microsoftgraph / microsoftgraph/msgraph-beta-sdk-dotnet

[Bug] Revoke SignInSessions not working

Open
#957 2 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Service issue type:bug
Dominant language
C#
Stars
112
Forks
37
Avg merge
14h 57m
Merged PRs (30d)
3

Description

Describe the bug

Followed the guide - https://learn.microsoft.com/en-us/graph/api/user-revokesigninsessions?view=graph-rest-beta&tabs=csharp

var graphClient = InitiateGraphClient();
await graphClient.Users[azure_user_id].RevokeSignInSessions.PostAsRevokeSignInSessionsPostResponseAsync();

Output:

{
    "additionalData": {
        "@odata.context": "https://graph.microsoft.com/beta/$metadata#Edm.Boolean"
    },
    "backingStore": {
        "returnOnlyChangedValues": false,
        "initializationCompleted": true
    },
    "value": true
}

Even after 10 mins I am able to utilize refresh_token and generate new access_token

Microsoft.

Expected behavior

Should have revoked access_token and refresh_tokens

How to reproduce
var graphClient = InitiateGraphClient();
await graphClient.Users[azure_user_id].RevokeSignInSessions.PostAsRevokeSignInSessionsPostResponseAsync();
SDK Version

5.93.0-preview

Latest version known to work for scenario above?

No response

Known Workarounds

None

Debug output
Click to expand log ```
</details>


### Configuration

- OS: Windows 11
- Microsoft.Graph.Beta - 5.93.0-preview

### Other information

_No response_

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start with the documented RevokeSignInSessions call in the issue and reproduce it using Microsoft.Graph.Beta 5.93.0-preview on Windows 11. Verify the returned value and whether an existing refresh_token can still generate an access_token after ten minutes; done means the observed behavior is explained or the SDK/API issue is isolated.

Written by the indexing model from the issue text.

Assessment

Tech stack
csharp
Domain
authentication
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.