How to expire all logged in sessions of a user on Password Reset?

AkshitAhuja-4588 10

I want to destroy all existing logged in sessions if user Resets Password from one logged in device. How can I achieve this?

1 answer

Vasil Michev 97,076 Reputation points MVP

2023-02-28T12:04:42.59+00:00

What you can do is revoke all refresh tokens, which in turn will invalidate any active session once the access token expires (up to 1 hour delay). To do this via the UI, open the Azure AD blade > Users > select the user > hit the Revoke sessions button on top. To do it via PowerShell, use the Revoke-AzureADUserAllRefreshToken cmdlet (Azure AD module) or Revoke-MgUserSignInSession (Graph SDK for PowerShell).
Please sign in to rate this answer.

5 people found this answer helpful.
AkshitAhuja-4588 10 Reputation points

2023-03-01T08:33:48.8566667+00:00

Thanks for the answer.

But actually I don't want to do it manually. I want to know let's say if I have activated SSPR and any user goes and Resets Password so how can I make any active session invalid. So point here is it should be done automatically on Password Reset.

Vasil Michev 97,076 Reputation points MVP

2023-03-01T09:40:43.6233333+00:00

You cannot. Only specific "signals" will result in refresh token being resolved, and SSPR is not one of them. You cannot customize the list.

That said, most O365 services now support Continuous access evaluation, as detailed here: https://learn.microsoft.com/en-us/azure/active-directory/conditional-access/concept-continuous-access-evaluation#critical-event-evaluation

It will trigger also on password reset, but the application (and service) itself needs to support CAE. Refer to the article above for list of supported scenarios and prerequisites.

Josh 0 Reputation points

2023-09-20T15:47:44.7+00:00

This cmdlet does not seem to work anymore. It worked last week, but this seems to have stopped working. It's is showing like the module isn't even installed anymore. Any thoughts?

Joshua Bines 1 Reputation point

2024-01-16T14:47:21.7433333+00:00

I believe if a admin resets the password or if the user is listed as a high risk user requiring a password reset the current sessions are reset. I tried to quickly find this again... so I'm still not 100% but that's as I remember it. @josh Revoke-MgUserSignInSession should still work

Jan Swinkels 0 Reputation points

2024-02-13T16:03:40.8033333+00:00

Which Azure role needs to be active to be able to execute this?
Sign in to comment

Share via

How to expire all logged in sessions of a user on Password Reset?

1 answer