Steps to Refresh an Access Token:

Prepare the HTTP POST Request: You will need to send a POST request to the token endpoint of the Microsoft identity platform. Set the Endpoint URL: The URL for the token request is:

https://login.microsoftonline.com/{tenant-id}/oauth2/v2.0/token">https://login.microsoftonline.com/{tenant-id}/oauth2/v2.0/token

Replace {tenant-id} with your actual Azure AD tenant ID. Include the Required Parameters in the Request Body: The body of your POST request should include the following parameters: client_id: Your application's client ID. scope: The scopes for which the access token is requested. Typically, this is set to https://graph.microsoft.com/.default to include all delegated permissions your app has consented to. refresh_token: The refresh token you received during the initial authentication. grant_type: Should be set to refresh_token. client_secret: Your application's client secret. This is required for confidential clients. Send the Request: You can use tools like curl, Postman, or code in a programming language like Python. Here's how you can do it using curl:

curl -X POST -H "Content-Type: application/x-www-form-urlencoded" -d "client_id={client_id}&scope=https://graph.microsoft.com/.default&refresh_token={refresh_token}&grant_type=refresh_token&client_secret={client_secret}" https://login.microsoftonline.com/{tenant-id}/oauth2/v2.0/token Handle the Response: The response from the Microsoft identity platform will contain a new access token, a new refresh token, and other tokens related details. You should update your storage mechanism where these tokens are stored and used in your application.

Example Using Python Here’s a Python script using the requests library to refresh the token. You can adapt this into your automation scripts:

import requests

def refresh_token(client_id, client_secret, refresh_token, tenant_id): url = f"https://login.microsoftonline.com/{tenant_id}/oauth2/v2.0/token" headers = {'Content-Type': 'application/x-www-form-urlencoded'} body = { 'client_id': client_id, 'scope': 'https://graph.microsoft.com/.default', 'refresh_token': refresh_token, 'grant_type': 'refresh_token', 'client_secret': client_secret, } response = requests.post(url, headers=headers, data=body) return response.json()

Example usage

client_id = 'your-client-id' client_secret = 'your-client-secret' refresh_token = 'your-refresh-token' tenant_id = 'your-tenant-id'

response = refresh_token(client_id, client_secret, refresh_token, tenant_id) print(response)

This Python function sends a request to refresh the access token and prints the response. Make sure to handle the new refresh token appropriately because it will replace the old refresh token.

Hello Deeksha,

Thanks you for your help.

Do you know if we can generate or refresh the token without recreating all the authentification ?

I mean, I know the current token and all the value, maybe there is a command to push to generate for the same AppID/ClientID another token and put it in our automaton ?

Regards.

Hi I’m a Microsoft user like yourself and I will try to help you as best as I can today.

Ensure Correct API Endpoint: You must send a request to the correct Microsoft identity platform token endpoint. This should generally be:

https://login.microsoftonline.com/{tenant-id}/oauth2/v2.0/token">https://login.microsoftonline.com/{tenant-id}/oauth2/v2.0/token Replace {tenant-id} with your organisation’s tenant ID.

Prepare the Request: Method: POST Headers: Content-Type: application/x-www-form-urlencoded Body (form-encoded):

client_id={your-client-id} scope=https://graph.microsoft.com/.default">https://graph.microsoft.com/.default refresh_token={your-refresh-token} grant_type=refresh_token client_secret={your-client-secret}

Send the Request: You can use a tool like Postman or curl to send this request. If using curl, the command would look like this:

curl -X POST -H "Content-Type: application/x-www-form-urlencoded" -d "client_id={your-client-id}&scope=https://graph.microsoft.com/.default&refresh_token={your-refresh-token}&grant_type=refresh_token&client_secret={your-client-secret}" https://login.microsoftonline.com/{tenant-id}/oauth2/v2.0/token

Common Issues to Check if You Encounter Errors Expired Refresh Token: Refresh tokens have a limited lifetime. If the refresh token has expired, you may need to initiate the entire authentication flow again to obtain a new access token and refresh token.

Incorrect Scope: Ensure that the scope you are requesting matches what was requested during the initial authentication. For Microsoft Graph, using https://graph.microsoft.com/.default is usually appropriate for refreshing tokens.

Incorrect Client Credentials: Double-check that the client_id, client_secret, and tenant-id are correct and belong to the registered application in Azure AD that you are using for this integration.

Debugging Tips Check the Error Response: The response from the token endpoint will usually contain an error description that can provide more insight into what went wrong. Logging: Make sure to log the full request and response (without sensitive data) to help trace the issue.

Implementing in JSM Automation Once you successfully refresh the token, you'll need to update the token stored in your JSM automation configuration (or wherever it is stored) so that subsequent API calls use the new access token. It might also be helpful to automate the token refresh process if the integration frequently encounters expired tokens.

If you're still experiencing difficulties, double-check all parameters and possibly re-examine the application permissions and configurations in your Azure AD setup. Sometimes, permissions or other application settings might prevent token refreshes from working as expected. If the problem persists, consider reaching out to Microsoft support

Hope this helps! Please let us know if you have any questions. Microsoft Support is available for further assistance if the issue persists.

Best Regards Deeksha