Share via

How to set FPC cookie in AZURE OAuth 2.0 Token as a session cookie

Tejasree Naga 0 Reputation points
2025-06-30T11:45:15.21+00:00

Using a pass through proxy service to call login.microsft Oauth 2.0 Endpoint to generate token

  1. Token response has a fpc cookie with 1 month expiration date - how to remove expiry to make it a session token.
  2. token doesnt contain JTI , how to add it .
Azure API Management
Azure API Management

An Azure service that provides a hybrid, multi-cloud management platform for APIs.

0 comments

1 answer

Sort by: Most helpful
Most helpful Newest Oldest
  1. Amira Bedhiafi 41,386 Reputation points MVP Volunteer Moderator
    2026-04-23T20:02:22.44+00:00

    Hello !

    You can’t directly make the Entra fpc cookie a session cookie from the Azure OAuth token endpoint. fpc is a Microsoft managed cookie used for tracking, throttling or protection and its behavior isn’t exposed as a tenant setting. If you change it, that would have to be done in your own proxy, with some risk of breaking supported sign in behavior.

    You can find in the doc below that cookie handling issues can affect SSO and sign out.

    https://learn.microsoft.com/en-us/entra/identity/authentication/concept-authentication-web-browser-cookies

    For the token identifier, Microsoft Entra uses uti, which is documented as equivalent to JWT jti.

    If your token does not contain a literal jti, Entra does not provide a supported way to map or copy the restricted uti claim into a custom jti claim. If a downstream service strictly requires jti, the usual workaround is to validate the Entra token in your own service and issue your own JWT containing jti.

    0 comments

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.