It's a code defect in CRM 365 and unfortunately Microsoft is not fixing this any time soon with a hotfix. They are planning to fix this next higher version of CRM.
Subject: RE: [REG:117022715379811] CRM Issue - Timeout Issue - Claims based Auth with IFD Initial Response
As of right now, your token is set to expire every 60 minutes. Normally, there should be a silent token renewal since the SSOLifetime is set for 480 minutes, however it appears that there is a bug that is being addressed currently for this issue. This case is now tied to this bug investigation.
In the interim, you can resolve the number of times that users are prompted for credentials by increasing the token lifetime from “0” to a higher limit. If you want the users to reauthenticate every 2 hours, change this value to 120, 4 hours – 240, 8 hours – 480, etc. Please keep in mind that if you increase this value to 480, you must increase the ADFS property for SSOLifetime to a higher value as well, such as 540.
Sent: Wednesday, March 01, 2017 11:46 AM
Subject: RE: [REG:117022715379811] CRM Issue - Timeout Issue - Claims based Auth with IFD Initial Response
In regards to the bug, the issue is that some users are not receiving the friendly prompt, and the silent token refresh is not occurring. This causes users to be signed out without warning and they lose all unsaved data. The resolution has been identified for an upcoming version of CRM as of earlier this month. This resolution is now being backported through the lower versions of 2016 and should be released in the next set of CRM updates, however there is always the possibility that the backport takes longer due to QA testing results.
This fix is scheduled to be included in the next release (9.0) and then backported to previous versions of CRM/Dynamics 365.
RE: [REG:117060715858892] CRM Issue - Timeout Issue - Claims based Auth with IFD
. As we discussed, the two problems you are experiencing unique issues which are caused by code defects within Dynamics CRM. Here is a summary of the two scenarios:
- The first problem is related to the session expiry reminder; instead of receiving the login option on the form at the defined reminder time (20 minutes before expiry), you are signed out and don’t receive the option to remain signed in.
- The second issue occurs if we have passed token expiry and the CRM window is still open; you click a link on the page or make changes and then click save, after this, CRM prompts for credentials three times. This occurs because CRM tries to load the last viewed record but it fails because the session has expired and there is no active authentication token.
