Share via

user: revokeSignInSessions without Admin Consent?

LEW CHENG CHEE 41 Reputation points
2020-12-19T01:28:41.647+00:00

Hi I understand the revoke session api is used to invalidate refresh token
POST https://graph.microsoft.com/v1.0/me/revokeSignInSessions

but it also required to enable the at least one of the permission below

  • User.ReadWrite.All
  • Directory.ReadWrite.All
  • Directory.AccessAsUser.All

these permissions all require admin consent, also ReadWrite.All permission are able to access other uses users' profile from the description, and it seem like a security concern for us.
https://learn.microsoft.com/en-us/graph/permissions-reference#user-permissions

the problem now is I intended to call this on user level, the scenario is user will call this API when click logout from the app.

is this API intended to be used on admin level only?
is there any other way to call revoke token on user level only?

Microsoft Security | Microsoft Entra | Microsoft Entra ID
0 comments
Accepted answer
  1. AmanpreetSingh-MSFT 56,871 Reputation points Moderator
    2020-12-21T13:05:01.63+00:00

    Hello @LEW CHENG CHEE · Thank you for reaching out.

    The purpose of invalidating refresh token is for administrator to revoke all access for a user in scenarios like compromised accounts, employee termination, and other insider threats. This functionality is NOT available for standard users.

    Best you can do to avoid having long lived refresh tokens for users is to implement sign-in frequency via conditional access policy. Please refer to https://learn.microsoft.com/en-us/azure/active-directory/conditional-access/howto-conditional-access-session-lifetime for more details on this.

    -----------------------------------------------------------------------------------------------------------

    Please "Accept the answer" if the information helped you. This will help us and others in the community as well.

    1 person found this answer helpful.
    0 comments

0 additional answers

Sort by: Most helpful
Most helpful Newest Oldest

Your answer

Answers can be marked as Accepted Answers by the question author, which helps users to know the answer solved the author's problem.