I'm still unable to invalidate the refresh token, even after waiting more than 20 minutes.
The refreshTokensValidFromDateTime
field was updated correctly, but I'm still able to use the existing refresh token to obtain a new access token. It seems the refresh token is not being invalidated as expected.
I’ve also checked the portal, and the StsRefreshTokensValidFrom
field is correctly set to the current time.
For reference, my token lifetimes are configured as follows:
Refresh Token: 14 days
Access Token: 1 hour
Is there any known issue that could be causing this?