Revoke Consent Request to Azure AD / Enterprise Application Consent Framework

Question

Hi,

I have a Laravel 10 Saas product which I'm trying to allow users to log in with their Microsoft account (Socialite package using oauth2/openid) with the view to having it approved on the Enterprise Application list.

So far:

1. They can log in after consent. (click Login with Microsoft button - goes to Microsoft page, then go back to Saas callback url)
2. They can log out of the Saas product and sign out of Microsoft at the same time - goes to Microsoft page then go backs to Saas logout url.

But I'm struggling to see how I can allow the user to revoke/remove consent? Also I can't seem to navigate through Azure AD to find a way to see what users have consented or perhaps I cannot?

I have the following permissions:

Microsoft Graph - openid and user.read

I suspect I need to add more permissions...after reading this article:

https://learn.microsoft.com/en-us/graph/api/user-revokesigninsessions?view=graph-rest-1.0&tabs=php

Any advice/links would be appreciated!

Answer 1

Hi @James Froud

Thanks for reaching out.

I understand you are trying to allow the user to revoke/remove consent.

How can I allow the user to revoke/remove consent?

To allow users to revoke/remove consent, you can use the Microsoft Graph API to revoke the user's tokens. Specifically, you can use the revokeSignInSessions method to revoke all refresh tokens and end all sessions for the user.

To revoke the refresh token of the signed-in user:

POST https://graph.microsoft.com/v1.0/me/revokeSignInSessions

To revoke the refresh token of another user:

POST https://graph.microsoft.com/v1.0/users/object_id_or_upn_of_user/revokeSignInSessions

To use this method, you will need to have the User.ReadWrite.All permission. This permission allows your application to revoke sign-in sessions for the signed-in user.

This will only revoke the refresh token. Access tokens cannot be revoked and automatically expires after 1 hour.

Reference: https://learn.microsoft.com/en-us/graph/api/user-revokesigninsessions?view=graph-rest-1.0&tabs=http

Also I can't seem to navigate through Azure AD to find a way to see what users have consented to do or perhaps I cannot?

To see what users have consented to, you can use the Microsoft Graph API to retrieve a list of users who have granted consent to your application. Specifically, you can use the List method of the oauth2PermissionGrants resource type to retrieve a list of all the OAuth 2.0 permission grants that have been given to your application.

To use this method, you will need to have the User.ReadBasic.All least privilege permission.

GET https://graph.microsoft.com/v1.0/users/<userid>/oauth2PermissionGrants

Reference: https://learn.microsoft.com/en-us/graph/api/user-list-oauth2permissiongrants?view=graph-rest-1.0&tabs=http

You can also go to Identity->Enterprise Application->Select your application->Select Permissions and go to user consent to see all the permission assigned to user.

Also, if you are looking to revoke the application permission that has been granted for entire organization through admin consent. You can refer https://learn.microsoft.com/en-us/azure/active-directory/manage-apps/manage-application-permissions?pivots=portal#review-and-revoke-permissions

Hope this will help.

Thanks,

Shweta

---

Please remember to "Accept Answer" if answer helped you.