APIM managed Developer Portal MSAL authentication times out after ~30 seconds

Question

APIM managed Developer Portal MSAL authentication times out after ~30 seconds

Craig Chandler 5

We are using the managed Azure API Management Developer Portal with MSAL-based authentication.

We have now reproduced the same timeout behaviour with two different identity providers:

Azure AD B2C
Microsoft Entra ID / External Identities

In both cases, authentication works if the user completes the interactive login/signup quickly enough.

If the authentication interaction remains open for around 30 seconds, the Developer Portal fails with:

timed_out: See https://aka.ms/msal.js.errors#timed_out for details

This is especially problematic during signup when the user needs to wait for an email verification code.

We originally suspected Azure AD B2C, but we have now ruled that out.

Reproduction with Azure AD B2C

Open the APIM managed Developer Portal.
Start B2C signup.
Enter an email address.
Click Send verification code.
Wait approximately 33 seconds.
The authentication flow fails with timed_out.

As a control test, we ran the same B2C user flow directly using:

Azure AD B2C
→ User flows
→ Run user flow

The B2C signup remained active for more than 90 seconds without timing out.

Reproduction with Microsoft Entra ID

We then configured a separate Microsoft Entra ID authentication provider in the same APIM Developer Portal using:

MSAL
SPA application registration
External Identities self-service signup

The same behaviour occurs.

If the Entra authentication/signup interaction takes longer than approximately 30 seconds, the Developer Portal returns timed_out.

If authentication is completed quickly, it succeeds.

This means the issue is not specific to B2C.

Environment

Portal type:
Managed Azure API Management Developer Portal

Developer Portal URL:
https://developer.ourdomain.com

Authentication client library:
MSAL

B2C login domain:
ourdomain.b2clogin.com

B2C user flow:
B2C_1_NewUserSignUp

Entra workforce tenant:
ourdomain.onmicrosoft.com

Entra authentication:
External Identities / self-service signup

APIM redirect URI:
https://developer.ourdomain.com/signin

App registration redirect type:
Single-page application (SPA)

The B2C application registration uses:

"spa": {
  "redirectUris": [
    "https://developer.ourdomain.com/signin"
  ]
},
"web": {
  "redirectUris": []
}

The Entra application is also configured using a SPA redirect URI.

Questions

Does the managed APIM Developer Portal configure an MSAL interaction timeout of approximately 30 seconds?
Is this a known issue with the managed Developer Portal?
Is there any supported way to increase the MSAL popup/window/interaction timeout?
Is the timeout controlled by settings such as windowHashTimeout, iframeHashTimeout, loadFrameTimeout, or another MSAL monitor timeout?
If the timeout is hard-coded in the managed Developer Portal, is there a planned fix?
Is there a supported workaround other than self-hosting/customising the Developer Portal?

The important diagnostic point is that both B2C and Entra ID reproduce the same ~30-second timeout, while the underlying B2C user flow remains valid for more than 90 seconds when run directly.

I would appreciate confirmation from the APIM team whether this is expected behaviour or a product defect.

0 comments

2 answers

Your answer

Answer 1

Hello @Craig Chandler ,

Thank you for reaching out to Microsoft Q & A!

Your cross-provider test is the strongest part of this. Two independent identity providers failing at roughly the same ~30-second mark, while the B2C user flow itself stays valid past 90 seconds when run directly, appears consistent with @Anonymous 's reading that the limit isn't coming from B2C or Entra External ID. That said, it points away from the identity providers rather than confirming where the timeout originates.

On questions 3 and 4 — I haven't found any documented mechanism to configure MSAL timeout parameters such as windowHashTimeout, iframeHashTimeout, or loadFrameTimeout in the managed Developer Portal. The documented customization surface for the managed portal covers the visual editor, the custom HTML code widget, and custom widgets — none of which reach MSAL initialization.

On questions 1, 2 and 5 — whether the managed portal applies a fixed MSAL interaction timeout, whether it's a known issue, and whether a fix is planned aren't answerable from public documentation. Determining whether this is a service defect or an undocumented limitation of the managed portal needs the APIM product team, and a support request under API Management → Developer portal is the route that gets it there. Your reproduction is already well documented; a browser trace or HAR capturing the failure, plus the APIM tier, region and timestamps, is what they'll ask for.

On question 6 — I'd hold off on self-hosting as a workaround until that's established. Azure Support's assistance for self-hosted portals is documented as limited to basic setup, and self-hosting also drops the visibility and access controls that only the managed portal supports.

References:

Please "Accept the Answer" if this information helped you. This will help us and others in the community as well.

Answer 2

Hello @Craig Chandler

Your testing strongly suggests the timeout is occurring in the managed APIM Developer Portal/MSAL integration, rather than in Azure AD B2C or Entra External Identities. The strongest evidence is that both identity providers fail at roughly the same ~30-second point, while the B2C flow itself remains active beyond 90 seconds when run directly.

Microsoft's current APIM documentation confirms that the managed Developer Portal uses MSAL for Microsoft Entra authentication and specifically instructs customers using the older ADAL integration to migrate to MSAL.

I don't see a documented APIM setting that exposes windowHashTimeout, iframeHashTimeout, loadFrameTimeout, or another MSAL timeout for the managed Developer Portal. Those MSAL client options therefore shouldn't be assumed configurable through APIM.

Given your reproducible cross-provider test, open an Azure Support case under API Management → Developer Portal, providing the ~30/33-second reproduction, browser trace/HAR, portal URL, APIM tier/region, and timestamps. Ask the APIM engineering team specifically whether the managed portal has a fixed MSAL interaction timeout.

Avoid changing the B2C/Entra user flows as a workaround. The direct-flow test indicates they aren't the component imposing the timeout.

Reference: Configure Microsoft Entra authentication for the APIM Developer Portal

At this point, Microsoft needs to confirm whether the ~30-second behavior is an undocumented managed-portal limitation or a product defect; don't self-host the portal solely to work around it until that is established.

Help make this community better for everyone: if this answer resolved your issue, please accept it or upvote it. If not, share more details in a comment so we can continue the discussion and find the right solution.