Revoking access — stop a person now | ATX AnalyticsTable Docs

Revoking access — stop a person nowEnd a person's sessions and refuse every token issued before now, block a leaver until unblocked, and bound how long a removed role can survive with a maximum token age. Roles are carried by the sign-in token, and a token already issued keeps saying what it said when it was issued. Without anything more, removing someone from a role would take effect only when their token expires — up to about an hour for Entra ID. ATX AnalyticsTable gives an administrator three ways not to wait: revoke a person, require fresh tokens, and let an authoritative SCIM directory decide roles on every request (see SCIM provisioning).

Overview

Roles are carried by the sign-in token, and a token already issued keeps saying what it said when it was issued. Without anything more, removing someone from a role would take effect only when their token expires — up to about an hour for Entra ID. ATX AnalyticsTable gives an administrator three ways not to wait: revoke a person, require fresh tokens, and let an authoritative SCIM directory decide roles on every request (see SCIM provisioning).

Revoke a person

Open Settings → Identity (Entra ID) → Revoke access: Settings → Settings → Set / Restore → Identity (Entra ID)
1. Open Settings → Identity (Entra ID) and find Revoke access.
2. Enter the person's user name or e-mail address.
3. Tick Block until unblocked only for someone who must not get back in at all — a leaver whose account cannot be disabled at the identity provider fast enough.
4. Click Revoke now. The message says how many sessions were ended.
Every session of that person ends at once, and every token issued to them before that moment is refused with 401 token_revoked — Entra tokens and OIDC tokens alike, whichever provider they signed in with. The app then renews silently: it asks Entra for a fresh token, which carries the roles the person holds now, or it shows the sign-in screen to an SSO user. A blocked person is refused with 403 access_blocked, including at the next sign-in, until an administrator lifts the block.
Active sessions lists every live single sign-on session with its provider and last activity; End stops one of them. The same actions are available to scripts as POST /api/identity/revoke ({ "username": "…" }, { "username": "…", "permanent": true } or { "all": true }), POST /api/identity/unblock, GET /api/identity/sessions and DELETE /api/identity/sessions/<id> — administrators only, and every one is written to the audit trail as identity.revoke, identity.unblock or identity.session.end.
Revocation compares in whole seconds, the precision of a token's issue time. A token issued within the same second just before the revocation is not caught; signing in again after it always works.

Require fresh tokens — the maximum token age

ANALYTICS_AUTH_MAX_TOKEN_AGE_SECONDS refuses any Entra or OIDC token issued longer ago than the value, with 401 token_stale. The app reacts by asking for a new token at once and repeating the request, so the person notices nothing but one slightly slower request. Because Entra writes roles and groups into a token when it issues it, a role removed in Entra disappears within that many seconds. 300 (five minutes) is a sensible value: it costs one silent token request per person every five minutes. Values below 60 are raised to 60, and the setting is off by default.

Which to use when

Someone leaves today — Disable them at the identity provider, then Revoke now with Block until unblocked.
Someone moves to another team — Change their groups at the identity provider. With SCIM, nothing else; otherwise Revoke now so their next token carries the new roles.
A device or a session may be compromised — Revoke now for that person, or { "all": true } to sign everyone out.
Policy says role changes must apply within minutes — Set ANALYTICS_AUTH_MAX_TOKEN_AGE_SECONDS=300, or provision with SCIM.
Revocations are kept in auth-revocations.json in the server's profile folder, written immediately, and pruned after seven days — except permanent blocks, which stay until lifted.

ATX Institute on LinkedIn

This site needs JavaScript for the full experience. Every page above is reachable without it.