Unable to invalidate refresh token Azure AD B2C

Tanja Tica 0 Reputation points
2024-07-18T11:37:46.63+00:00

We use a Python CLI application and we want to invalidate the refresh token after the logout. We have tried to use InvalidateAllRefreshTokens method from the Microsoft Graph API. We get 200 responses instead of 204, as it is stated in the official documentation, but nothing happens, the refresh token is still valid.

In the registration of the B2C application, we gave permission to the User for the Graph API.ReadWriteAll and Directory. ReadWriteAll are we missing something?

Do you have any suggestions for this issue? We want to prevent the user from using the token to access our protected API's after the logout.

Microsoft Security | Microsoft Entra | Microsoft Entra External ID
{count} votes

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.