Sign a user out everywhere in your tenant
End one or all of a member's sessions in your tenant at once, for example after a suspected compromise or a change that must take effect immediately. The member's sessions in other organizations keep working.
Who can do it
A tenant administrator or a tenant access administrator. The Token Management screen opens for a person who holds the permission to read your tenant's tokens; ending a session needs the permission to revoke them, and choosing a member from the list needs the permission to list users.
Before you start
- Ending sessions does not stop the person from signing in again while their membership is active. To keep them out, suspend or remove the membership, which also ends their sessions here.
- A pending invitation has no session, so it is not offered.
Steps
- Open Token Management in the sidebar.
- Under Sign-in sessions, choose the Member. Their sessions in your tenant are listed with how and when they signed in and their last activity.
- To end one session, select End session on its row, then confirm with End session.
- To end all of them, select End all of this member's sessions in this tenant, then confirm with End the sessions.
What you see when it worked
The console says Session ended. or The sessions were ended. and the list is read again.
- An ended session is signed out at its next request: its access tokens are refused by every service and its refresh token no longer works.
- Ending all of them also refuses every access token the member was issued for your tenant before the request, including a session the list does not show. A session of the member that is in another organization keeps working, but cannot switch into your tenant afterwards.
Each revocation is recorded in the audit trail, naming you as the actor and the member as the target.
If it fails
| What you see | Cause | What to do |
|---|---|---|
| The sessions were not ended, with the reason | The person is no longer an active member of your tenant, or the session already ended or belongs to another organization | Read the list again; nothing was changed |
| "The sessions could not be read" | The session list could not be loaded | Select Retry |
| "Choosing a member requires the admin.tenant.user.list permission." | You can end sessions but cannot list your tenant's members | Ask an administrator for the permission to list users |
| A service-unavailable refusal | The session store or the account service could not be reached | Try again later; nothing was changed |
Without the console
| Surface | How |
|---|---|
| API | DELETE /api/v3/auth/tenant/users/{userId}/sessions/{sessionId} (operation revokeTenantUserSession) to end one session; POST /api/v3/auth/tenant/users/{userId}/sessions/revoke (operation revokeTenantUserSessions) to end all of them |
The key management CLI and the admin SDK have no command or method for this task.
Related
- Token Management: what the screen shows and every decision you make on it.
- Team Members: suspending or removing a member, which also ends their sessions here.