Azure Active Directory not getting the refresh token any longer

Question

We have an unexpected issue: When we are hitting endpoint: https://login.microsoftonline.com/common/oauth2/v2.0/token, we are not getting the refresh token anymore as seen in the picture attached, have not changed anything code side. It seems that this has recently stopped working on 27th November.

Some things to note:

we've tried with two different application id + secret and still same issue, any ideas? Any help would greatly be appreciated.
We've already added offline access as per here: https://docs.microsoft.com/en-us/azure/active-directory/develop/v2-permissions-and-consent#offline_access

I have attached the following screenshot:

Update solution found: previously, in the authorization code, we were using the default, and it was working fine. However, something seems to be changed at the Azure Active Directory side. So we changed the request authorization code scope, and that resolved the issue.

Changed from this:

let URL = https://login.microsoftonline.com/common/oauth2/v2.0/authorize?client_id=000000000-af44-44c9-a967-000000000000&response_type=code&redirect_uri=http://localhost:3000/token&response_mode=query&scope=https://graph.microsoft.com/.default&state=12345

To this:

let url = https://login.microsoftonline.com/common/oauth2/v2.0/authorize?client_id=000000-af44-44c9-a967-00000&response_type=code&redirect_uri=http://localhost:3000/token&response_mode=query&scope=openid%20offline_access%20https%3A%2F%2Fgraph.microsoft.com%2Fmail.read&state=12345

Have you tried adding offline_access scope when requesting the tokens? I think that's required to get refresh tokens. — juunas
Yes, I am using offline_access already. However we resolved the issue, I am updating the description now with what we did. — Twana Daniel
Previously, in the authorization code, we were using the default, and it was working fine. However, something seems to be changed at the Azure Active Directory side. So we changed the request authorization code scope, and that resolved the issue. And thanks @juunas for your input... — Twana Daniel

Hury Shen Hury Shen · Accepted Answer · 2020-12-07T01:24:33

Summarize the solution from the comments(also from OP updated in question) for communities reference:

offline_access is necessary in scope if we want to get refresh token. So just change

let URL = https://login.microsoftonline.com/common/oauth2/v2.0/authorize?client_id=000000000-af44-44c9-a967-000000000000&response_type=code&redirect_uri=http://localhost:3000/token&response_mode=query&scope=https://graph.microsoft.com/.default&state=12345

to

let url = https://login.microsoftonline.com/common/oauth2/v2.0/authorize?client_id=000000-af44-44c9-a967-00000&response_type=code&redirect_uri=http://localhost:3000/token&response_mode=query&scope=openid%20offline_access%20https%3A%2F%2Fgraph.microsoft.com%2Fmail.read&state=12345

Azure Active Directory not getting the refresh token any longer

1 Answers