This actually isn't determined by Microsoft Graph but rather by Azure Active Directory.
For a given tenant, the life-time can be configured using Configurable token lifetimes in Azure Active Directory (Public Preview). There are a couple of important notes about this functionality:
-
This functionality is still in Preview, so functionality may change between now and general release.
-
This configuration is per tenant, service principal, or application. If you configure it on the application, then the policy will apply on multi-tenant applications unless superseded by a policy on the service principal or tenant level.
-
The maximum lifetime for an Access token is 24 hours (minimum is 10 minutes, default is 1 hour).
In general, rather than adjusting the lifetime of the Access Token you should rely on the Refresh Token instead. These have a much longer lifetime of 14 days.
