Sometimes it is critical to revoke a user’s Azure AD session for whatever reason it may be. You can always delete the user from Azure AD, however if the user is connected via PowerShell, the user’s token may not expire for a few more minutes, or maybe hours, depending on the token TTLs settings… So what can you do? You can forcefully revoke a user’s token session by using the following PowerShell cmdlet, “Revoke-AzureADUserAllRefreshToken“. Due to Microsoft’s ever changing Azure modules, I have tested this solution within the Azure Cloud Shell, and not on a local machine with PowerShell ISE with the AZ or RM modules.
First we need to identify which user will have its access revoked. Based off of the Revoke cmdlet, you will need to specify the “ObjectID” parameter, and the user’s ObjectID can be found within the Azure AD blade as seen below:
For additional information you can view the user’s access by executing the following cmdlet, “Get-AzRoleAssignment -ObjectId <>”
Once we have identified the user and its ObjectID, we first need to connect to Azure AD, this is done by running the following cmdlet, “Connect-AzureAD -TenantId <>“. With my experience you need to specify the TenantID. Once you have connected, and verified your device, you can now run the Revoke cmdlet, as seen below, the following cmdlet needs to be executed, “Revoke-AzureADUserAllRefreshToken -ObjectId <>“. The Revoke cmdlet will not provide any details if the operation was successful, however it will throw an error if something did not go right — yes, very helpful, right? 🙂
By running this Revoke cmdlet, the user has now lost all access to its Azure AD account and any active sessions, either via the Azure Portal UI, or PowerShell will be immediately revoked. 🙂
SCOM & Other Geeky Stuff 
Yes, this will revoke the Token, BUT it does not revoke all existing open sessions. The session is still open and active for the revoked user to use. If they already have a browser or other session open with the token, that token will remain active until they refresh, restart the session or otherwise reboot at which time the session the revocation will be detect when the token attempts to refresh.
Was investigating this in connection with On-Prem AD Account Expiration to forcefully revoke the open sessions without Disabling the AzureADUser account separate to avoid potential triggering of Deprovisioning Processes in case their is an Extension on the Account.
LikeLike
Yes, you are correct. Only cached, non-open sessions will be revoked.
LikeLike