diff --git a/.changeset/many-carpets-act.md b/.changeset/many-carpets-act.md
new file mode 100644
index 0000000000..5285eeebbd
--- /dev/null
+++ b/.changeset/many-carpets-act.md
@@ -0,0 +1,5 @@
+---
+'@backstage/plugin-auth-backend': patch
+---
+
+Handle difference in expiration time between Microsoft session and Backstage session which caused the Backstage token to be invalid during a time frame.
diff --git a/plugins/auth-backend/src/providers/microsoft/provider.ts b/plugins/auth-backend/src/providers/microsoft/provider.ts
index fd2a1529a7..9b14a3c91b 100644
--- a/plugins/auth-backend/src/providers/microsoft/provider.ts
+++ b/plugins/auth-backend/src/providers/microsoft/provider.ts
@@ -50,6 +50,8 @@ import {
 import { Logger } from 'winston';
 import fetch from 'node-fetch';
 
+const BACKSTAGE_SESSION_EXPIRATION = 3600;
+
 type PrivateInfo = {
   refreshToken: string;
 };
@@ -145,12 +147,17 @@ export class MicrosoftAuthProvider implements OAuthHandlers {
 
     const { profile } = await this.authHandler(result, this.resolverContext);
 
+    const expiresInSeconds =
+      result.params.expires_in === undefined
+        ? BACKSTAGE_SESSION_EXPIRATION
+        : Math.min(result.params.expires_in, BACKSTAGE_SESSION_EXPIRATION);
+
     const response: OAuthResponse = {
       providerInfo: {
         idToken: result.params.id_token,
         accessToken: result.accessToken,
         scope: result.params.scope,
-        expiresInSeconds: result.params.expires_in,
+        expiresInSeconds,
       },
       profile,
     };