Forum Discussion

Yoel_Horvitz's avatar
Yoel_Horvitz
Icon for Microsoft rankMicrosoft
Mar 17, 2023

Azure AD B2C authorization code and refresh token size increase update

Update September 11, 2023: This post is irrelevant anymore   As part of ongoing security improvement efforts in Azure Active Directory (AAD), part of Microsoft Entra, Azure AD B2C will be rolling...
Azure AD B2C
Expecho's avatar
Expecho
Copper Contributor
Apr 21, 2023

Yoel_Horvitz Wow this caused us a lot of trouble. We have some desktop apps that lets users log in using Azure B2C. This morning our support desk was overwhelmed with calls of customers not being able to log in due to this change. We found out that customers running an older version of our software where primarily impacted by this change. Customers running newer versions where not impacted. Turned out new version use a newer version of the MSAL NuGet package, in which support for this change was introduced: https://github.com/AzureAD/microsoft-authentication-library-for-dotnet/releases/tag/4.35.0

 

  • Limits on URL length in embedded browsers was causing errors with auth code. Applications will not fail on the embedded browers due to the limitation. See issue https://github.com/AzureAD/microsoft-authentication-library-for-dotnet/issues/2743

 

We would very much like to know what we should have done to prevent this. Is this blog post the only way of communication regarding this update? What will Microsoft do in order to prevent this from happening again since a lot of replies mention the poor communication regarding this change.

Resources