Automating Revoking of Refresh Tokens on Password Changes

Question

Automating Revoking of Refresh Tokens on Password Changes

srednuasj 0

Currently, we have an issue of our logs spamming with M365/AD login failures by non-interactive user sign-ins. However, we determined that majority of these users have had recent password changes, making us believe that non-up-to-date refresh tokens are causing the issue. Since we are a large enough company that could not keep up with manually revoking tokens, is there a way to automate this process? I don't have much experience with Microsoft Graph, but would it involve that?

0 comments

1 answer

Your answer

Answer 1

Yep - this can be automated, and Microsoft Graph is the correct API for this. In Entra ID, a password change does not automatically invalidate all existing refresh tokens in every scenario. Existing refresh tokens can continue to be used until they expire or are revoked, which can result in non-interactive sign-in failures when applications attempt to use stale credentials.

You can automate token revocation by using Microsoft Graph's revokeSignInSessions action (POST /users/{id}/revokeSignInSessions). This invalidates the user's refresh tokens and session cookies, forcing applications to obtain new tokens. A script or automation runbook can monitor password changes (for example through Entra audit logs, Microsoft Graph change notifications, or scheduled queries) and automatically revoke sessions for affected users.

For a large environment, you might want to target users showing repeated non-interactive sign-in failures after a password reset. This can be automated with Azure Automation, Logic Apps, Functions, or a scheduled PowerShell script using Microsoft Graph PowerShell SDK with appropriate permissions such as User.ReadWrite.All or Directory.ReadWrite.All (depending on implementation). Also verify that the failures are actually caused by stale refresh tokens, because other causes such as cached credentials, legacy authentication, service accounts, or misconfigured applications can produce similar patterns.

If the above response helps answer your question, remember to "Accept Answer" so that others in the community facing similar issues can easily find the solution. Your contribution is highly appreciated.

hth

Marcin