Skip to content

user-invalidateallrefreshtokens.md

Latest commit

 

History

History
130 lines (100 loc) · 5.46 KB

user-invalidateallrefreshtokens.md

File metadata and controls

130 lines (100 loc) · 5.46 KB
title user: invalidateAllRefreshTokens
description Invalidates all of the user's refresh tokens issued to applications and session cookies in a user's browser.
ms.localizationpriority medium
author yyuank
ms.reviewer iamut
ms.subservice entra-users
doc_type apiPageType
ms.date 10/22/2024

user: invalidateAllRefreshTokens

Namespace: microsoft.graph

[!INCLUDE beta-disclaimer]

Invalidates all of the user's refresh tokens issued to applications and session cookies in a user's browser, by resetting the refreshTokensValidFromDateTime user property to the current date-time. Typically, this operation is performed (by the user or an administrator) if the user has a lost or stolen device. This operation would prevent access to any of the organization's data accessed through applications on the device without the user first being required to sign in again. In fact, this operation would force the user to sign in again for all applications that they have previously consented to, independent of device.

For developers, if the application attempts to redeem a delegated access token for this user by using an invalidated refresh token, the application receives an error. If this happens, the application needs to acquire a new refresh token by making a request to the OAuth 2.0 /authorize endpoint, which forces the user to sign in.

Important

This API won't be promoted to general availability status. We recommend that you use the user: revokeSignInSessions API instead.

[!INCLUDE national-cloud-support]

Permissions

Choose the permission or permissions marked as least privileged for this API. Use a higher privileged permission or permissions only if your app requires it. For details about delegated and application permissions, see Permission types. To learn more about these permissions, see the permissions reference.

[!INCLUDE permissions-table]

Important

In delegated scenarios with work or school accounts, the signed-in user must be assigned a supported Microsoft Entra role or a custom role with a supported role permission. The following least privileged roles are supported for this operation:

  • Directory Writers
  • Helpdesk Administrator
  • Authentication Administrator
  • Privileged Authentication Administrator
  • User Administrator

HTTP request

POST /me/invalidateAllRefreshTokens
POST /users/{id | userPrincipalName}/invalidateAllRefreshTokens

[!INCLUDE me-apis-sign-in-note]

Request headers

Header Value
Authorization Bearer {token}. Required. Learn more about authentication and authorization.

Request body

This operation has no request content.

Response

If successful, this method returns a 2xx series response code.

Example

Request

The following example shows a request.

HTTP

POST https://graph.microsoft.com/beta/me/invalidateAllRefreshTokens

C#

[!INCLUDE sample-code] [!INCLUDE sdk-documentation]

Go

[!INCLUDE sample-code] [!INCLUDE sdk-documentation]

Java

[!INCLUDE sample-code] [!INCLUDE sdk-documentation]

JavaScript

[!INCLUDE sample-code] [!INCLUDE sdk-documentation]

PHP

[!INCLUDE sample-code] [!INCLUDE sdk-documentation]

PowerShell

[!INCLUDE sample-code] [!INCLUDE sdk-documentation]

Python

[!INCLUDE sample-code] [!INCLUDE sdk-documentation]

Response

The following example shows the response.

HTTP/1.1 204 No Content