How to Set a Custom Token Lifetime for One App in Entra ID 

How to Set a Custom Token Lifetime for One App in Entra ID 

Here’s something that comes up a lot: the security team wants shorter access tokens for one sensitive app, but nobody wants to change the sign-in experience for the rest of the tenant. Entra ID can do exactly that.  

The catch is that there’s no portal setting for it, so it’s PowerShell (or Graph) all the way. Here’s the quickest way to get it done. 

Microsoft Entra ID lets you configure token lifetimes using Microsoft Graph PowerShell. Here’s how to create a 30-minute token lifetime policy, assign it to an application, and verify the configuration. 

When Should You Configure a Custom Token Lifetime? 

Access tokens typically have a variable default lifetime of 60–90 minutes. ID and SAML tokens generally last one hour. 

Suppose your organization uses an internal application to access confidential business reports. You want to configure a shorter token lifetime for that application rather than changing the default for every application. 

A token lifetime policy can help. However, shorter lifetimes also increase token renewal requests, and they don’t necessarily force users to sign in interactively again. 

Step 1: Connect to Microsoft Graph 

First, install the Microsoft Graph PowerShell SDK if it isn’t already available. These permissions allow you to create token lifetime policies and assign them to applications. 

Install-Module Microsoft.Graph.Identity.SignIns, Microsoft.Graph.Applications -Scope CurrentUser 
Connect-MgGraph -Scopes "Policy.ReadWrite.ApplicationConfiguration","Application.ReadWrite.All" 

Step 2: Create a Token Lifetime Policy 

Let’s create a policy that sets the token lifetime to 30 minutes. 

$policy = New-MgPolicyTokenLifetimePolicy -BodyParameter @{ 
    DisplayName = "30-Minute Token Lifetime" 
    IsOrganizationDefault = $false 
    Definition = @('{"TokenLifetimePolicy":{"Version":1,"AccessTokenLifetime":"00:30:00"}}') 
} 

Keep IsOrganizationDefault as $false. Set to $true, this policy would apply to every app in your tenant. 

The AccessTokenLifetime property uses the hh:mm:ss format. Supported values range from 10 minutes (00:10:00) to 23 hours, 59 minutes, and 59 seconds (23:59:59). 

Step 3: Assign the Policy to an Application 

Next, find the application’s Object ID under its app registration in the Microsoft Entra admin center. Then replace the placeholder below: 

$app = Get-MgApplication -Filter "displayName eq 'Confidential Reports App'" 
New-MgApplicationTokenLifetimePolicyByRef -ApplicationId $app.Id -BodyParameter @{ 
    "@odata.id" = "https://graph.microsoft.com/v1.0/policies/tokenLifetimePolicies/$($policy.Id)" 
} 

Looking up the app by name saves you a trip to the portal. Note that -ApplicationId expects the Object ID, not the Application (client) ID, which is an easy mix-up. Assign the policy to the app whose tokens you want shortened, since policies are evaluated on the application being accessed.  

Step 4: Verify the Assignment: 

Check the policy assigned to the application:  

Get-MgApplicationTokenLifetimePolicyByRef -ApplicationId $applicationId  

To inspect the policy definition, run:  

Get-MgPolicyTokenLifetimePolicy -TokenLifetimePolicyId $policy.Id | Select-Object Id, DisplayName, Definition  

Important Limitations 

• Policy priority: An organization-level policy takes precedence over an application-level policy. Check for an existing organization policy if your configuration doesn’t take effect. 
• Refresh and session tokens: Their lifetimes are no longer configurable through these policies. Use Conditional Access sign-in frequency when you need to control how often users must sign in. 
• SharePoint and OneDrive: These policies apply to mobile and desktop clients, not browser sessions. 
• Managed identities: Configurable token lifetime policies aren’t supported for managed identity service principals. 
• Continuous Access Evaluation (CAE): Compatible clients may receive tokens valid for 24–28 hours, with near-real-time revocation for supported critical events. 

Configurable token lifetimes can help you apply different token validity requirements to supported applications. By creating and assigning policies through Microsoft Graph PowerShell, you can manage these settings without manually configuring each policy through a portal. 

Before deploying a shorter lifetime, test the application and confirm that the policy behaves as expected in your environment.