This browser is no longer supported.
Upgrade to Microsoft Edge to take advantage of the latest features, security updates, and technical support.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(166.4, 61%, 26%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3ERC%3C/text%3E%3C/svg%3E)
Hello everyone,
Whenever a user changes his password in AD, their phones (usually) still try to login using the old password, thus generating a lot of noise for the security team (password spraying attacks).
Is there a way to "force logoff" to all the devices user is logged on?
Many thanks!
Hi @Robert Cristian , thanks for the question. To clarify, when you say "their phones still try to login using the old password" does this mean that their new password returns an error on sign-in? How are the passwords getting changed, SSPR? Also, have you looked at this document? It may not be what you're looking for but it's work a look. Please let me know and I can help you further!
Thank you,
James
So, to be more precise, I am part of the security team. Users are changing AD passwords (most probably when they are forced to, due to policy) and we are getting a lot of alerts of brute-force/password spraying.
When checking the logs for the IPs that are causing this, we see that the users phones are trying to connect to "office 365" (may be teams, outlook, who knows) and are denied the connection, so I can safely assume that since user just changed his password, and alerts are generated by his phone that is still trying to login or refresh, get some push notifications (not technical on this side, sorry).
What I want to know if it is possible when a user is changing his AD password, to force an automatic logout from all his other devices?
I hope this makes more sense now, thanks a lot!
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(236.8, 46%, 32%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3ER4%3C/text%3E%3C/svg%3E)
Are users changing their passwords from their phone or workstation? Would "user training" be needed so the users are aware they need to update their phone o365 password once they change their password on the domain? I too have run into this issue in the past and never found an automated way to address it. Would reducing the o365 token life time help at all?
You can sign a user out of ALL sessions in Office 365 ( or Azure), but I dont think that is what you are asking?
For just mobile devices, there is no way I know of to force a logoff and its really just up to the user to set the correct password on the device.
Unfortunately no. I was thinking more like an automatic feature that logs out the user from all his devices when the password is changed.
It would be a massive hassle to sign out the user manually (especially when you have A LOT of users, haha).
Yea, that I dont know of anything that does that automatically. :(
I ll keep looking into this, thanks for the feedback though :)
Hi @Robert Cristian , sorry for the delay in response. @Andy David - MVP had a good response , but it seems that and the document I posted in the original reply didn't apply to your case.
I have a possible solution but it might be a little complicated. I figured I'd share it just in case! Have you looked into Microsoft Graph? There is a way to sign out of sessions using this. It depends how your users are changing their passwords, but you may be able to integrate this call on password change. Please let me know if this is on the right track or if it's wildly off! Either way we can work to find you an answer.
I would also recommend filing a feature request here. Regardless of a solution I do believe there should be a simpler approach.
If this answer helped you please mark it as "Verified" so other users can reference this.
Thank you,
James
I will give it a shot next week, trying to implement this with the client.
Will let you know if it worked, thanks a lot!
bump for awareness
