EntraID (AzureAD) OIDC implementation missing revocation_endpoint

Adam 15

Why doesn't Azure provide the revocation_endpoint for OIDC - or if it does, how to enable it?

If not - are there any plans to add it?

Is there any other way to revoke user's refresh_token along with access tokens, other than terminating all of their sessions using Graph API: https://graph.microsoft.com/v1.0/users/{user-uuid}/revokeSignInSessions ?

This is a serious security flaw of Azure, since

unrevoked token can be used to obtain access tokens and maintain the session indefinitely
currently revocation in Azure requires special implementation in the services that want to do it
many clients cannot afford to terminate all of user's sessions just to revoke a single token

@Alfredo Revilla - Upwork Top Talent | IAM SWE SWA

Alfredo Revilla - Upwork Top Talent | IAM SWE SWA 27,461 Reputation points

2023-11-15T19:20:31.84+00:00

Hello @Adam . I'm reaching the product team about this and will come back ASAP.
Carlos Solís Salazar 17,886 Reputation points

2023-11-16T12:58:53.8566667+00:00

Azure's implementation of OpenID Connect (OIDC) and OAuth 2.0 includes several endpoints for authentication and authorization flows, but it appears that a specific token revocation endpoint is not explicitly provided. The Microsoft identity platform, which includes Azure, adheres to standards-compliant implementations of OAuth 2.0 and OIDC 1.0, offering HTTP endpoints for executing auth flows【https://learn.microsoft.com/en-us/entra/identity-platform/v2-protocols】. The most commonly used endpoints are the authorization endpoint and the token endpoint【https://learn.microsoft.com/en-us/entra/identity-platform/v2-protocols】.

Regarding token revocation, Azure Active Directory (Azure AD) does allow for the revocation of refresh tokens. Users can revoke their refresh tokens using the Revoke-AzureADSignedInUserAllRefreshToken PowerShell cmdlet, and administrators can use the Revoke-AzureADUserAllRefreshToken cmdlet for the same purpose. However, Azure AD does not support the revocation of access tokens directly. Instead, you can control the lifetimes of these tokens, which default to a lifespan of 60 to 90 minutes【https://learn.microsoft.com/en-us/answers/questions/986743/how-to-revoke-oauth-refresh-token】.

In practice, issues have been reported regarding the enforcement of token revocation policies, especially following password changes. Users have observed that access tokens and refresh tokens can still be used without error even after a password change, which contradicts expectations of automatic revocation【https://techcommunity.microsoft.com/t5/microsoft-entra-azure-ad/azure-ad-oauth-token-revocation-when-user-change-their-password/td-p/182869】.

As for ending user sessions, Azure AD supports an end_session_endpoint, which can be used to sign out users. This endpoint is part of the OIDC configuration and supports both HTTP GET and POST requests【https://learn.microsoft.com/en-us/entra/identity-platform/v2-protocols-oidc#:~:text=Redirect%20the%20user,HTTP%20GET%20and%20POST%20requests】.

In summary, while Azure AD provides mechanisms for revoking refresh tokens and ending user sessions, there seems to be a lack of a dedicated OIDC token revocation endpoint similar to what is defined in some OIDC implementations. This can pose challenges in managing token lifecycles, especially in the context of security and compliance requirements. As of now, there's no publicly available information on any plans to add such an endpoint to Azure AD.

Accept the answer if the information helped you. This will help us and others in the community as well.
Adam 15 Reputation points

2023-11-16T16:09:43.65+00:00
Well, the end_session_endpoint doesn't do the job either, because:

User can cancel this operation, because it's a redirect within the browser

... to make things worse the user is asked to confirm the logout

It also terminates MS account session and other related sessions/tokens

Share via

EntraID (AzureAD) OIDC implementation missing revocation_endpoint

Your answer