Silently re-authenticate Active Directory account - active-directory

Question

I'm looking for a way to silently verify that a user is still present in Active Directory after initially using AD to authenticate them.
My code for the user authentication looks like this:
var authenticateResult = await app.AcquireTokenAsync(settings.Scopes, username, UIBehavior.ForceLogin, "");
Where app is an instance of PublicClientApplication and username is a previously remembered username, if any, otherwise blank.
If this authentication succeeds, my app creates a persistent JWT token, stores it in local preferences, and uses that token for a long time (up to 60 days). If my app is closed and re-opened during that time, it re-uses the stored token and skips the AD authentication.
The problem I'm having is that my customer wants the app to check periodically (every hour or so) to ensure that the user's Active Directory access is still valid, and they want to do this without interrupting the user or presenting any UI. I tried using UIBehavior.NoPrompt, but that didn't work, I still got a prompt. I also tried using app.GetAccountAsync or GetAccountsAsync, since all I really need to do here is to ensure that the user's account still appears, but this doesn't work either (the calls return nothing).
I proposed to my customer that we simply lower the lifetime of the JWT token, but they don't want to do this. They want their users to be able to keep using the app for 60 days without logging in, unless they remove the user from AD during that time.
What's the best way to accomplish this?

Answer 1

The best way is to use refresh token.By default, access tokens expire after 1h. So it is recommended forcing a refresh every 30 min, or half the lifetime of the AT when this is a custom lifetime. The default value of refresh token is 90 days, 14 day inactive sliding .
So, If we want users to keep using the app for 60 days then we need o stop fetching refresh token on 60th day.
If we want to check user is in AAD programmatically. Then we can use MS Graph. Please go through Ms graph document for more details.
The C# code snippet is available below,
GraphServiceClient graphClient = new GraphServiceClient( authProvider );
var users = await graphClient.Users
.Request()
.GetAsync();
Ms Graph sample where we can test the above snippet is here.