How to void Entra App User Access token after the user access is removed from application

Question

Hi everyone,
I would like to know if there's a way to void a Microsoft Entra app user access token immediately after the user access is removed from a registered application in Microsoft Entra admin center.

Currently user access token will be voided around an hour after the user access removal without me doing anything in the access token configuration.

This is in relation to a question I asked previously:
https://learn.microsoft.com/en-us/answers/questions/2140277/how-to-void-an-established-vpn

Thank you

Answer 1

Hi @Handinata Tanudjaja

Thank you for reaching Microsoft Q&A Forum!

I understand that you are trying to revoke the Microsoft Entra app user access token immediately after the user access is removed from a registered application in Microsoft Entra admin center.
You can implement Continuous access evaluation, which allows access tokens to be revoked based on critical events, user termination or password change/reset and policy evaluation, rather than relying on token expiry based on lifetime.

For more read How to use Continuous Access Evaluation enabled APIs in your applications.

If you would like to revoke all sessions for the user, you can use Revoke Sessions feature in Entra portal which revoke the access, and it requires the user to re-sign in from all devices and issue a new access token.

Entra ID refresh tokens can be revoked by a user using the AzureAD PowerShell Revoke-AzureADSignedInUserAllRefreshToken cmdlet or by an admin using the Revoke-AzureADUserAllRefreshToken cmdlet.

Reference: Revoke user access in Microsoft Entra ID
Hope this helps. Do let us know if you any further queries by responding in the comments section.