OAuth2.0 for Jira REST API with Azure AD as Identity Provider

[ibuchanan]

@MuthurajArunKumar,

I think the same question was answered here:

@NusratSultana

The behaviour you are describing at first scenario is because of automatic reuse detection. Once you get a NEW_REFRESH_TOKEN (rotating), any usage of an earlier refresh token will be considered as a lost/stolen refresh token. Hence to prevent such malicious attack both the refresh tokens are invalidated and user is forced to re-consent.

In short, expected behavior.