I got a token and a refresh token following https://learn.microsoft.com/en-us/azure/active-directory/develop/v2-oauth2-device-code , but i can't revoke refresh token. The revoke API is clearly defined in the RFC7009 document. Links and screenshots are below: https://www.rfc-editor.org/rfc/rfc7009 Google's revoke API meet RFC7009 Links and screenshots are below: https://developers.google.com/identity/protocols/oauth2/limited-input-device Does Microsoft have an interface that comply with RFC7009? How to revoke a refresh token if there is no interface that comply with RFC7009?

@scarecrow kakashi Thank you for reaching out to us. You can use the below graph call to revoke the Refresh token: To revoke the refresh token of the signed-in user: POST https://graph.microsoft.com/v1.0/me/revokeSignInSessions To revoke the refresh token of another user: POST https://graph.microsoft.com/v1.0/users/object_id_or_upn_of_user/revokeSignInSessions Alternatively, you can use below PowerShell cmdlets as well: Revoke-AzureADSignedInUserAllRefreshToken Revoke-AzureADUserAllRefreshToken Let me know if you have any questions.

Revoke OAuth refresh token API

Accepted answer

Givary-MSFT 32,591 Reputation points Microsoft Employee

2022-09-06T12:01:27.283+00:00

@scarecrow kakashi Thank you for reaching out to us.

You can use the below graph call to revoke the Refresh token:

To revoke the refresh token of the signed-in user:

POST https://graph.microsoft.com/v1.0/me/revokeSignInSessions

To revoke the refresh token of another user:

POST https://graph.microsoft.com/v1.0/users/object_id_or_upn_of_user/revokeSignInSessions

Alternatively, you can use below PowerShell cmdlets as well:

Revoke-AzureADSignedInUserAllRefreshToken

Revoke-AzureADUserAllRefreshToken

Let me know if you have any questions.
Please sign in to rate this answer.
Karol 1 Reputation point

2022-09-14T13:06:01.557+00:00

Hey Givary,

The APIs you pointed out would revoke all user tokens and loginns for all applications. They also require extra permissions and it seems the intention is that they woubd be used by org admins and they do not work for personal accounts.

I'm a 3rd party app developer and we are looking for a way to revoke/invalidate refresh tokens for a user, but just those our users granted us with to use our app, not all tokens users have granted to other applications. Ideally we would be able to do it for all the users (with both work and personal accounts).

Is ther a way to invalidate/revoke specific tokens?

Thanks.

scarecrow kakashi 246 Reputation points

2022-09-19T04:03:19.983+00:00

@Givary-MSFT

I have the same question as Karol-0876 . Is ther a way to invalidate/revoke tokens for a personal accounts?

Givary-MSFT 32,591 Reputation points Microsoft Employee

2022-09-19T06:25:39.863+00:00

@Karol @scarecrow kakashi If I understand correctly you want to know if there is an API that can revoke only one(my) specific refresh token , basically disconnecting my (third party )app from their Microsoft Account. If my understanding is incorrect feel free to post/write/reply it back.

Unfortunately, we do not support this feature as of now to revoke specific refresh token for specific application. Currently only feature is to invalidate all the refresh token for user access.

You can post your feedback here https://feedback.azure.com/d365community which is closely monitored by our product group team.

Let me know if you have any further questions.
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.

Share via

Revoke OAuth refresh token API

0 additional answers

Your answer