Microsoft Security | Microsoft Entra | Microsoft Entra External ID
Managing external identities to enable secure access for partners, customers, and other non-employees
Persistent Token Generation Issue in Azure B2C Despite User Deletion or Deactivation
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(86.4, 28.000000000000004%, 18%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EKL%3C/text%3E%3C/svg%3E)
Kiran Lagishetti
0
Reputation points
@Jas Suri As part of our testing, we generated a 7-day refresh token with a 1-hour validity access token. After generating the token, I executed the **`Revoke-AzureADUserAllRefreshToken -ObjectId
Microsoft Security | Microsoft Entra | Microsoft Entra External ID
-
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(112.00000000000001, 28.999999999999996%, 20%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EJS%3C/text%3E%3C/svg%3E)
Jas Suri 91 Reputation points Microsoft Employee2025-11-12T13:23:39.1966667+00:00 User flows should evaluate the RT issued timestamp and compare against the revocation timestamp on the user object automatically. However, if you are using a custom policy - you have to actually implement this logic using the refresh token journey. https://github.com/Azure-Samples/active-directory-b2c-custom-policy-starterpack/blob/main/README.md#09-august-2022
Sign in to comment
Sign in to answer