Share via

Are Refresh Token OAuth Flows are impacted by Phase 2 MFA enforcement?

Rozerin Akkus 0 Reputation points
2026-03-12T18:04:03.03+00:00

Hello,

I wanted to ask for clarification for the Phase 2 MFA enforcement presented in this doc: https://learn.microsoft.com/en-us/entra/identity/authentication/concept-mandatory-multifactor-authentication?tabs=dotnet#request-more-time-to-prepare-for-phase-2-mfa-enforcement

We have integrations that use the OAuth2 with refresh token flow, mainly to access Graph API and SharePoint CSOM/REST apis for read operations. Although the document states that Generally, Microsoft Graph APIs aren't in scope for Azure MFA enforcement. Only requests sent to https://management.azure.com/ are under scope of enforcement., I wanted to get confirmation on this.

Would the existing tokens be revoked since they are not obtained by MFA?

Microsoft Security | Microsoft Entra | Microsoft Entra ID
0 comments
Answer accepted by question author
  1. Rukmini 30,115 Reputation points Microsoft External Staff Moderator
    2026-03-12T18:15:11.59+00:00

    Hello Rozerin Akkus

    No, Phase 2 MFA enforcement has no effect on OAuth2 renew token flows used for SharePoint CSOM/REST or the Microsoft Graph API.

    According to the documentation, requests made to Azure Resource Manager (https://management.azure.com/) are primarily subject to required MFA enforcement. In general, this enforcement does not apply to Microsoft Graph APIs.

    Therefore:

    • Refresh tokens that already exist won't be invalidated just because they weren't obtained using MFA. -
    • Until their normal expiration or revocation events (password reset, admin revocation, Conditional Access modifications, etc.), refresh tokens will remain functional.
    • Integrations that use the Graph or SharePoint APIs for read operations should keep working as usual.

    Microsoft recommends adopting service principals or managed identities instead of user accounts for automation as a long-term best practice.

    If the assistance was helpful, kindly take a moment to click on 210246-screenshot-2021-12-10-121802.pngand click on Yes for was this answer helpful. And, if you have any further query do let us know.

    0 comments

0 additional answers

Sort by: Most helpful
Most helpful Newest Oldest

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.