Refresh token
A refresh token is a credential a client sends to an authorization server to request new access tokens without repeating the full interactive sign-in.
How an application stays signed in
An access token has a limited lifetime. When an application has a refresh token, it can ask the authorization server for a new access token without always sending the user through an interactive sign-in again. The server decides whether to accept that request.
The refresh token is not sent to the API that holds the user’s files or messages. The application sends an access token there. One token renews access; the other is used to make the API request.
Does renewal always work?
No. Refresh tokens can expire or be revoked, and policy can require another sign-in. Having one does not guarantee that a future token request will succeed.
In Microsoft Entra, refresh tokens are associated with a user and client combination. They can obtain tokens for resources the client is allowed to access, subject to the relevant conditions. An earlier request for one resource does not necessarily limit later requests to that same resource.
A Microsoft Primary Refresh Token serves a different role in broker-based single sign-on. It is not simply the name of every refresh token issued to a Microsoft application.
Replacing a token and revoking it are different
Microsoft Entra can return a new refresh token when the client uses one. It does not revoke the old refresh token just because it was used. Clients should securely discard the old copy after storing its replacement.
Revocation is a separate action. Even when renewal is blocked, previously issued access tokens and application sessions may still work. During an incident, check those separately before concluding that access has ended.