Configurable token lifetimes in Azure Active Direc

问题:

I could not assign TokenLifetimePolicy Azure AD application policy from PowerShell. I had an error BadRequest : Message: Open navigation properties are not supported on OpenTypes.Property name: 'policies

I am trying to implement token expiry time from Configurable token lifetimes in Azure Active Directory

See screenshot below, any useful links and solutions on the AzureAD cmdlet Add-AzureADApplicationPolicy are welcome

回答1:

I made it work by only using New-AzureADPolicy cmdlet and setting -IsOrganizationDefault $true not $false. The effect takes a while for you to see it. So wait for about 30 minutes to an hour (I don't know how long exactly). After that your new policy will be created and applied. Also remember that this is PowerShell, so no whitespaces in the cmdlet.

Example:

New-AzureADPolicy -Definition @('{"TokenLifetimePolicy":{"Version":1,"AccessTokenLifetime":"02:00:00","MaxInactiveTime":"02:00:00","MaxAgeSessionSingleFactor":"02:00:00"}}') -DisplayName "PolicyScenario" -IsOrganizationDefault $true -Type "TokenLifetimePolicy"

Multi-Line version:

New-AzureADPolicy -Definition @(
    '
        {
            "TokenLifetimePolicy":
                {
                    "Version": 1,
                    "AccessTokenLifetime": "02:00:00",
                    "MaxInactiveTime": "02:00:00",
                    "MaxAgeSessionSingleFactor": "02:00:00"
                }
        }
    '
    ) -DisplayName "PolicyScenario" -IsOrganizationDefault $true -Type "TokenLifetimePolicy"

Microsoft may fix the issue with IsOrganizationDefault $true. Read more on this in the question: Azure AD Configurable Token Lifetimes not being Applied.

回答2:

I test this quite a bit for my customers. I run into issues like this every now and then due to not on the latest version of PowerShell.

get-module

Latest Version 2.0.0.114 at the moment for AzureADPreview (V2) Instructions to download here

There was an issue with -IsOrganizationDefault $true as Seth has pointed out.

Another issue I've found is having multiple versions of PowerShell on your system and it's loading the wrong one that doesn't have the updated bits. I hit this last Friday - I had to wipe everything and reinstall - then it fixed it.

Also -

There is a difference between:

Add-AzureADApplicationPolicy

and

Add-AzureADServicePrincipalPolicy

One is for an application object and the other is for a ServicePrincipal. If you are applying it to say, a SAML-Based application, then you should apply it to the ServicePrincpal.

Note: There is a different ObjectID for the application object and the servicePrincipal object. Don't get these confused. For an experiment, run the two cmds against your application:

Get-AzureADServicePrincipal -SearchString <name of app>
Get-AzureADApplication -SearchString <name of app>

If you grab the wrong ObjectID - no go when you go to apply the policy

The sequence for these Policies are: ServicePrincipal -> Application -> Tenant (organization)

回答3:

Was the application created in B2C portal?

Assuming the answer is yes, this behavior is expected: Microsoft has 2 authorization end points, V1 and V2.

B2C portal creates V2 apps. The token lifetime setting from powershell probably only works against the V1 apps.

There are settings on the b2c blade to change this.

The other option is to create an app from the azure active directory blade(as opposed to the b2c blade). Then you can set the token life time using powershell.