3 ms·

https://learn.microsoft.com/en-us/azure/active-directory/conditional-access/concept-token-protection https://learn.microsoft.com/en-us/azure/active-directory/co

https://learn.microsoft.com/en-us/azure/active-directory/conditional-access/concept-token-protection https://learn.microsoft.com/en-us/azure/active-directory/con... Those “sessions which never expire” do, in fact, expire. It’s just that there’s more to it than time. The author should read up on the reasoning behind primary refresh tokens and session tokens.

neolefty 3y ago
They also expire faster when suspicious things happen, such as your IP address changing. Auth providers are pretty quiet about what they find "suspicious" — some are obvious, some are clever.