Revoke Multifactor Authentication (MFA) fails.

Question

As of today, our Global Admins in Azure/Entra cannot revoke a multifactor authentication session. We get a generic error that just tells us we cannot do it.

---

Moved from: Microsoft Security | Microsoft Authenticator

Answer 1

Hello @az_meszarosj1,

Thank you for posting your question in the Microsoft Q&A forum.

Based on the information you shared, it appears that you are experiencing an issue when attempting to revoke the session of an account in Microsoft Entra admin center, and an unexpected error is preventing the action from completing. I completely understand how concerning and inconvenient this situation can be, especially when you are trying to manage account security or ensure proper access control. 

To better understand what is happening on your side, could you please provide a screenshot of the exact error message that appears when the revoking process fails? Please make sure all personal information is hidden before sharing with me. 

In the meantime, it would be very helpful if you could try the detailed steps below:

1. Please create a brand‑new user account in your tenant and assign the Global Administrator role to this user (No license assignment is required). After completing this, sign in using the new test account and try revoking a session again. If the revoking action works with the new account, this will indicate that the issue may be specific to the original user account or its permission setup.
2. Please test the same action from another computer or mobile device. 
3. Temporarily disable third‑party applications such as VPN, firewall, antivirus that running on the background. Then, please close all browser completely and try to use revoke session again. 
4. Try a different browser or use Incognito/InPrivate mode. If the issue does not occur in InPrivate mode, then the problem is likely caused by corrupted cookies, cached data, or conflicting browser extensions.

Once you have completed the steps above, please share the results with me. The outcomes of these tests will help narrow down the issue and allow me to guide you toward the most effective next steps.

Thank you again for reaching out. I look forward to hearing back from you.

Answer 2

If Global Admins are encountering issues when trying to revoke a multifactor authentication (MFA) session, it may be due to various factors such as permissions or system issues. Here are a few steps you can take to troubleshoot the situation:

1. Check Permissions: Ensure that the Global Admins have the necessary permissions to revoke MFA sessions. They should have the Global Administrator role assigned.
2. Use Microsoft Graph PowerShell: If the standard method fails, consider using Microsoft Graph PowerShell to revoke user sessions. This can sometimes bypass issues encountered in the UI.
3. Session State: Verify the state of the user's MFA session. If the session is already expired or invalid, revocation may not be necessary.
4. Error Messages: Pay attention to any specific error messages that may provide clues about the failure. If the error is generic, it may be worth checking Microsoft support channels for any ongoing issues or outages.
5. Contact Support: If the problem persists, consider reaching out to Microsoft support for assistance, as they can provide more detailed insights into the issue.

If you continue to experience difficulties, it may be helpful to check for updates or changes in the Microsoft Entra or Azure environments that could affect MFA functionality.

---

References:

• Manage user authentication methods for Microsoft Entra multifactor authentication
• Reauthentication prompts and session lifetime for Microsoft Entra multifactor authentication