How to handle expired access tokens in the Microsoft identity platform using least-privilege authentication?

Answer

When an Azure AD access token nears expiration (typically 60–90 minutes), the client can renew it silently without prompting the user. The process must preserve the minimal set of scopes requested originally, ensuring the least‑privilege model remains intact.

1. Detect Near‑Expiration

• Decode the JWT (if available) and inspect the exp claim. Compare it to the current UTC time and trigger renewal if exp - now < 5 minutes.
• Alternatively, send the token to the resource API; a 401 Unauthorized with error=invalid_token or error=expired_token indicates expiration.

2. Trigger Silent Renewal

Use the Microsoft Authentication Library (MSAL) for the client type:

• SPA (public client): msalInstance.acquireTokenSilent({ scopes: requestedScopes }). MSAL will use the cached refresh token or a silent iframe exchange.
• Native apps: AcquireTokenSilentAsync in MSAL.NET or MSAL Android/iOS.
• Do not request .default unless the operation truly needs all app‑registered scopes. Request only the scopes required for the next API call.

3. Verify the New Token’s Scopes

After acquireTokenSilent returns, decode the new access_token and confirm its scp claim matches the original requestedScopes. If the payload is missing scp (e.g., for application tokens), validate the roles claim against the expected role set.

4. Confirm Silent Renewal Success Without Interactive Login

• Send a lightweight request (e.g., a GET /me on Microsoft Graph) with the new token. A 200 OK indicates success.
• If the request fails with 401 and error=interaction_required, the silent renewal failed and the user must be prompted for interactive sign‑in.

5. Optional: Revoke the Old Token

For extra security, call the POST https://login.microsoftonline.com/{tenant}/oauth2/v2.0/logout endpoint or the token revocation endpoint to invalidate the previous access token, especially if it may have been compromised.

Missing Diagnostic Detail

If you do not have a refresh token cached (e.g., the user signed in with a one‑time code or the app is a daemon service), the silent flow will fail. In that case, you must fall back to the appropriate interactive flow (Authorization Code) or, for non‑interactive services, use the client‑credentials flow with the minimal scope set.

Confirmed Facts (Based on Microsoft Documentation)

• MSAL’s acquireTokenSilent uses a cached refresh token or a silent iframe exchange to obtain a new access token.
• The scp claim lists the delegated scopes granted; the roles claim lists application roles.
• A 401 with error=interaction_required is the signal that silent renewal cannot proceed.

Practical Verification Steps

1. Decode the current token: jwt.ms or node-jose.
2. Trigger acquireTokenSilent and log the returned access_token.
3. Decode the new token and compare scp to the requested scopes.
4. Make a test API call with the new token and verify a 200 OK.