How can I revoke a users token?

[justinmchase]

I see in the sample the app appears to be constructing a logout url and navigating a user to it:

https://github.com/AzureAD/microsoft-authentication-library-for-js/blob/dev/samples/msal-node-samples/ExpressTestApp/src/AuthProvider.ts#L161

But I'd really like to do this silently from within my app backend. I have their refresh token is there no way for me to just do it directly?

[jasonnutter]

@justinmchase Unfortunately, there is not currently a way to invalidate a given refresh token. It will be valid until it expires or until all of their RTs are invalidated by an admin.

[justinmchase]

Can I invalidate the accessToken though? Which will invalidate all refresh tokens?

[jasonnutter]

That is not currently possible, no.

[justinmchase]

Its been a year, is this possible now?

[BrandonSchreck]

This is something we need too...for security purposes, we need the ability to revoke a user's session from within the Azure B2C portal...and have the user logged out of our application.

However, in testing, I am not logged out.

UI:
Angular: 15.2.10
@azure/msal-angular: 3.0.11
@azure/msal-browser: 3.7.1

API:
Node/Express: 18.18.2/4.18.2
passport: 0.7.0
passport-azure-ad: 4.3.5

The API doesn't really matter though because I can see the refresh token being retrieved prior to the API being called (which makes the API validation a moot point since a new valid token is being issued).