Direct answer
After an endpoint incident, identify affected identities and applications, use the approved identity-provider revocation process and separately address application-owned sessions that the provider cannot directly revoke.
Identify exposed access
The incident team should determine which accounts, browsers, applications and device sessions were available on the affected endpoint. Record the time, scope and owner of the decision; avoid assuming that resetting one password invalidates every session.
Understand token boundaries
Microsoft explains that Entra can block new sign-ins and revoke refresh tokens, but applications may issue their own session cookies. Existing access can continue until expiration or until the application revokes its session. Different applications and token types have different timing.
Reference: Microsoft: Revoke user access in an emergency.
Coordinate and verify
Use approved incident procedures to restrict the account, revoke relevant sessions and contact application owners for separate invalidation where needed. Test the expected access denial using authorized accounts and track remaining sessions or systems that cannot be verified.
Example: browser and application sessions
After a lost laptop, the identity team may revoke the user's provider refresh tokens while a separate business application maintains its own session cookie. Ask that application's owner how sessions are invalidated and when access actually ends. Document the completion or uncertainty for each affected service instead of reporting a universal immediate logout.
Assessment limits
Revocation behavior depends on application design, token lifetime and synchronization. This workflow is not a guarantee of immediate termination of every session.
Frequently asked questions
Does a password reset immediately end all sessions?
Not necessarily. Check identity-provider and application-specific token and session behavior.
Can Entra directly revoke every application's own cookie?
Microsoft states that an application controls revocation of its own session tokens.
Should device isolation replace account containment?
No. Consider device and identity containment separately as part of the incident plan.
Primary sources and further reading
These guides combine published security guidance with practical assessment planning. Adapt checks to the owner's policy, environment, and authorized scope.
This guide was prepared with AI assistance using the linked sources and illustrative examples. Check current vendor guidance and your environment before making changes.