# AADSTS700082：刷新令牌因不活动而过期。

- **ID:** `api/oauth2-error-invalid-grant-azure-ad`
- **领域:** api
- **类别:** auth_error
- **错误码:** `AADSTS700082`
- **验证级别:** ai_generated
- **修复率:** 90%

## 根因

刷新令牌在允许的不活动窗口内未被使用（Azure AD 通常为 90 天），导致授权服务器撤销了该令牌。

## 版本兼容性

| 版本 | 状态 | 引入 | 弃用 |
|------|------|------|------|
| Microsoft Authentication Library (MSAL) 4.x | active | — | — |
| Azure SDK for .NET 1.14.x | active | — | — |
| Azure SDK for Python 1.28.x | active | — | — |
| Azure AD v2.0 | active | — | — |

## 解决方案

1. ```
   Acquire a new authorization code by redirecting the user to the login endpoint. In MSAL, use acquireTokenSilent with a fresh login hint. Code example: msalInstance.acquireTokenRedirect({ scopes: ['User.Read'], loginHint: user.email })
   ```
2. ```
   Implement a token refresh schedule that proactively refreshes within the inactivity window (e.g., every 60 days) using a background job. In Python, use msal's ConfidentialClientApplication with acquire_token_silent.
   ```
3. ```
   Configure Azure AD to extend the refresh token inactivity timeout (up to 365 days) via conditional access policies.
   ```

## 无效尝试

- **** — The token is permanently expired; reusing it will always fail. (100% 失败率)
- **** — The refresh token is stored on the server side, not client-side cache. (80% 失败率)
- **** — The inactivity timeout is a separate setting; increasing lifetime does not affect inactivity expiration. (60% 失败率)