


The default Azure AD refresh token expiration is 90 days.Users continue to access the customer engagement apps/Microsoft Dataverse data without the needs to reauthenticate until the Azure AD token lifetime policy expires. This Azure AD ID token refresh cycle continues in the background based on the Azure AD token lifetime policy configurations. For example, if an administrator disables or deletes a user account, blocks the user from signing in, and an administrator or user revokes the refresh token, the Azure AD session policy is enforced.

Every hour a new Azure AD ID Token is fetched silently in the background and the Azure AD instant policy is enforced (by Azure AD). Customer engagement apps use the Azure AD ID Token with a Policy Check Interval (PCI) claims. Honor Azure AD session policyīy default, the customer engagement apps leverage the Azure Active Directory (Azure AD) session policy to manage the user session timeout. This means that a user is not forced to sign in with their credentials to use the customer engagement apps and other Microsoft service apps like Outlook that were opened in the same browser session every 24 hours. The maximum user session timeout of 24 hours is removed. You can use security enhancements to better secure the customer engagement apps (Dynamics 365 Sales, Dynamics 365 Customer Service, Dynamics 365 Field Service, Dynamics 365 Marketing, and Dynamics 365 Project Service Automation).
