Feature Request: Support for Token Lifetime Policies

[nominalnz]

Community Note

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritise this request
• Please do not leave "+1" or "me too" comments, they generate extra noise for issue followers and do not help prioritise the request
• If you are interested in working on this issue or have submitted a pull request, please leave a comment

Description

This feature request is to add support for managing token lifetime policies in the Azure AD Terraform provider. Token lifetime policies allow administrators to specify the lifetime of access, SAML, and ID tokens issued by the Microsoft identity platform. This functionality would enable users to create, update, delete, and assign token lifetime policies to applications and service principals using Terraform.
Key capabilities to include:

1. Create and manage token lifetime policies
2. Assign policies to applications and service principals
3. Configure access token lifetimes
4. Set organization-wide default policies

This feature would greatly enhance the ability to manage Azure AD authentication and security settings through Infrastructure as Code.

New or Affected Resource(s)

• azuread_token_lifetime_policy (new resource in the Policies category)
• azuread_application_token_lifetime_policy_assignment (new resource in the resource in Applications category)
• azuread_service_principal_token_lifetime_policy_assignment (new resource in the resource in Service Principals category)

Potential Terraform Configuration

Application Configuration:

resource "azuread_application" "example" {
  display_name = "example"
}

resource "azuread_token_lifetime_policy" "example" {
  display_name = "Example Token Lifetime Policy"
  is_organization_default = false
  definition = jsonencode({
    TokenLifetimePolicy = {
      Version = 1
      AccessTokenLifetime = "8:00:00"
    }
  })
}

resource "azuread_application_token_lifetime_policy_assignment" "example" {
  token_lifetime_policy_id = azuread_token_lifetime_policy.example.id
  application_id = azuread_application.example.id
}

Service Principal Configuration:

resource "azuread_application" "example" {
  display_name = "example"
}

resource "azuread_service_principal" "example" {
  client_id = azuread_application.example.client_id
}

resource "azuread_token_lifetime_policy" "example" {
  display_name = "Example Token Lifetime Policy"
  is_organization_default = false
  definition = jsonencode({
    TokenLifetimePolicy = {
      Version = 1
      AccessTokenLifetime = "8:00:00"
    }
  })
}

resource "azuread_application_token_lifetime_policy_assignment" "example" {
  token_lifetime_policy_id = azuread_token_lifetime_policy.example.id
  service_principal_id = azuread_service_principal.example.id
}

References

• Configurable token lifetimes in the Microsoft identity platform (preview)
• Configure token lifetime policies (preview)
• Microsoft Graph API: tokenLifetimePolicy resource type
• Microsoft Graph API: Add tokenLifetimePolicy (service principal)
• Microsoft Graph API: Add tokenLifetimePolicy (application)

[nominalnz]

@manicminer I'd be interested in contributing and building this feature. It should be straightforward because resources with a similar structure exist. For example, azuread_claims_mapping_policy and azuread_service_principal_claims_mapping_policy_assignment. What do you reckon?