How to revoke all Azure refresh tokens for a Leaver?

Implement & Extend
, ,
1

Hi,

I have a requirement to revoke all Azure access tokens assigned to a user when they leave the organization.

One way is to invoke this PowerShell command or call Graph API to achieve this.

PowerShell → Revoke-AzureADUserAllRefreshToken -ObjectId <object_id_of_user>
Graph API → POST https://graph.microsoft.com/v1.0/users/<object_id_of_user>/revokeSignInSessions

Are there any other alternatives using Azure AD connector to achieve same result?

We are using IIQ8.1p1

2

If the user is deactivated as part of leaver, I believe the access tokens will become useless. However. to explicitly revoke those, you may leverage after provisioning rule to call graph API to revoke access tokens. Direct connector can’t be used since access token is not a managed object.

3

Thank you @kalyankumar_saha .

Per Microsoft access tokens stay alive for up to 1 hour after user’s account is disabled. Only way (as of now) is to explicitly revoke them. This is especially critical for an Immediate termination use case.

4

Right and good to know this small small nitty-gritty. Thanks for sharing.

5

Hi  @kalyankumar_saha  ,

I have also same requirement to revoke all Azure access tokens, Can you please attach Graph API code snippet, how we can use from After provisioning Rule.

Thanks in advance

6

You have to make an HTTP call to the API. You will get ample example in Google how to do that using Apache HTTP client.

7

I have the same issue - will look it up but would love sample on the call out from sailpoint