period it still continue to navigate between pages and show data from api.

---

Document Details

⚠ Do not edit this section. It is required for docs.microsoft.com ➟ GitHub issue linking.

• ID: 02ff3d62-dc0e-ad0c-f5ae-418337cf31e4
• Version Independent ID: d50952b5-6b98-c40d-d3a3-f9cbec58dd28
• Content: Configurable token lifetimes in Azure Active Directory - Microsoft identity platform
• Content Source: articles/active-directory/develop/active-directory-configurable-token-lifetimes.md
• Service: active-directory
• Sub-service: develop
• GitHub Login: @rwike77
• Microsoft Alias: ryanwi

[Alberto-Vega]

@kamranbashir I'm sorry to hear that you are facing this issue. Would you please share the link to the document that you are following?
If this is not documentation feedback would you please create a question on the developer forums like StackOverflow and MSDN. Unlike here there is a developer community plus the engineering team that can help you.

[kamranbashir]

Issue also raised with ms azure team / Microsoft suppot
Support request number: | 119111922000009

@Alberto-Vega-MSFT FYI, Here is well known azure Documentation LINK
https://docs.microsoft.com/en-us/azure/active-directory/develop/active-directory-configurable-token-lifetimes

I am using for my B2C tenent.
the user must reauthenticate case never happen it silently acqire a new session.
If some someone need i can send fiddler .saz file.
Thanks

my personal opinion @MarileeTurscak-MSFT is also a great ms expert to advice in this matter.

Reference stackoverflow:
https://stackoverflow.com/questions/49067562/azure-ad-b2c-logout-after-session-timeout

[kamranbashir]

Even tried "MaxInactiveTime":"00:10:00". full detail about policy is below mentioned.
After 17 mins inactive uses'r session : the user must reauthenticate case never happen!!! frustrated

If you read defination in below mentioned all lies, it never happen!!
Refresh Token Max Inactive Time
String: MaxInactiveTime

Affects: Refresh tokens

Summary: This policy controls how old a refresh token can be before a client can no longer use it to retrieve a new access/refresh token pair when attempting to access this resource. Because a new refresh token usually is returned when a refresh token is used, this policy prevents access if the client tries to access any resource by using the current refresh token during the specified period of time.

This policy forces users who have not been active on their client to reauthenticate to retrieve a new refresh token.

The Refresh Token Max Inactive Time property must be set to a lower value than the Single-Factor Token Max Age and the Multi-Factor Refresh Token Max Age properties.

Our custom policy

New-AzureADPolicy -Definition @('{"TokenLifetimePolicy":{
"Version":1,
"AccessTokenLifetime":"00:14:00",
"MaxInactiveTime":"00:10:00",
"MaxAgeSingleFactor":"1.00:00:00",
"MaxAgeSessionSingleFactor":"00:59:00",
"MaxAgeSessionMultiFactor":"00:59:00"
}}') -DisplayName "TokenLifetimeDefaultPolicy" -IsOrganizationDefault $true -Type "TokenLifetimePolicy"

[kamranbashir]

Also created issue here
https://docs.microsoft.com/answers/questions/1463/token-lifetime-policy-is-not-working.html

[Alberto-Vega]

@kamranbashir I looked at the support ticket and I see that support engineer is asking you for some information. Can you please engage there? She should be able to help you solve your problem. There is no point to having this open also in the docs since you are getting help there. Closing this issue for now.

[frankhu-2021]

This answer is further addressed in the Q&A forums : https://docs.microsoft.com/answers/questions/1463/token-lifetime-policy-is-not-working.html?childToView=1526#answer-1526