# AADSTS700082: The refresh token has expired due to inactivity.

- **ID:** `api/oauth2-error-invalid-grant-azure-ad`
- **Domain:** api
- **Category:** auth_error
- **Error Code:** `AADSTS700082`
- **Verification:** ai_generated
- **Fix Rate:** 90%

## Root Cause

The refresh token was not used within the allowed inactivity window (typically 90 days for Azure AD), causing the token to be revoked by the authorization server.

## Version Compatibility

| Version | Status | Introduced | Deprecated |
|---------|--------|------------|------------|
| Microsoft Authentication Library (MSAL) 4.x | active | — | — |
| Azure SDK for .NET 1.14.x | active | — | — |
| Azure SDK for Python 1.28.x | active | — | — |
| Azure AD v2.0 | active | — | — |

## Workarounds

1. **Acquire a new authorization code by redirecting the user to the login endpoint. In MSAL, use acquireTokenSilent with a fresh login hint. Code example: msalInstance.acquireTokenRedirect({ scopes: ['User.Read'], loginHint: user.email })** (95% success)
   ```
   Acquire a new authorization code by redirecting the user to the login endpoint. In MSAL, use acquireTokenSilent with a fresh login hint. Code example: msalInstance.acquireTokenRedirect({ scopes: ['User.Read'], loginHint: user.email })
   ```
2. **Implement a token refresh schedule that proactively refreshes within the inactivity window (e.g., every 60 days) using a background job. In Python, use msal's ConfidentialClientApplication with acquire_token_silent.** (90% success)
   ```
   Implement a token refresh schedule that proactively refreshes within the inactivity window (e.g., every 60 days) using a background job. In Python, use msal's ConfidentialClientApplication with acquire_token_silent.
   ```
3. **Configure Azure AD to extend the refresh token inactivity timeout (up to 365 days) via conditional access policies.** (85% success)
   ```
   Configure Azure AD to extend the refresh token inactivity timeout (up to 365 days) via conditional access policies.
   ```

## Dead Ends

- **** — The token is permanently expired; reusing it will always fail. (100% fail)
- **** — The refresh token is stored on the server side, not client-side cache. (80% fail)
- **** — The inactivity timeout is a separate setting; increasing lifetime does not affect inactivity expiration. (60% fail)