Unable to invalidate refresh token Azure AD B2C

Tanja Tica 0 Reputation points
2024-07-18T11:37:46.63+00:00

We use a Python CLI application and we want to invalidate the refresh token after the logout. We have tried to use InvalidateAllRefreshTokens method from the Microsoft Graph API. We get 200 responses instead of 204, as it is stated in the official documentation, but nothing happens, the refresh token is still valid.

In the registration of the B2C application, we gave permission to the User for the Graph API.ReadWriteAll and Directory. ReadWriteAll are we missing something?

Do you have any suggestions for this issue? We want to prevent the user from using the token to access our protected API's after the logout.

Microsoft Entra External ID
Microsoft Entra External ID
A modern identity solution for securing access to customer, citizen and partner-facing apps and services. It is the converged platform of Azure AD External Identities B2B and B2C. Replaces Azure Active Directory External Identities.
2,907 questions
{count} votes

Your answer

Answers can be marked as Accepted Answers by the question author, which helps users to know the answer solved the author's problem.