AADSTS700082: refresh token expired due to inactivity
The app's refresh token expired because it wasn't used for too long, so the user has to sign in interactively again.
From Microsoft's documentation, checked 9 Nov 2026.
AADSTS700082: ExpiredOrRevokedGrantInactiveToken - The refresh token has expired due to inactivity. The token was issued on {issueDate} and was inactive for {time}.Also searched as: ExpiredOrRevokedGrantInactiveToken · refresh token expired
What it means
Microsoft describes this as an expected part of the token lifecycle: the user went a long time without using the app, so the refresh token had expired when the app tried to use it. Refresh tokens last 24 hours for single-page apps and email one-time passcode flows and 90 days in other scenarios by default, and can be revoked earlier.
Common causes
- The user didn't use the application for longer than its refresh token lifetime.
How to fix it
Find the failing sign-in
In the Microsoft Entra admin center, go to Entra ID > Monitoring & health > Sign-in logs and filter by user, date and correlation ID. Or query the logs with Microsoft Graph PowerShell (needs AuditLog.Read.All); Microsoft recommends a time range so the request doesn't time out.
$since = (Get-Date).ToUniversalTime().AddDays(-7).ToString("yyyy-MM-ddTHH:mm:ssZ")
Get-MgAuditLogSignIn -Filter "status/errorCode eq 700082 and createdDateTime ge $since" -Top 10Check which lifetime applies
Default refresh token lifetimes are 24 hours for single-page apps and email one-time passcode flows, and 90 days for everything else.
Handle it in the app
Microsoft's guidance is for the app to handle expiry and revocation by sending the user to an interactive sign-in to get new tokens.
How to confirm it's fixed
- After an interactive sign-in the app receives new tokens and the error stops for that user.
Related engineering templates
Follow Microsoft Entra ID failures and fixes
A short email about twice a week with new runbooks, configuration traps and fixes from KBY Technologies.