Deleted Users from Azure AD B2C Are Still Able to Log In to the Web Application

Hello Naveen Kumar (NVK)

Thank you for reaching out to Microsoft Q&A.

Why Deleted Users Can Still Log In: -

This is expected behavior in Azure AD B2C. Even after a user is deleted, existing refresh tokens remain valid until:

• The refresh token expires, or
• You explicitly revoke the refresh token.

Azure AD B2C does not automatically invalidate existing refresh tokens when a user is deleted. So, the user may continue to authenticate silently using:

• Refresh Token (valid by default for 14 hours–90 days depending on configuration)
• Session Cookie (valid until configured session expiry)This is expected behavior in Azure AD B2C. Even after a user is deleted, existing refresh tokens remain valid until:
  • The refresh token expires, or
  • You explicitly revoke the refresh token.
  Azure AD B2C does not automatically invalidate existing refresh tokens when a user is deleted. So the user may continue to authenticate silently using:
  • Refresh Token (valid by default for 14 hours–90 days depending on configuration)
  • Session Cookie (valid until configured session expiry)

1. Revoke Refresh Tokens

You can force sign‑out a user immediately by revoking their refresh tokens.

Azure AD B2C supports revocation via Microsoft Graph:

Option A – invalidateAllRefreshTokens (beta endpoint)

POST https://graph.microsoft.com/beta/users/{userId}/invalidateAllRefreshTokens

Option B – revokeSignInSessions (v1.0 endpoint)

POST https://graph.microsoft.com/v1.0/users/{userId}/revokeSignInSessions

2. Implement the Refresh Token User Journey

If you are using Custom Policies, Microsoft recommends implementing the RedeemRefreshToken journey from the starter pack:

This journey checks whether the user still exists and is enabled before issuing a new token.

From Microsoft’s custom policy starter pack:

“The Refresh Token user journey checks the user still exists and is enabled… This fix prevents directory deleted users from getting continued access.”

For your reference: https://github.com/Azure-Samples/active-directory-b2c-custom-policy-starterpack/blob/main/README.md

You can add the RedeemRefreshToken journey to your TrustFrameworkExtensions.xml without modifying the base file shared across apps.

3. Adjust Token Lifetimes

Microsoft explains that access tokens cannot be revoked, so controlling lifetime helps minimize risk

• Access Token Lifetime: decrease from 1 hour to something shorter (e.g., 15 minutes)
• Refresh Token Lifetime: decrease (minimum allowed = 1 hour sliding / 24 hours non‑sliding)

For your reference: https://learn.microsoft.com/en-us/azure/active-directory-b2c/session-behavior?pivots=b2c-user-flow

let us know if you need any further assistance.

Thanks