Microsoft Security | Microsoft Entra | Microsoft Entra External ID
Managing external identities to enable secure access for partners, customers, and other non-employees
Token lifetime configuration Entra External ID
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(268.8, 6%, 36%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3ES2%3C/text%3E%3C/svg%3E)
SindreThorbjrnsen-2049
0
Reputation points
Hi,
Is it possible to configure refresh token behavior in External ID?
I am able to change the access token and ID token lifetime as described here: https://learn.microsoft.com/en-us/answers/questions/5612977/is-this-possible-to-configure-token-lifetime-in-en
However, I am not able to disable refresh tokens or shorten the refresh token lifetime.
Is it currently possible to configure refresh token lifetime or inactivity in External ID?
Additionally, do you know if or when Conditional Access session controls (such as sign-in frequency) will become available for External ID tenants?
Microsoft Security | Microsoft Entra | Microsoft Entra External ID
-
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(201.6, 99%, 29%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3ER%3C/text%3E%3C/svg%3E)
Rukmini 43,915 Reputation points Microsoft External Staff Moderator2026-01-14T14:12:55.1233333+00:00 Hello Sindre Thorbjørnsen
No, Refresh token behavior configuration is not yet supported by Microsoft Entra External ID. You are unable to configure inactivity timeouts, shorten their lifetime, or disable refresh tokens. The duration of refresh tokens is fixed and maintained by the platform.
- Access token and ID token lifetimes are configurable but refresh tokens are not affected by these settings.
As of right now, External ID tenants are not accessible for Conditional Access session controls (including Sign-in frequency). Consequently, you cannot use Conditional Access to manage refresh token usage.
There is no public ETA for when External ID will support refresh token controls or Conditional Access session controls.
Hence you can try to enforce session/idle timeouts at the application layer and managing re-authentication when refresh tokens expire.
Let me know if any further queries - feel free to reach out!
-
Rukmini 43,915 Reputation points Microsoft External Staff Moderator
2026-01-15T10:42:25.6766667+00:00 Hello Sindre Thorbjørnsen, Following up to see if the above provided information was helpful. If you have any further queries do let us know.
Sign in to comment
Sign in to answer