Issue Summary
Applications embedded within a Genesys Cloud iFrame experience session timeouts after approximately 60 minutes of inactivity. Once the authentication token expires, the embedded application is unable to silently refresh the user's Microsoft Entra ID (Azure AD) session, resulting in authentication failure within the iFrame. Users must manually refresh the iFrame or reload the widget to regain access.
Background
The embedded application relies on Microsoft Entra ID Single Sign-On (SSO) for authentication. During token renewal, the application attempts to load login.microsoftonline.com within the iFrame to obtain a new authentication token. However, Microsoft blocks authentication pages from being rendered inside iFrames through security controls such as the X-Frame-Options: DENY header and related browser protections.
As a result:
- Silent token refresh within the iFrame is prevented.
- Authentication sessions expire after the token lifetime.
- The embedded application becomes unusable until manually refreshed.
- User experience is degraded due to unexpected interruptions and loss of workflow continuity.
Impact
- Agents must manually refresh the embedded widget every time the authentication token expires.
- Increased operational friction and reduced productivity for Contact Centre users.
- Risk of service interruption when users are actively relying on embedded applications during customer interactions.
- Future widgets and integrations leveraging Microsoft Entra ID SSO are likely to experience the same limitation if they depend on iFrame-based authentication flows.
#Integrations------------------------------
Eystein Kylland
Systemutvikler Genesys Applikasjonsspesialist
------------------------------