AADSTS700082 api auth_error ai_generated true

AADSTS700082: The refresh token has expired due to inactivity.

ID: api/oauth2-error-invalid-grant-azure-ad

Also available as: JSON · Markdown · 中文
90%Fix Rate
87%Confidence
1Evidence
2024-06-01First Seen

Version Compatibility

VersionStatusIntroducedDeprecatedNotes
Microsoft Authentication Library (MSAL) 4.x active — — —
Azure SDK for .NET 1.14.x active — — —
Azure SDK for Python 1.28.x active — — —
Azure AD v2.0 active — — —

Root Cause

The refresh token was not used within the allowed inactivity window (typically 90 days for Azure AD), causing the token to be revoked by the authorization server.

generic

中文

刷新令牌在允许的不活动窗口内未被使用（Azure AD 通常为 90 天），导致授权服务器撤销了该令牌。

Official Documentation

https://learn.microsoft.com/en-us/azure/active-directory/develop/refresh-tokens

Workarounds

  1. 95% success Acquire a new authorization code by redirecting the user to the login endpoint. In MSAL, use acquireTokenSilent with a fresh login hint. Code example: msalInstance.acquireTokenRedirect({ scopes: ['User.Read'], loginHint: user.email }) 
    Acquire a new authorization code by redirecting the user to the login endpoint. In MSAL, use acquireTokenSilent with a fresh login hint. Code example: msalInstance.acquireTokenRedirect({ scopes: ['User.Read'], loginHint: user.email })
  2. 90% success Implement a token refresh schedule that proactively refreshes within the inactivity window (e.g., every 60 days) using a background job. In Python, use msal's ConfidentialClientApplication with acquire_token_silent. 
    Implement a token refresh schedule that proactively refreshes within the inactivity window (e.g., every 60 days) using a background job. In Python, use msal's ConfidentialClientApplication with acquire_token_silent.
  3. 85% success Configure Azure AD to extend the refresh token inactivity timeout (up to 365 days) via conditional access policies. 
    Configure Azure AD to extend the refresh token inactivity timeout (up to 365 days) via conditional access policies.

中文步骤

  1. Acquire a new authorization code by redirecting the user to the login endpoint. In MSAL, use acquireTokenSilent with a fresh login hint. Code example: msalInstance.acquireTokenRedirect({ scopes: ['User.Read'], loginHint: user.email })
  2. Implement a token refresh schedule that proactively refreshes within the inactivity window (e.g., every 60 days) using a background job. In Python, use msal's ConfidentialClientApplication with acquire_token_silent.
  3. Configure Azure AD to extend the refresh token inactivity timeout (up to 365 days) via conditional access policies.

Dead Ends

Common approaches that don't work:

  1. 100% fail

    The token is permanently expired; reusing it will always fail.

  2. 80% fail

    The refresh token is stored on the server side, not client-side cache.

  3. 60% fail

    The inactivity timeout is a separate setting; increasing lifetime does not affect inactivity expiration.