How to set idle timeout on Microsoft External ID

Question

How to set idle timeout on Microsoft External ID

Machado, Eduardo 40

I've configured Entra External ID with PowerPages following Microsoft documentation (link below) and I want to know how the session/idle timeout is configured. Is it on Entra, PowerPages or both?

https://learn.microsoft.com/en-us/power-pages/security/authentication/entra-external-id

Thanks!

Machado, Eduardo 40 Reputation points

2025-08-13T13:29:11.99+00:00

Thanks again!
Machado, Eduardo 40 Reputation points

2025-08-13T13:31:12.27+00:00

Hello @Sreetheja Adusumilli

Thanks a lot for your reply. Entra Ext ID is configured to authenticate with password and Email OTP as MFA. How this impact the refresh token lifetime? Will it be 90 days?

Regards,

Eduardo
Sreetheja Adusumilli 0 Reputation points Microsoft External Staff

2025-08-13T18:16:59.6066667+00:00
Hello Machado, Eduardo,
When Microsoft Entra External ID is set up to sign in users using both a password and an Email One-Time Passcode (OTP) as a second step (multi-factor authentication), the way the refresh token works changes from the usual.

Here’s the short explanation:

Normally, refresh tokens last about 90 days, meaning users can stay signed in without needing to log in again for up to 90 days.

But when Email OTP is used as the second factor, the refresh tokens expire much faster—usually after about 12 hours of no activity.

This means users will have to log in again every 12 hours, instead of staying signed in for 90 days.

This shorter refresh token lifetime is a security measure Microsoft put in place to reduce risks and protect accounts.

The usual 90-day refresh token period still applies if you use other MFA methods like a security key (FIDO) or Microsoft Authenticator, but not with Email OTP.

Microsoft is working on better ways to manage this, such as using Conditional Access policies that can control how often users must sign in.

Please Note:

Understand that with password + Email OTP, the refresh token only lasts about 12 hours.

Users will need to reauthenticate roughly every 12 hours.

You can use Conditional Access policies, like setting sign-in frequency, to balance security with user convenience.

Keep an eye on Microsoft updates for improved controls around Email OTP scenarios.

Reference Document:

Microsoft documentation on multifactor authentication prompts and session lifetime

Documentation on refresh tokens in Microsoft identity platform

Guidance on configuring adaptive session lifetime policies

Kindly let us know if the above helps or you need further assistance on this issue.

Please "Accept the answer" if the information helped you. This will help us and others in the community as well.

1 answer

Your answer

Machado, Eduardo 40 Reputation points

2025-08-13T13:29:11.99+00:00

Thanks again!
Machado, Eduardo 40 Reputation points

2025-08-13T13:31:12.27+00:00

Hello @Sreetheja Adusumilli

Thanks a lot for your reply. Entra Ext ID is configured to authenticate with password and Email OTP as MFA. How this impact the refresh token lifetime? Will it be 90 days?

Regards,

Eduardo
Sreetheja Adusumilli 0 Reputation points Microsoft External Staff

2025-08-13T18:16:59.6066667+00:00

Hello Machado, Eduardo,
When Microsoft Entra External ID is set up to sign in users using both a password and an Email One-Time Passcode (OTP) as a second step (multi-factor authentication), the way the refresh token works changes from the usual.

Here’s the short explanation:

Normally, refresh tokens last about 90 days, meaning users can stay signed in without needing to log in again for up to 90 days.

But when Email OTP is used as the second factor, the refresh tokens expire much faster—usually after about 12 hours of no activity.

This means users will have to log in again every 12 hours, instead of staying signed in for 90 days.

This shorter refresh token lifetime is a security measure Microsoft put in place to reduce risks and protect accounts.

The usual 90-day refresh token period still applies if you use other MFA methods like a security key (FIDO) or Microsoft Authenticator, but not with Email OTP.

Microsoft is working on better ways to manage this, such as using Conditional Access policies that can control how often users must sign in.

Please Note:

Understand that with password + Email OTP, the refresh token only lasts about 12 hours.

Users will need to reauthenticate roughly every 12 hours.

You can use Conditional Access policies, like setting sign-in frequency, to balance security with user convenience.

Keep an eye on Microsoft updates for improved controls around Email OTP scenarios.

Reference Document:

Microsoft documentation on multifactor authentication prompts and session lifetime

Documentation on refresh tokens in Microsoft identity platform

Guidance on configuring adaptive session lifetime policies

Kindly let us know if the above helps or you need further assistance on this issue.

Please "Accept the answer" if the information helped you. This will help us and others in the community as well.

Answer 1

Hello Machado, Eduardo
Thanks for reaching out to Microsoft Q&A.
When you connect Entra External ID (formerly Azure AD External Identities) to Power Pages, session and idle timeout settings are handled in two places:

Entra External ID – Controls how long authentication tokens last.

Power Pages – Controls how long the site keeps a user logged in before kicking them out for being idle.

Right now, Entra External ID has some restrictions:

You can’t customize session timeouts or token expiry for External ID users the same way you can for normal Azure AD users.
Token policies for refresh tokens were retired in 2021. - https://learn.microsoft.com/en-us/entra/identity-platform/configurable-token-lifetimes
Conditional Access Session policies don’t work with External ID tenants.
If you use Email OTP (one-time passcode) login, the refresh token always lasts 12 hours — you can’t change that.
Access tokens typically last around 60–90 minutes.

Document Reference: https://learn.microsoft.com/en-us/entra/external-id/customers/concept-supported-features-customers

Set the Timeout : You’ll mostly control session timeout from the Power Pages settings, because Entra External ID doesn’t give much flexibility for external guest accounts.

To Configure Timeout in Power Pages

Open Power Platform Admin Center → Go to your Power Pages environment.
Open the Portal Management App.
Go to Website > Site Settings. Add the following:
Idle Timeout

text
Name: Authentication/ApplicationCookie/ExpireTimeSpan  
Value: 00:10:00  → means 10 minutes of inactivity

After Timeout Redirect Page

text
Name: Authentication/ApplicationCookie/LoginPath  
Value: /SignIn  → page where users will be sent after timeout

Match Entra Token Lifetime (Optional)

     Name: Authentication/OpenIdConnect/[provider]/UseTokenLifetime
     Value: true (to sync with Entra token lifetime)

Settings on Entra Side (Limited Impact)

In Entra Admin Center → Go to Settings → Signing out + notifications → turn on directory-level idle timeout.
But note: This mainly affects the Entra portal, not the external Power Pages login.

Reference Documentation:

Areas for Optimization

If using Email OTP: Remember the refresh token will always expire after 12 hours.
If you want more control, switch to username/password login in Entra External ID.
Add client-side timeout warnings (e.g., a pop-up saying “Your session will expire soon”).
Balance security and user experience by choosing reasonable timeouts (5–10 mins is strict, 15–30 mins is relaxed).

Suggested Process:

Set the timeout in Power Pages (main control point).
Test by logging in and leaving the session idle.
Check if users are redirected to the login page after the set time.
Monitor user and token logs in Entra.

Please Note:

Power Pages controls your site session timeout.
Entra External ID controls token expiry, but has strict limits for Email OTP.

Kindly let us know if the above helps or you need further assistance on this issue.

Share via

How to set idle timeout on Microsoft External ID

1 answer

Your answer