microsoftgraph / microsoftgraph/msgraph-sdk-dotnet

RevokeSignInSessions not working for B2C tenant

Open
#3,019 1 comment 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Service issue
Dominant language
C#
Stars
789
Forks
264
Avg merge
15h 17m
Merged PRs (30d)
3

Description

Describe the bug

I am working on a feature to trigger revoking sessions for a user from all devices. The SignInSessionValidFromDateTime was reset, but the user could still get new access tokens using the refresh token.

Note: this is for a B2C tenant. I tried to use "Revoke sessions" from Azure portal and it works as expected. I am wondering if the portal is doing more than just resetting SignInSessionsValidFromDateTime value.

Expected behavior

The user logged in from other browsers should not refresh the access token once existing access token expires. Like what it does from azure portal, when "Revoke sessions" triggers for a user, all existing refresh tokens become invalid.

How to reproduce
  1. Login as user in a browser
  2. Run the program to revoke sessions and returns 200 response. var response = await _graphClient.Users[userId].RevokeSignInSessions.PostAsRevokeSignInSessionsPostResponseAsync();
  3. Issue: the user keeps getting new access tokens once previous one expires.
SDK Version

No response

Latest version known to work for scenario above?

No response

Known Workarounds

No response

Debug output
Click to expand log ```
</details>


### Configuration

_No response_

### Other information

_No response_

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start with the RevokeSignInSessions.PostAsRevokeSignInSessionsPostResponseAsync call in the reproduction against a B2C tenant, then compare its 200 response and refresh-token behavior with the Azure portal's Revoke sessions action. Done means identifying whether the SDK request or the B2C service causes refresh tokens to remain valid, with a reproducible result and an actionable fix or service finding.

Written by the indexing model from the issue text.

Assessment

Tech stack
csharp
Domain
api, authentication
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.