Block Microsoft 365 sign-in and revoke user sessions

SUPPORTED TENANTPILOT TASK · Fictional examples · Updated October 2026

Block sign-in is not the same as revoking a session

Disabling a user account stops permitted new sign-ins once the change is enforced. Revoking sessions is a separate action intended to invalidate sign-in sessions or refresh tokens, and existing access tokens may remain valid until they expire.

Suggested authorised workflow

1. Confirm the user, the reason and the required urgency.
2. Coordinate with the service desk and information-security process if the account is compromised.
3. Block sign-in or disable the account where authorised.
4. Revoke the user’s sign-in sessions using an approved identity-admin method.
5. Review connected applications, delegated access and any required retention separately.
6. Document the change and verify sign-in status.

Microsoft Graph PowerShell example

Update-MgUser -UserId "[email protected]" -AccountEnabled:$false

This example disables the cloud user when your Graph connection and permissions allow it. Revoke sessions separately; do not assume a password reset or account disable immediately terminates every active session.

Where TenantPilot fits

TenantPilot includes tasks to disable or enable users and revoke user sessions. Security incidents and employee-leaver procedures may need additional actions outside the app.