This browser is no longer supported.
Upgrade to Microsoft Edge to take advantage of the latest features, security updates, and technical support.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(214.4, 91%, 30%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3ETT%3C/text%3E%3C/svg%3E)
We use a Python CLI application and we want to invalidate the refresh token after the logout. We have tried to use InvalidateAllRefreshTokens method from the Microsoft Graph API. We get 200 responses instead of 204, as it is stated in the official documentation, but nothing happens, the refresh token is still valid.
In the registration of the B2C application, we gave permission to the User for the Graph API.ReadWriteAll and Directory. ReadWriteAll are we missing something?
Do you have any suggestions for this issue? We want to prevent the user from using the token to access our protected API's after the logout.