Free tools Windows power users keep installed
One-click scans. No signup required.
No: changing a password does not reliably revoke every OAuth token or sign out every SaaS app. A password reset, an identity provider’s token revocation, and an application’s own session termination are separate controls. After a suspected token theft, responders need to cut off new sign-ins, revoke provider-side credentials and grants, invalidate app-native sessions, and verify what actually stopped working.
Why a password reset may leave access behind
OAuth access and refresh tokens are issued by an authorization server. A password change is an account event; whether it revokes those credentials depends on that issuer’s policy and the token type. The IETF’s OAuth 2.0 Security Best Current Practice, RFC 9700, says authorization servers may automatically revoke refresh tokens after a security event such as a password change or logout. It does not require every provider to do so.
As an Amazon Associate I earn from qualifying purchases.
Microsoft Entra’s documentation illustrates the variation: outcomes depend on token class and on how the password was changed or reset. Some password-based token types may be revoked in specified cases, while non-password-based tokens can remain valid. The reset surface matters, too. These are Entra-specific behaviors, not a rule for every identity provider.
There is also a boundary between the identity provider and the SaaS app. An app may maintain its own browser cookie, mobile session, API credential, or server-side session after the identity provider’s tokens have been revoked. Microsoft explicitly says Entra cannot directly revoke an application-issued session token; the app must enforce its own authorization policy. Check each affected service rather than treating a successful identity-provider operation as proof that all sessions ended.
#1 Best Overall
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Which credential or session are you trying to invalidate?
“Sign out” and “revoke OAuth” can refer to different state held by different systems. Identify the issuer and enforcement point before choosing a control.
| Credential or session | Who issues or enforces it | What revocation can accomplish |
|---|---|---|
| Access token | Authorization server issues it; a resource server accepts or rejects it. | RFC 7009 says implementations must support refresh-token revocation and should support access-token revocation. Whether a revoked access token stops working immediately depends on the provider’s implementation and how quickly resource servers learn of the change. |
| Refresh token | Authorization server | Revoking it prevents it from being used to obtain new access tokens, subject to provider behavior and propagation. It may also affect related tokens or the grant, but that cascade is not identical across providers. |
| Identity-provider browser session | Identity provider | A provider’s session-revocation control can invalidate its own browser session state and, depending on the provider, associated refresh-token state. It does not necessarily end an app’s separate session. |
| SaaS-native session | The SaaS application | The application’s session termination or user-session controls are needed to invalidate app-issued cookies or server-side sessions that the identity provider cannot directly revoke. |
Refresh tokens deserve particular attention because they can obtain new access tokens. RFC 9700 requires public-client refresh tokens to use rotation or sender constraint to detect replay. Rotation replaces an old refresh token and can reveal reuse; a provider may revoke the active token when it detects replay, forcing the legitimate user to authorize again. Sender constraint binds use to key material, but theft of both token and key weakens that protection.
Rank #2
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
What to do after a suspected token theft
Use the response sequence below as a framework, then follow the identity provider’s and each affected SaaS application’s documented controls. The exact operations and their scope differ by provider.
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minute- Contain new access and preserve evidence. If the account itself is compromised, use the identity provider’s account-disable or block-sign-in control under your incident process. Before cleanup where feasible, record affected accounts, apps, grants, devices, and the relevant time window. Preserve logs and other evidence without leaving exposed tokens in incident artifacts.
- Revoke identity-provider refresh tokens and sessions. Microsoft’s Entra emergency guidance describes blocking sign-ins and revoking refresh tokens. Its Microsoft Graph
revokeSignInSessionsoperation invalidates a user’s refresh tokens and browser session cookies. Microsoft Graph documentation warns that revocation can take a few minutes to propagate, and says this operation does not revoke sessions for external users authenticating through their home tenant. - Revoke grants or tokens at the issuer or application. RFC 7009 defines an HTTPS token-revocation endpoint. It requires implementations to support refresh-token revocation and recommends support for access-token revocation. Depending on the authorization server’s policy, revocation may also invalidate related tokens or the underlying grant. Confirm the documented scope rather than assuming a cascade.
- End sessions inside each affected SaaS app. Use the service’s own session-revocation or user-session termination controls, and revoke app-specific grants where available. Check browser, mobile, API, and integration credentials separately; they may not share one session store or one sign-out control.
- Rotate exposed secrets and secure token-bearing systems. If client secrets or signing keys were exposed, rotate them according to the provider’s process. Remove tokens from logs, tickets, shell history, repositories, and exported incident files. RFC 9700 calls for protecting tokens in storage and transit. Google’s OAuth best practices advise server-side applications to encrypt tokens at rest, protect token datastores from public internet access, and avoid transmitting tokens in plaintext.
- Verify the cutoff and document the result. Test whether the old refresh token can still obtain an access token and whether existing app sessions still work. Record observed propagation time, which session types ended, and whether users must complete interactive authorization again. RFC 7009 notes that revocation may take time to reach all servers.
How to interpret the cutoff window
Revocation is not always instantaneous across a distributed service. RFC 7009 notes practical propagation delay, and an access token already issued may remain usable until the relevant resource server learns it was revoked or the token expires. Microsoft Graph documents a possible delay of a few minutes for revokeSignInSessions; that timing is specific to the documented operation, not a general OAuth guarantee.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Short-lived access tokens reduce the time an exposed token may be useful, but they do not solve every active-session problem. Microsoft Entra’s emergency-access guidance gives a default access-token lifetime of one hour for Entra. That is a Microsoft-specific default, not a universal OAuth lifetime. Microsoft also notes that browser applications commonly rely on application session tokens, which may remain active independently of an Entra access token.
For each system, establish what a revocation response means in practice: whether the token is rejected at the next request, whether replicas or resource servers have caught up, and whether an existing browser or mobile session has separate state. The remaining lifetime of a token and the propagation time of a revocation are different parts of the exposure window.
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Reduce the chance and impact of another compromise
Limit token authority
- Request only the scopes the application needs, and keep access-token audiences limited to the intended resource server or a small set of resources, as RFC 9700 recommends.
- Use incremental authorization where appropriate. Google recommends asking for scopes when a feature needs them instead of requesting every permission at initial sign-in.
- Audit OAuth clients and grants. Google advises proactively removing obsolete OAuth clients rather than relying on automatic deletion. Maintain an owner, purpose, permission set, and review date for each integration.
Make refresh-token replay harder to exploit
For public clients, implement refresh-token rotation or sender constraint in line with RFC 9700. Rotation can detect reuse of an invalidated token, but a replay response may also force the legitimate user to authorize again. Sender constraint, including DPoP, binds token use to a key; it is not protection if an attacker obtains both the token and the relevant key material.
Protect token storage and recovery paths
Store tokens using protections appropriate to the platform, encrypt server-side token stores at rest, and protect credentials in transit. Restrict access to logs, backups, incident exports, and developer tooling that could contain token material. Build a clean recovery path for unexpected invalidation: RFC 7009 says clients must be prepared for tokens to be invalidated, so applications should handle failed refreshes predictably and require reauthorization when needed rather than treating the failure as an unexplained outage.
Best Value
- POWERFUL SECURITY KEY: The YubiKey 5 is a versatile physical passkey that protects your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 secures 100+ of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 via USB and tap it to authenticate. No batteries, no internet connection, and no extra fees required.
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Test the behavior before an incident
A documented button or successful API response does not establish that every credential type has been cut off. Include a controlled revocation exercise in identity and SaaS response planning. Record the provider, operation, target account, affected token and session types, observed propagation, and user impact. Test whether reconnection requires interactive authorization and whether app-native sessions, external users, mobile clients, and integrations follow different paths. Recheck this behavior after material changes to identity configuration or application architecture.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
