Azure AAD B2C: revokeSignInSessions seems to be ignored

Question

Azure AAD B2C: revokeSignInSessions seems to be ignored

Stefano Sapienti 110

Hi,

we are using Azure B2C with custom policies to authenticate users in different types of applications: web, SPA and mobile.

We have custom attributes that could be changed by offline systems and that are included in JWT. We would like to invalidate refresh tokens in order to force the app to refresh the token and have attributes changed.

We are simulating call using postman so we use the "/authorize" endpoint to authenticate the user, then we call "/token" endpoint to retrieve the refresh token and "/token" endpoint again to refresh it.

After calling "/users/{id}/revokeSignInSessions" we expect an error on the next "/token" call but it keeps working also with the original refresh token, generated hours before the revokeSignInSessions, until the refresh token expires.

We are missing something on the expected behavior of the revoking API? Maybe we have to change something on the policies to handle it? I can't find any clear documentation on that.

Thanks in advance

Carolyne 1,151 Reputation points Microsoft Employee

2026-02-02T14:46:37.42+00:00

Hey Stefano!
Did you get a workaround for this. I believe In Azure AD B2C, revokeSignInSessions does not automatically invalidate refresh tokens issued via custom policies; it resets timestamps on the user object, but refresh tokens keep working unless the policy explicitly checks those values during refresh.
For custom policies, you must implement a Refresh Token user journey (e.g., RedeemRefreshToken) that compares refreshTokenIssuedOnDateTime with refreshTokensValidFromDateTime; without this, revoked tokens will continue to refresh. Try to update your custom policy to include the refresh-token validation claims transformation.

Your answer

Carolyne 1,151 Reputation points Microsoft Employee

2026-02-02T14:46:37.42+00:00

Hey Stefano!
Did you get a workaround for this. I believe In Azure AD B2C, revokeSignInSessions does not automatically invalidate refresh tokens issued via custom policies; it resets timestamps on the user object, but refresh tokens keep working unless the policy explicitly checks those values during refresh.
For custom policies, you must implement a Refresh Token user journey (e.g., RedeemRefreshToken) that compares refreshTokenIssuedOnDateTime with refreshTokensValidFromDateTime; without this, revoked tokens will continue to refresh. Try to update your custom policy to include the refresh-token validation claims transformation.