No worries! I have a new issue now. When the Entra token expires, I don't have a refresh_token available to refresh the token. It seems like the Entra token expires before the FusionAuth token does.

Within the OpenId Reconcile lambda, the tokens parameter only has access_token and id_token in its properties.

I have "offline_access" included in my scope but the refresh token isn't provided.

Do you know how can can get the Entra Id refresh token?

@mark-robustelli Thanks Mark! you were right.

I used an OpenId Connect Reconcile lambda and found that the Azure Ad token was stored in tokens.access_token.

Hi,

Version: 1.61.1

I have implemented FusionAuth with Azure Ad (Entra Id) to my application and I am able to successfully sign in to my app using my Microsoft account.

In this guide, it states that FusionAuth will have an Azure AD authorization code which can then be used to get an Azure AD access token:
https://fusionauth.io/docs/lifecycle/authenticate-users/identity-providers/enterprise/azure-ad-oidc.

I haven't been able to find a way to get the azure ad token from the logged in user to then use it to access the Microsoft Graph API. I can only get the FusionAuth access and Id tokens which don't work with Microsoft Graph.

How can I achieve this/is this possible?