Identity Platform Oauth2 Revoke Acess

Question

So what I am searching for is a Revoke oauth2 Access Endpoint on Identity platform.

Basically I have an App x which uses Microsoft identity platform and graph API to gain Access and use Users Mail,Calendar,contacts etc.

When the User want's their Microsoft Access to be removed from My app or wishes to delete their Account.

• i need to revoke the Access Token and Refresh Token I have and My App Should be removed from the 'account.microsoft.com -> privacy -> Apps and Services That can Access your Data '
  so that the user can be sure that the Integration is removed.

This feature is available with google's API's Google Revoke Access Link. So when i Hit this api with my refresh token all the access is removed and my App disappears from the 'accounts.google.com->apps which access your data' screen too.

Can you guys please help me find if this is Available with Microsoft's API and Point me towards it
Thanks

Answer 1

Hi @mohamed arshad ,

Thanks for reaching out.

I understand you are looking to revoke the tokens so users won't able to access the application further.

You can use the below graph call to revoke the Refresh token:

To revoke the refresh token of the signed-in user:

POST https://graph.microsoft.com/v1.0/me/revokeSignInSessions

To revoke the refresh token of another user:

POST https://graph.microsoft.com/v1.0/users/object_id_or_upn_of_user/revokeSignInSessions

Alternatively, you can use below PowerShell cmdlets as well:

Revoke-AzureADSignedInUserAllRefreshToken

Revoke-AzureADUserAllRefreshToken

Access tokens cannot be revoked. Access tokens are short-lived and by default valid for 1 hour. However, when the refresh tokens are revoked, the application will not be able to redeem the refresh tokens (long-lived tokens) to acquire new access tokens.

You may also consider setting access token lifetime to a lower value than 1 hour (minimum supported value is 10 minutes and the maximum is 1 day). Refer to: https://learn.microsoft.com/en-us/azure/active-directory/develop/active-directory-configurable-token-lifetimes#token-lifetime-policies-for-access-saml-and-id-tokens.

Hope this will help.

Thanks,
Shweta

-------------------------------------------

Please remember to "Accept Answer" if answer helped you.