Azure AD JWT Token Validation options

Question

In the Microsoft Azure AD Documentation the JWT Token validation process is described as validating the token signature and then validating its claims.

So, the validation happens entirely on the client side, without asking the Azure AD server whether the token is still valid.

Is there any option for "extended" validation of the token, i.e. by querying for the Azure server, so that the application granting the access to the resource could be sure that the person is still authorized and has an access to that resource.

Answer 1

No, access is granted for the lifetime of the token.

Tokens have an expiration date that you can read from the exp claim. You can control the expiration of a token which then requires the user to reauthenticate after expiration.

If you want to do extended validation, you will need to implement that logic.

ID Tokens

Access Tokens

Configurable token lifetimes in Azure Active Directory