Updating 'passwordProfile' via GraphAPI results in Session Revocation

Question

If I update a user's passwordProfile via PATCH on /users/<objectId> as an User Administrator, all sessions for the user are automatically revoked as

• refreshTokensValidFromDateTime and
• signInSessionsValidFromDateTime are set to the current timestamp.

Is there any way to disable this default behavior?

Answer 1

@Tobias Schmidt
Thank you for your time and patience and for following up on this!

I changed my user's password using the below PATCH and ran into the same issue that you're experiencing.

Update the passwordProfile of a user to reset their password:

PATCH https://graph.microsoft.com/v1.0/users/{id}  
Content-type: application/json  
  
{  
  "passwordProfile": {  
    "forceChangePasswordNextSignIn": false,  
    "password": "testPassword001"  
  }  
}  

Initially when I changed my user's password, my session was expired almost immediately. However, to confirm the session expiration was from the password reset, I re-ran the same PATCH with a new password and didn't notice the session expire for about 1-2minutes.

I've reached out to our engineering team with this info and will update as soon as possible.

If you have any other questions, please let me know.
Thank you for your time and patience throughout this issue.

Answer 2

using Microsoft.Graph;
using Azure.Identity;

namespace test1

{
class Program
{
static async System.Threading.Tasks.Task Main(string[] args)

      {  
      
          var scopes = new[] { "Directory.AccessAsUser.All" };  
      
          // Multi-tenant apps can use "common",  
          // single-tenant apps must use the tenant ID from the Azure portal  
          var tenantId = "b2c tenant id";  
      
          // Value from app registration  
          var clientId = "b2c app client id";  
      
      
          // using Azure.Identity;  
          var options = new TokenCredentialOptions  
          {  
              AuthorityHost = AzureAuthorityHosts.AzurePublicCloud  
          };  
      
          var userName = "b2c user name";  
          var password = "password";  
          
          // https://learn.microsoft.com/dotnet/api/azure.identity.usernamepasswordcredential  
          var userNamePasswordCredential = new UsernamePasswordCredential(  
              userName, password, tenantId, clientId, options);  
      
          var graphClient = new GraphServiceClient(userNamePasswordCredential, scopes);  
      
          var user = new User  
          {  
              PasswordProfile = new PasswordProfile  
              {  
                  ForceChangePasswordNextSignIn = false,  
                  Password = "xWwvJ]6NMw+bWH-d"  
              }  
          };  
      
          await graphClient.Users["user id"]  
              .Request()  
              .UpdateAsync(user);  
      
      }  
  }  

}