Recorded 14 Oct 2026 at 10:19 UTC. This is what ChangeIntel recorded, including the title, summary, facts and links. It is not a statement of the source's current position. See the latest record.
Authorization codes can no longer be reused
Effective date: November 15, 2018 Endpoints impacted: Both v1.0 and v2.0 Protocol impacted: Code flow Starting on November 15, 2018, Microsoft Entra ID will stop accepting previously used authentication codes for apps. This security change helps to bring Microsoft Entra ID in line with the OAuth specification and will be enforced on both the v1 and v2 endpoints. If your app reuses authorization codes to get tokens for multiple resources, we recommend that you use the code to get a refresh token, and then use that refresh token to acquire additional tokens for other resources. Authorization codes can only be used once, but refresh tokens can be used multiple times across multiple resources. Any new app that attempts to reuse an authentication code during the OAuth code flow will get an invalid_grant error. For more information about refresh tokens, see Refreshing the access tokens. If using MSAL, this is handled for you by the library - replace the second instance of AcquireTokenByAuthorizationCodeAsync with AcquireTokenSilentAsync.
What it said
- Published
- 1 Oct 2018
- Product
- Microsoft Entra
Recorded links
What changed
First observed 14 Oct 2026No field changes in the recorded history.
Cite this recorded revision to keep the same title, summary, facts and links when the page changes.
A day selects the latest observation by the end of that UTC day; today's selection can change until midnight. History starts when this installation records it.