How do I revoke a Refresh Token who took my Minecraft account?

@Jimmy Ma

Thank you for posting this in Microsoft Q&A.

As I understand you want to revoke the access token that was issued to your account initially while accessing Minecrafe SSID>

The default lifetime of an access token is variable. When issued, an access token's default lifetime is assigned a random value ranging between 60-90 minutes (75 minutes on average). The default lifetime also varies depending on the client application requesting the token or if Conditional Access is enabled in the tenant. If the authentication protocol allows, the app can silently reauthenticate the user by passing the refresh token to the Microsoft Entra ID when the access token expires.

There is refresh token that is issue to user account also along with access token.

When access token is expired, refresh token is given to identity provider to to get new access token and silent authentication takes place.

In your situation you can revoke your refresh token for your account, and this will prompt for credentials once again when access token is expired instead of performing silent authentication.

You can revoke refresh token using below PowerShell command,

Revoke-AzureADUserAllRefreshToken -ObjectId "a1d91a49-70c6-4d1d-a80a-b74c820a9a33"

https://video2.skills-academy.com/en-us/powershell/module/azuread/revoke-azureaduserallrefreshtoken?view=azureadps-2.0

You can also perform this using Microsoft Graph,

POST https://graph.microsoft.com/{version}/users/{userobject_id}/invalidateAllRefreshToken`

https://stackoverflow.com/questions/72645759/how-to-revoke-azure-ad-oauth-token

Let me know if you have any further questions.

Please "Accept the answer" if the information helped you. This will help us and others in the community as well.