AADSTS700082 api auth_error ai_generated true

AADSTS700082：刷新令牌因不活动而过期。

AADSTS700082: The refresh token has expired due to inactivity.

ID: api/oauth2-error-invalid-grant-azure-ad

其他格式: JSON · Markdown 中文 · English
90%修复率
87%置信度
1证据数
2024-06-01首次发现

版本兼容性

版本状态引入弃用备注
Microsoft Authentication Library (MSAL) 4.x active — — —
Azure SDK for .NET 1.14.x active — — —
Azure SDK for Python 1.28.x active — — —
Azure AD v2.0 active — — —

根因分析

刷新令牌在允许的不活动窗口内未被使用（Azure AD 通常为 90 天），导致授权服务器撤销了该令牌。

English

The refresh token was not used within the allowed inactivity window (typically 90 days for Azure AD), causing the token to be revoked by the authorization server.

generic

官方文档

https://learn.microsoft.com/en-us/azure/active-directory/develop/refresh-tokens

解决方案

  1. Acquire a new authorization code by redirecting the user to the login endpoint. In MSAL, use acquireTokenSilent with a fresh login hint. Code example: msalInstance.acquireTokenRedirect({ scopes: ['User.Read'], loginHint: user.email })
  2. Implement a token refresh schedule that proactively refreshes within the inactivity window (e.g., every 60 days) using a background job. In Python, use msal's ConfidentialClientApplication with acquire_token_silent.
  3. Configure Azure AD to extend the refresh token inactivity timeout (up to 365 days) via conditional access policies.

无效尝试

常见但无效的做法:

  1. 100% 失败

    The token is permanently expired; reusing it will always fail.

  2. 80% 失败

    The refresh token is stored on the server side, not client-side cache.

  3. 60% 失败

    The inactivity timeout is a separate setting; increasing lifetime does not affect inactivity expiration.