Jan 06 2021
- last edited on
Feb 06 2023
Is it possible to have when a user's password expires it logs that user out so they are forced to reset it. Currently the notification appears for the user but they only have to reset it when they log out and log back in.
I know there is a way to manually sign user's out but I wonder if this can be done automatically on expiration of password.
Jan 07 2021 12:33 AM
Session validity is enforced by token validity, not directly by passwords. Password change/expiration will cause the refresh token to expire, but the user can still retain access for the validity of the access token, and we have no way to revoke those. It also depends on the account type, the service used, etc.
TL;DR if you want thing to happen as fast as possible, best initiate the sign out.
Jan 07 2021 08:33 AMSolution
Technically, you can. In our organization we wanted to force sign-out users when their accounts get disabled or passwords are reset/changed, and so instead of waiting for the Azure refresh token to expire we solved the situation by running the following cmdlet when that action occurs:
Dec 07 2022 07:45 AM
Oct 23 2023 08:15 AM
@whitephnx2 The interceptor we use is MIM, but it can be anything. If you have an email notification whenever the password is reset, you can create a rule to Bcc a copy of that notification to a shared mailbox, and have Power Automate (for instance) revoke the token when a notification mail arrives.