Skip to content

Commit e347c96

Browse files
Merge pull request #214717 from OwenRichards1/ch-token-policies
[msid][content-health] configure-token-lifetimes.md (ADO-1997136)
2 parents 6b92639 + 6d41e31 commit e347c96

File tree

1 file changed

+9
-8
lines changed

1 file changed

+9
-8
lines changed

articles/active-directory/develop/configure-token-lifetimes.md

Lines changed: 9 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -9,29 +9,30 @@ ms.service: active-directory
99
ms.subservice: develop
1010
ms.workload: identity
1111
ms.topic: how-to
12-
ms.date: 04/08/2021
12+
ms.date: 10/17/2022
1313
ms.author: ryanwi
14-
ms.custom: aaddev, contperf-fy21q1
14+
ms.custom: identityplatformtop40, contperf-fy21q2, engagement-fy23
1515
ms.reviewer: ludwignick, jlu, annaba
1616
---
1717
# Configure token lifetime policies (preview)
18-
You can specify the lifetime of an access, SAML, or ID token issued by Microsoft identity platform. You can set token lifetimes for all apps in your organization, for a multi-tenant (multi-organization) application, or for a specific service principal in your organization. For more info, read [configurable token lifetimes](active-directory-configurable-token-lifetimes.md).
1918

20-
In this section, we walk through a common policy scenario that can help you impose new rules for token lifetime. In the example, you learn how to create a policy that requires users to authenticate more frequently in your web app.
19+
In the following steps, you'll implement a common policy scenario that imposes new rules for token lifetime. It's possible to specify the lifetime of an access, SAML, or ID token issued by the Microsoft identity platform. This can be set for all apps in your organization or for a specific service principal. They can also be set for multi-organizations (multi-tenant application).
20+
21+
For more information, see [configurable token lifetimes](active-directory-configurable-token-lifetimes.md).
2122

2223
## Get started
2324

2425
To get started, download the latest [Azure AD PowerShell Module Public Preview release](https://www.powershellgallery.com/packages/AzureADPreview).
2526

26-
Next, run the `Connect` command to sign in to your Azure AD admin account. Run this command each time you start a new session.
27+
Next, run the `Connect-AzureAD` command to sign in to your Azure Active Directory (Azure AD) admin account. Run this command each time you start a new session.
2728

2829
```powershell
2930
Connect-AzureAD -Confirm
3031
```
3132

3233
## Create a policy for web sign-in
3334

34-
In this example, you create a policy that requires users to authenticate more frequently in your web app. This policy sets the lifetime of the access/ID tokens to the service principal of your web app.
35+
In the following steps, you'll create a policy that requires users to authenticate more frequently in your web app. This policy sets the lifetime of the access/ID tokens to the service principal of your web app.
3536

3637
1. Create a token lifetime policy.
3738

@@ -73,7 +74,7 @@ To see all policies that have been created in your organization, run the [Get-Az
7374
Get-AzureADPolicy -All $true
7475
```
7576

76-
To see which apps and service principals are linked to a specific policy you identified run the following [Get-AzureADPolicyAppliedObject](/powershell/module/azuread/get-azureadpolicyappliedobject?view=azureadps-2.0-preview&preserve-view=true) cmdlet by replacing **1a37dad8-5da7-4cc8-87c7-efbc0326cf20** with any of your policy IDs. Then you can decide whether to configure Conditional Access sign-in frequency or remain with the Azure AD defaults.
77+
To see which apps and service principals are linked to a specific policy that you identified, run the following [`Get-AzureADPolicyAppliedObject`](/powershell/module/azuread/get-azureadpolicyappliedobject?view=azureadps-2.0-preview&preserve-view=true) cmdlet by replacing `1a37dad8-5da7-4cc8-87c7-efbc0326cf20` with any of your policy IDs. Then you can decide whether to configure Conditional Access sign-in frequency or remain with the Azure AD defaults.
7778

7879
```powershell
7980
Get-AzureADPolicyAppliedObject -id 1a37dad8-5da7-4cc8-87c7-efbc0326cf20
@@ -82,7 +83,7 @@ Get-AzureADPolicyAppliedObject -id 1a37dad8-5da7-4cc8-87c7-efbc0326cf20
8283
If your tenant has policies which define custom values for the refresh and session token configuration properties, Microsoft recommends you update those policies to values that reflect the defaults described above. If no changes are made, Azure AD will automatically honor the default values.
8384

8485
### Troubleshooting
85-
Some users have reported a `Get-AzureADPolicy : The term 'Get-AzureADPolicy' is not recognized` error after running the `Get-AzureADPolicy` cmdlet. As a workaround, run the following to uninstall/re-install the AzureAD module and then install the AzureADPreview module:
86+
Some users have reported a `Get-AzureADPolicy : The term 'Get-AzureADPolicy' is not recognized` error after running the `Get-AzureADPolicy` cmdlet. As a workaround, run the following to uninstall/re-install the AzureAD module, and then install the AzureADPreview module:
8687

8788
```powershell
8889
# Uninstall the AzureAD Module

0 commit comments

Comments
 (0)