When to use Revoke-MgUserSignInSession and when to use Revoke-SPOUserSession? I also read an articlet Revoke-SPOUserSession is expired.

Use Revoke-MgUserSignInSession for normal Microsoft Entra/Microsoft 365 session revocation; use Revoke-SPOUserSession only when specifically administering sessions through SharePoint Online PowerShell and its stricter prerequisites are acceptable.

Key differences

For new automation and general Entra session revocation, Microsoft’s current access-revocation procedure uses Revoke-MgUserSignInSession. ^3^

Recommended Graph command

Connect using an accepted permission—User.RevokeSessions.All is the least-privileged permission listed specifically for this operation—and then revoke the target user’s sessions:

Import-Module Microsoft.Graph.Users.Actions

Connect-MgGraph -Scopes "User.RevokeSessions.All"

# A user object ID or UPN can be supplied.
Revoke-MgUserSignInSession `
    -UserId "[Email]" `
    -Confirm:$false

The result is a Boolean. The user must authenticate again when an application next requires Entra authentication.

For an account compromise or employee termination, session revocation alone is not the complete offboarding action. Microsoft’s procedure also disables the account and, where appropriate, disables registered devices. ^3^

When the SPO command is still appropriate

If existing SharePoint Online administration already depends on the SPO Management Shell, it can still be run as follows:

Connect-SPOService `
    -Url "https://contoso-admin.sharepoint.com"

Revoke-SPOUserSession `
    -User "[Email]" `
    -Confirm:$false

Use it only when:

• the target is a tenant member, not a guest;
• the operator is a Global Administrator;
• an SPO service connection is established; and
• the possible delay of up to one hour is acceptable.

The current Microsoft reference still documents Revoke-SPOUserSession and does not mark it as deprecated or expired. “It can take up to an hour” describes revocation propagation, not the command expiring. A result saying that the cmdlet “isn’t ready for use in your organization yet” means it has been disabled for that tenant, not globally retired. ^2^

Revocation is not always an instantaneous global logout

Neither command guarantees that every application window immediately closes:

• Existing access tokens can remain usable until they expire; Microsoft documents a typical one-hour lifetime.
• An application can issue and control its own session cookie. Microsoft Entra cannot directly revoke an application-owned session token.
• The effective sign-out time therefore depends on how the application validates access, whether it supports Continuous Access Evaluation, and when it returns to Entra for reevaluation. ^3^

Consequently, do not run both cmdlets routinely: use the Graph cmdlet for general Entra/Microsoft 365 revocation, retaining the SPO cmdlet only for a specific existing SharePoint Online operational requirement.

References

1. Revoke-MgUserSignInSession-Syntax
2. Revoke-SPOUserSession-Syntax
3. Revoke user access in Microsoft Entra ID