.Net Project Graph SDK Token is expiring when deployed to Azure App Service

[ricardomatos95]

Describe the bug

I developed a .NET webapp and after deploying it into Azure App servicey the access token seems to be expiring after 1h and not refreshing and throwing me the error:

ODataError: Lifetime validation failed, the token is expired.

Currently I have a class called Invite.cshtml.cs that looks like this:

namespace Test_Web_App.Pages
{
    [AuthorizeForScopes(ScopeKeySection = "MicrosoftGraph:Scopes")]
    public class InviteModel : PageModel
    {
        private readonly GraphServiceClient _graphServiceClient;
        private readonly ILogger<IndexModel> _logger;
        private readonly IConfiguration _configuration;
        private readonly IHttpContextAccessor _httpContextAccessor;

        public InviteModel(  ILogger<IndexModel> logger, IConfiguration configuration, GraphServiceClient graphServiceClient, IHttpContextAccessor httpContextAccessor)
        {
            _logger = logger;
            _graphServiceClient = graphServiceClient; ;
            _configuration = configuration;
            _httpContextAccessor = httpContextAccessor;
        }

public async Task<IActionResult> OnPostAsync()
{
        var user = await _graphServiceClient.Me.GetAsync(); ;
//Other actions
 }

The code after 1 hour of the user being signed in throws a server error for token expiration on my OnPostAsync method as soon as it tries to load the graphServiceClient:

public async Task<IActionResult> OnPostAsync()
{
        var user = await _graphServiceClient.Me.GetAsync(); ;
}

On my Program.cs I have setup the following:

var builder = WebApplication.CreateBuilder(args);

var initialScopes = builder.Configuration["AzureAd:Scopes"]?.Split(' ') ?? builder.Configuration["MicrosoftGraph:Scopes"]?.Split(' ');

// Add services to the container.
builder.Services.AddAuthentication(OpenIdConnectDefaults.AuthenticationScheme)
    .AddMicrosoftIdentityWebApp( options =>
    {
        builder.Configuration.Bind("AzureAd", options);
        options.SaveTokens = true; // Ensure tokens are saved
    })
        .EnableTokenAcquisitionToCallDownstreamApi(initialScopes)
            .AddInMemoryTokenCaches().AddMicrosoftGraph();

builder.Services.AddAuthorization(options =>
{
    // By default, all incoming requests will be authorized according to the default policy.
    options.FallbackPolicy = options.DefaultPolicy;
});
builder.Services.AddRazorPages().AddMicrosoftIdentityUI();
var app = builder.Build();

Expected behavior

I expected the builder settings in Program.cs to automatically refresh the Access token since they are using graph sdk

How to reproduce

• Create builder for Initialize GraphServiceClient.
• Create class to send call to graphServiceClient (e.g., graphServiceClient.Me.GetAsync(); )
• Publish application to Azure Web App
• Open Azure Web app trigger Post method.
• Wait 1 hour for token to expire and trigger post method again

SDK Version

5.56.0

Latest version known to work for scenario above?

No response

Known Workarounds

N/A

Debug output

Click to expand log

```

</details>


### Configuration

Windows 11
x64

### Other information

_No response_

[andrueastman]

Thanks for raising this @ricardomatos95

The line below suggests that you are using the Microsoft.Identity.Web.GraphServiceClient library for acquiring tokens. Any chance this is the case?

.EnableTokenAcquisitionToCallDownstreamApi(initialScopes)
            .AddInMemoryTokenCaches().AddMicrosoftGraph();

If so, I believe the right place to file the issue is at https://github.com/AzureAD/microsoft-identity-web/issues

[ricardomatos95]

Hi @andrueastman thank you for reaching out,
So the responsible actor for keeping the token alive is the Microsoft.Identity.Web.GraphServiceClient ?

I assumed when calling the SDK through _graphServiceClient.Me.GetAsync(); ; it would be here that the refresh would be triggered by the SDK to refresh the token in case the one provided is not valid.

Is this not the case, because from what I've seen the SDK should have cover the refresh automatically no?