RevokeSignInSessions API Not Signing Out User

Question

RevokeSignInSessions API Not Signing Out User

Ashutosh Gairola 0

I am experiencing an issue with the revokeSignInSessions Microsoft Graph API. I am calling the API to sign out a user from Microsoft 365 sessions while for other applications like Onedrive, Teams and Outlook the user got signed out immediately. While the API returns a success code (200), the user remains signed in even after waiting for 30 minutes.

Steps Taken:

I have confirmed the revokeSignInSessions API call is made correctly with a valid access token targeting the specific user.
The response body from the API call does not contain any error messages.
Network connectivity has been verified and there are no apparent issues.
I have reviewed Microsoft documentation for known issues or delays related to revokeSignInSessions but found nothing relevant.

Request:

I kindly request assistance in investigating this issue. Please advise on the following:

Why the user sign-out is experiencing a significant delay (30 minutes) despite a successful revokeSignInSessions call.
Any additional troubleshooting steps I can take to resolve this issue.I am experiencing an issue with the revokeSignInSessions Microsoft Graph API. I am calling the API to sign out a user from Microsoft 365 sessions. While the API returns a success code (200), the user remains signed in even after waiting for 30 minutes.

1 answer

Your answer

Answer 1

Vasil Michev 119.9K MVP Volunteer Moderator

The call revokes Refresh tokens, i.e. the ability to get new access tokens. It does not affect any already issued Access tokens, so the user will still be able to access certain services until the corresponding access token(s) expire.

Some applications can behave differently if they have implemented the Continuous access evaluation feature, as detailed here: https://learn.microsoft.com/en-us/entra/identity/conditional-access/concept-continuous-access-evaluation

For such apps, access tokens can also be invalidated, which usually happens few minutes after you issue the call. However, not every app supports said feature, including many apps owned by Microsoft.

Ashutosh Gairola 0 Reputation points

2024-05-29T17:16:22.1266667+00:00
Thank you for your previous explanation regarding the delay in user sign-out after using revokeSignInSessions.

In my further testing, I observed that even after disabling and then deleting a user from the Microsoft Azure, sessions on already opened Microsoft 365 webpages (Word, Excel, PowerPoint) remained active. The user was still able to edit and share these documents.

My question is: Is there a way to immediately sign out a user from all Microsoft 365 sessions, even if their account has not yet been fully removed through disabling or deletion?

Additional Notes:

I understand that revoking refresh tokens prevents obtaining new access tokens, but it seems existing access tokens might be allowing continued access even after account actions like disabling or deletion.

Ideally, I would like to achieve an immediate sign-out upon disabling or deleting a user account.
Vasil Michev 119.9K Reputation points MVP Volunteer Moderator

2024-05-29T17:46:05.28+00:00

Disabling the user also has no effect on (non-CAE) access tokens. The only functionality that can ever invalidate an access token is CAE.
Ashutosh Gairola 0 Reputation points

2024-05-29T18:49:02.62+00:00
Thanks Vasil for clarifying the behavior regarding user sign-out after disabling and deleting user accounts. I appreciate you confirming that:

Disabling a user account does not invalidate existing access tokens.

Only applications leveraging Continuous Access Evaluation (CAE) can revoke access tokens in real-time.

Word, Excel, and PowerPoint, in this case, do not currently support CAE.

This explains why these applications don't automatically sign out the user upon disabling their account.

Please confirm if there's currently no API or method to directly revoke sessions for these active tabs.

To manage expectations, I'd like to confirm the typical expiration time for these non-CAE access tokens. Knowing the timeframe will help us set appropriate wait times for users to be automatically signed out.

Share via

RevokeSignInSessions API Not Signing Out User

1 answer

Your answer