How to revoke Microsoft 365 sessions after an account compromise.
Changing a password and ending existing access are separate recovery tasks. Use this guide when an Office 365 or Microsoft 365 business account may still have an attacker connected.
Before you start
Use a trusted administrator session on an unaffected device. Confirm the correct user and tenant. Record the incident time and evidence alongside urgent containment. If you cannot administer the tenant, contact the organisation’s IT provider through a verified route.
Block sign-in, then revoke sessions
- Open Microsoft Entra admin centre → Entra ID → Users → All users.
- Select the affected user. Check the account identifier before changing anything.
- Edit the account properties and set Account enabled to No; save. For hybrid identities, coordinate the source-directory action too.
- Return to the user’s Overview and select Revoke sessions. Confirm the action and record when it was requested.
Does “revoke sessions” sign the attacker out immediately?
Do not assume it does. Revocation invalidates refresh tokens, but access-token lifetime and application session behaviour affect when access actually ends. Applications can issue their own cookies and require separate action. Microsoft Graph also documents a short delay before revocation takes effect.
What if activity continues?
Distinguish a delayed log entry from a new event by checking the event timestamp. If access continues, keep the account blocked and escalate. Investigate application access, other identities, devices and persistence rather than repeatedly pressing the same button. Use the temporary sending restriction guide if malicious email is still a concern.
Revocation does not complete recovery
You still need to investigate credentials, authentication methods and mailbox changes. If the user completed MFA on a phishing page, read how session theft can happen with MFA enabled. Return access only through your approved recovery process.
Microsoft references
- Emergency access revocation and application limitations
- Microsoft Graph: revokeSignInSessions behaviour
Reviewed 18 October 2026. Portal wording and access vary by role, tenant and licensing. Follow your organisation’s incident procedure.