---
title: "Discussion on \"Untangling Authorization Code, OBO, and Refresh Token Flows in Azure AD — A Technical Exploration\" | Hashnode"
description: "Discussion on \"Untangling Authorization Code, OBO, and Refresh Token Flows in Azure AD — A Technical Exploration\". Dissecting OAuth 2.0 flows in multi-app Azure AD scenarios — what’s OBO, what’s not, and how to structure secure delegation."
url: "https://hashnode.com/posts/untangling-authorization-code-obo-and-refresh-token-flows-in-azure-ad-a-technical-exploration/68eb33c449fdea77a180f69d"
---

[Feed](https://hashnode.com/feed) /

Discussion

# [Untangling Authorization Code, OBO, and Refresh Token Flows in Azure AD — A Technical Exploration](https://curiouskernel.hashnode.dev/untangling-authorization-code-obo-and-refresh-token-flows-in-azure-ad-a-technical-exploration?utm_source=hashnode&utm_medium=feed)

Dissecting OAuth 2.0 flows in multi-app Azure AD scenarios — what’s OBO, what’s not, and how to structure secure delegation.

Oct 12, 2025 · 5 min read · curiouskernel.hashnode.dev  
Read the article

-   [#on-behalf-of-flow](https://hashnode.com/tag/on-behalf-of-flow)
-   [#authorization-code-flow](https://hashnode.com/tag/authorization-code-flow)
-   [#delegated-access](https://hashnode.com/tag/delegated-access)
-   [#oauth2](https://hashnode.com/tag/oauth2)
-   [#azure-ad](https://hashnode.com/tag/azure-ad)
-   [#refresh-token](https://hashnode.com/tag/refresh-token)
-   [#api-security](https://hashnode.com/tag/api-security)
-   [#azure](https://hashnode.com/tag/azure)
-   [#microsoft-identity-platform](https://hashnode.com/tag/microsoft-identity-platform)
-   [#identity-management](https://hashnode.com/tag/identity-management)

## Written by

[Fayaz Khan](https://hashnode.com/@FayazKhan)

@FayazKhan · Pune- India

  
[View profile](https://hashnode.com/@FayazKhan)

Learning, building and Sharing - one challange at a time

Hi, I’m Fayaz Khan — a PLM Solution Architect with deep hands-on experience in 3DEXPERIENCE, real-world integrations, and enterprise system behavior. I work at the intersection of engineering, security, and systems thinking, navigating between PLM platforms, cloud infrastructure, APIs, and practical business needs. I prefer digging into why something works (or breaks), rather than just how to configure it. My writing is an attempt to document the often-overlooked details — the silent bugs, the edge cases, the security gaps — and sometimes, the mental models that help me make sense of it all.

## Responses

Markdown supported · ⌘↵ to post

No responses yet.