Removing user from Enterprise Application

Question

I removed a user from Apple Internet Accounts enterprise app to restrict access to default iOS mail app. However, the user can still use the email app, can send and receive email. From testing, it is only restricting sign-ins from new users that are not added to Users and groups.

It appears removing a user or group do not remove/expire the issued token.

Is there a way to forcefully expire the token? Can Conditional Access sign-in frequency solve this?

Answer 1

When a user is removed from an enterprise app in Apple Internet Accounts, it only revokes the user's access to sign in again to that app. It does not immediately revoke any existing tokens that the user may have obtained. These tokens can still be used until they expire or are revoked by the service. To forcefully expire the token for a user, you can use the Apple Business Manager (ABM) or Apple School Manager (ASM) to revoke the user's token. Here are the steps to revoke the token for a user:

1. Sign in to your ABM or ASM account.
2. Go to the "Accounts" section and find the user you want to revoke the token for.
3. Click on the user's name to go to the user's details page.
4. Click on the "Devices and Content" tab.
5. Scroll down to the "Apps and Books" section and find the app that the user has access to.
6. Click on the "More" button (three dots) next to the app and select "Revoke Access".
7. Confirm the action by clicking "Revoke".

This will revoke the user's access to the app and revoke any existing tokens that the user may have obtained. As for using Conditional Access sign-in frequency to solve this issue, it may not be the best solution as it only limits the number of times a user can sign in to a service within a certain time period. It does not revoke existing tokens and may not be effective in immediately revoking a user's access to an app. It's best to use the above method to forcefully revoke a user's access to an app.