Revoke Access Token Service to Service Authentication

Question

Hi All,

I am using service to service authentication, I get the access token in my daemon service using OAuth 2.0 Client Credential flow using following end point
https://login.microsoftonline.com/{tenant}/oauth2/v2.0/token

Now my service wants to invalidate or logout the token how can I achieve this. Please help me on this. What is the token revoke end point? Is it possible if not please provide some feedback as I can get and revoke token with other CRM Platforms like Salesforce.

Regards,
IK

Answer 1

Dynamics 365 API tokens can be revoked by calling DELETE /login/refreshToken?refreshToken={refresh_token_value} HTTP/1.1

Example:

DELETE https://mrs.contoso.com/login/refreshToken?refreshToken=ScW2t HTTP/1.1

Also, visit the documentation page: deployr-api-docs

---

--please don't forget to upvote and Accept as answer if the reply is helpful--

Answer 2

Note that, 'Access tokens cannot be revoked and are valid until their expiry' Reference: https://learn.microsoft.com/en-us/azure/active-directory/develop/active-directory-configurable-token-lifetimes#access-tokens
However, you may revoke refresh tokens using Graph API. Application looses the token when you revoke refresh token and it helps. Following POST command will revoke the refresh token

POST https://graph.microsoft.com/v1.0/me/revokeSignInSessions  

----------

--please don't forget to upvote and Accept as answer if the reply is helpful--