🔐 Microsoft 365 Security: Revoking Sessions Is Not the Same as Blocking User Access

An employee leaves the organisation, or their Microsoft 365 account is compromised.

As an administrator, you go to Microsoft Entra ID → Users → Select User → Revoke Sessions.

The portal displays a successful message.

But here is an important question:

Has the user's access actually been terminated?

Not necessarily. This is where many administrators need to understand the difference between session revocation and account disablement.

Let's break it down. 👇

1️⃣ Revoke Sessions – What actually happens?

When you select Revoke Sessions, Microsoft Entra ID invalidates the user's refresh tokens and browser session cookies.

This forces supported clients to reauthenticate when they next need a valid session.

However:

  • The user account remains enabled.
  • The user may authenticate again.
  • Previously issued access tokens may remain valid until expiry, depending on the application and Continuous Access Evaluation (CAE) support.
  • Some third-party applications maintain their own sessions.

Remember: Revoke Sessions is not the same as disabling an account.

2️⃣ Block Sign-in – Stop new authentication

If you need to prevent a user from signing in again, disable the account.

In Microsoft Entra Admin Center:

Users → All Users → Select User → Properties → Account Enabled → No.

For stronger containment, combine:

  • Block Sign-in
  • Revoke Sessions
  • Investigate suspicious activity
  • Review MFA methods and credentials
  • Check application permissions and mailbox forwarding rules
  • Review registered devices and active sessions

3️⃣ How do we verify whether access is actually blocked?

Don't rely only on the success notification in the portal.

Verify the following:

✅ Audit Logs

  • Check whether the session revocation action was successful.
  • Review the actor, target user and timestamp.

✅ Sign-in Logs

  • Review both Interactive and Non-interactive sign-ins.
  • Check authentication status and failure reasons.
  • Correlate timestamps and correlation IDs.

✅ Important Error Codes

  • AADSTS50173 – The provided grant has been revoked.
  • AADSTS50057 – User account is disabled.

These errors help identify why authentication failed.

✅ Application Verification

  • Test Outlook Web access.
  • Check whether the user can establish a new session.
  • Verify access to other Microsoft 365 services and relevant third-party applications.

4️⃣ What should Microsoft 365 administrators remember?

There are three different security objectives:

🔹 Revoke Sessions: Invalidate existing refresh credentials and supported browser sessions.

🔹 Block Sign-in: Prevent the account from authenticating again.

🔹 Remove Application Access: Review and revoke specific application permissions or consent grants.

These are different security controls. One does not automatically replace the others.

My Takeaway 💡

In identity security, clicking a button is not proof that access has been removed.

Action → Verification → Evidence → Confirmation

A successful administrative operation is only the beginning. Always validate the actual user access, correlate Entra audit and sign-in logs, and confirm that the containment objective has been achieved.

This is the difference between simply managing Microsoft 365 and practising effective identity security.