Bdtjtk

We are using Configurable token lifetimes in Azure Active Directory to change the max session age for multi-factor scenarios. While I've updated the policy with the command below, and confirmed that the access token lifetime changed from the default 60 minutes to 30 minutes, it did not change to 10 minutes as the policy indicates it should below. I've also confirmed it is the default org policy.

Set-AzureADPolicy -Id <OBJECT ID> -DisplayName "OrganizationDefaultPolicyUpdatedScenario" -Definition @('{"TokenLifetimePolicy":{"Version":1,"AccessTokenLifetime":"00:30:00","MaxAgeMultiFactor":"00:11:00","MaxAgeSessionMultiFactor":"00:10:00"}}')

I've checked the JWT token and confirmed exp is 30 minutes, so AccessTokenLifetime is implemented, but I'm using Outlook to test and confirmed MFA. The amr claim is "pwd,mfa".

Indirectly I think the MaxAgeMultiFactor timeout is working, but the session timeout is longer so it is hard to tell.

Why isn't MaxAgeSessionMultiFactor at 10 minutes (the minimum) working?

What am I doing wrong?

Complete policy:

class Policy

{

    Id = 2a094bfe-d74e-4d55-906f-7cef8e54746b

    OdataType =

    AlternativeIdentifier =

    Definition =

    [

        {

            "TokenLifetimePolicy":    

            {

                "Version":1,

                "AccessTokenLifetime":"00:30:00",

                "MaxAgeMultiFactor":"00:11:00",

                "MaxAgeSessionMultiFactor":"00:10:00"

            }

        }

    ]

    DisplayName = OrganizationDefaultPolicyUpdatedScenario

    IsOrganizationDefault = True

    KeyCredentials =

    [

    ]

    Type = TokenLifetimePolicy

}

Generally once access token is obtained, Azure AD will only check for the refresh token at the time of renewal. If the refresh token is also expired, Azure AD will then force the user for a fresh auth and check if MFA is required. If MFA is required, Azure AD will look to see if MFA cookie exists, MFA cookie is valid or not etc.

I see that you have only modified the access token lifetime and MFA lifetimes. So unless your MaxAgeSessionSingleFactor lifetime (Refresh Token) is less than MaxAgeSessionMultiFactor user will not be affected or prompted for MFA. Also single-factor authentication is considered less secure than multi-factor authentication, we recommend that you set MaxAgeSessionSingleFactor property to a value that is equal to or lesser than the Multi-Factor Refresh Token Max Age property(MaxAgeSessionMultiFactor).

With that being said, this feature is being deprecated as described in the article you are following. So we do not recommend using this feature in new environments.

"After hearing from customers during the preview, we're planning to replace this functionality with a new feature in Azure Active Directory Conditional Access. Once the new feature is complete, this functionality will eventually be deprecated after a notification period. If you use the Configurable Token Lifetime policy, be prepared to switch to the new Conditional Access feature once it's available." from the article.