Graph API RevokeSignInSessions not invalidating refresh tokens

Question

Graph API RevokeSignInSessions not invalidating refresh tokens

Dongyang Li 0

I am trying to use MS Graph RevokeSignInSessions to invalidate a user's refresh tokens to enforce the user to login when the existing access token expires.

I set the lifetime of access token to 5 mins. In my tests, when the request completes successfully, the pre-logged in user can still get new access token, which means RevokeSignInSessions failed to invalidate issued refresh token.

Deleted

This comment has been deleted due to a violation of our Code of Conduct. The comment was manually reported or identified through automated detection before action was taken. Please refer to our Code of Conduct for more information.

1 answer

Your answer

Deleted

This comment has been deleted due to a violation of our Code of Conduct. The comment was manually reported or identified through automated detection before action was taken. Please refer to our Code of Conduct for more information.

Answer 1

Anonymous

Thanks for reaching out! experiencing an issue where the RevokeSignInSessions function in Microsoft Graph isn't invalidating the refresh tokens as expected, leading to the user being able to obtain a new access token even after revocation.

So rundown of how Revoke-MgUserSignInSession is supposed to work if it invalidates all refresh tokens issued to applications for a user by resetting the signInSessionsValidFromDateTime property to the current time. This should compel the user to sign in again across all applications they've previously consented to use.

1.Ensure that the user executing the Revoke-MgUserSignInSession cmdlet has the necessary permissions to revoke the sessions.

2.Confirm that the application fetching the new access token is indeed prompting for a refresh token and not using a cached access token.

3.Make sure that there’s a proper delay between revocation and subsequent login attempts as the effects might not be immediate depending on how tokens are managed on the client-side.

4.Double-check that your access token settings (like lifetimes) are not somehow configured to issue new tokens despite the revocation.

Dongyang Li 0 Reputation points

2025-10-28T12:13:21.59+00:00

Thanks for the reply, I was using an application to execute the command. The application has User.RevokeSessions.All permission.

Also can confirm that new access token can be issues after old access token expires and signInSessionsValidFromDateTime reset to current datetime.

I set lifetime of access token to 5 minutes, but the token can be renewed after half hour.

BTW i was using Graph API revokeSignInSessions. Let me know it the issue can be reproduced on your side or not. Thanks.
Anonymous

2025-10-31T07:17:41.95+00:00
Thank you for your follow-up. You are correct — invalidateAllRefreshTokens does not instantly kill already-issued refresh tokens. This is by design for resiliency. The token will remain valid until:

1.The user changes their password.

Conditional Access policies enforce reauthentication.

3.The refresh token reaches its configured max age or inactivity limit.

4.Use Conditional Access Sign-in Frequency to force reauthentication at a short interval.

Alternatively, reset the user’s password or revoke credentials, which invalidates all tokens immediately.
Dongyang Li 0 Reputation points

2025-10-31T14:55:59.3933333+00:00

Thanks for the reply.

However, I read from the documentation that the issued refresh tokens will be invalidated based on signInSessionsValidFromDateTime. By debugging, I noticed when I revoked sessions, signInSessionsValidFromDateTime did reset to the current datetime. But it just did not effect to invalidate issued refresh tokens. We waited after hours but still the refresh token worked.

I also tried "Revoke sessions" button from the Azure portal, it is also sending a request to Graph API /RevokeSignInSessions to reset signInSessionsValidFromDateTime but it works there. So is there any difference doing from portal vs calling from code against the same endpoint?

Thanks in advance!

Invalidates all the refresh tokens issued to applications for a user (and session cookies in a user's browser), by resetting the signInSessionsValidFromDateTime user property to the current date-time.
Anonymous

2025-11-03T13:00:05.73+00:00

Thank you for sharing your concerns. You are correct — the current design of Azure AD and Microsoft Graph does not provide an API to instantly invalidate already-issued refresh tokens. This is intentional to maintain service resiliency and avoid breaking active sessions unexpectedly.
Conditional Access Sign-in Frequency: Configure a short sign-in frequency to enforce reauthentication and limit refresh token reuse.
Password Reset or Account Disable: Resetting the user’s password or disabling the account will immediately invalidate all tokens.
InvalidateAllRefreshTokens: This ensures any new refresh tokens cannot be issued, but existing ones will expire based on their lifetime.
Dongyang Li 0 Reputation points

2025-11-05T14:03:50.42+00:00

My understanding is that the api /RevokeSignInSessions sets signInSessionsValidFromDateTime, so that already-issued refresh tokens become invalid. And new access tokens should not be issued using already-issued refresh tokens, isn't this correct?
Anonymous

2025-11-07T11:49:48.9233333+00:00

Yes you are correct
Anonymous

2025-11-11T06:02:32.7966667+00:00

Hope you're doing well! Please let us know if the issue persists or resolved. If the answer is helpful, please click "Accept Answer" and kindly approve it.
Anonymous

2025-11-13T08:53:23.7733333+00:00

We haven’t received any further updates or follow-up on this case, so we’ll proceed with closing it at this time. If you require additional assistance or have new information to share, please feel free to raise new thread, we’re happy to support you further needed.