From an application's perspective, the validity period of the token is specified by the NotOnOrAfter value of the element in the token. The default lifetime of the token is 1 hour. They are also consumed by applications using WS-Federation. SAML tokens are used by many web-based SaaS applications, and are obtained using Azure Active Directory's SAML2 protocol endpoint. For more information, see Access token lifetime. The default lifetime also varies depending on the client application requesting the token or if conditional access is enabled in the tenant. When issued, an access token's default lifetime is assigned a random value ranging between 60-90 minutes (75 minutes on average). The default lifetime of an access token is variable. Improved system performance is achieved by reducing the number of times a client needs to acquire a fresh access token. Adjusting the lifetime of an access token is a trade-off between improving system performance and increasing the amount of time that the client retains access after the user's account is disabled. A malicious actor that has obtained an access token can use it for extent of its lifetime. Access tokens cannot be revoked and are valid until their expiry. An access token can be used only for a specific combination of user, client, and resource. Access tokensĬlients use access tokens to access a protected resource. You can set token lifetime policies for access tokens, SAML tokens, and ID tokens.

Token lifetime policies for access, SAML, and ID tokens To find the right license for your requirements, see Comparing generally available features of the Free and Premium editions.Ĭustomers with Microsoft 365 Business licenses also have access to Conditional Access features. Using this feature requires an Azure AD Premium P1 license. Refer to the SharePoint Online blog to learn more about configuring idle session timeouts. To manage the lifetime of web browser sessions for SharePoint Online and OneDrive for Business, use the Conditional Access session lifetime feature. Configurable token lifetime policy only applies to mobile and desktop clients that access SharePoint Online and OneDrive for Business resources, and does not apply to web browser sessions.

Loginmicrosoft365 online