Session revocation
Session revocation is the deliberate invalidation of an existing session so the service responsible for it stops accepting that session as a basis for access.
Which session is being revoked?
A sign-in can lead to several kinds of continuing access. An identity provider may maintain its own session, an application may issue a separate session cookie, and a client may hold access or refresh tokens. Before revoking access, check which of these your action will actually end.
Microsoft states that Entra ID cannot directly revoke a session token issued by an application. The application’s own controls matter. Access-token enforcement also depends on the resource and supported mechanisms; do not assume a single revocation action immediately stops every existing request path.
OWASP recommends invalidating sessions on the server. Deleting a cookie from your browser does not stop the server accepting a copy held elsewhere.
Confirming access has ended
An open page may be cached, so check with a fresh request to the server. If that request times out, you still do not know whether access was revoked. Work with the application owner to check the response and any other sessions that may remain active.