Identity Guardians Session Revocation

SpyCloud Identity Guardians can detect stolen active sessions and refresh tokens associated with your workforce and revoke them through your connected identity provider (IdP).

Session revocation is available for:

• Microsoft Entra ID Guardian
• Okta Workforce Guardian

This guide explains how session revocation works, how to configure it in the SpyCloud Console, and how to choose the right remediation policy for your organization.

---

🔍 Why Session Revocation?

Attackers don't always need a password to access an account. Infostealer malware and adversary-in-the-middle (AiTM) phishing attacks can steal active session cookies, refresh tokens, and other authentication artifacts that allow an attacker to maintain access to an account.

Resetting an exposed password doesn't necessarily terminate an active session. If an attacker has a valid session or refresh token, they may retain access after the password changes.

Session revocation closes this gap by terminating exposed sessions and refresh tokens through the identity provider, requiring the user to authenticate again.

SpyCloud identifies confirmed stolen access through Access severity records. For more information, see Identity Access – Severity 30 Records.

---

🧰 Before You Begin

To get up and running with session revocation, you need:

• An active SpyCloud Workforce Threat Protection license that includes Entra ID Guardian or Okta Workforce Guardian
• Access to the Guardians module in the SpyCloud Console
• An Entra ID or Okta Workforce environment that you can connect to SpyCloud
• The appropriate administrative permissions to establish the connection

You can configure one or multiple supported IdP connections based on your environment.

---

⚙️ How Session Revocation Works

When session revocation is enabled, SpyCloud monitors recaptured data for exposed authentication artifacts associated with your workforce.

What if an identity isn't found?

If SpyCloud can't match an exposed identity to a user in the connected IdP, no revocation action is taken.

---

🚀 Get Started

1. Open Identity Guardians

In the SpyCloud Console, navigate to the Guardians module and select the Guardian you want to configure:

• Entra ID Guardian
• Okta Workforce Guardian

2. Connect Your Identity Provider

Connect the Entra ID or Okta Workforce environment where you want Identity Guardians to remediate exposed sessions.

You'll need the appropriate administrative access for your identity provider to authorize the connection.

A single organization can configure multiple supported IdP connections when needed.

Note: Findings may appear before you establish an IdP connection, but SpyCloud can't perform session revocation until the appropriate connection is active.

3. Configure Your Remediation Policy

Choose how you want Identity Guardians to handle confirmed matches.

4. Configure Exclusions

Use the Exclusion Filter for identities that shouldn't be subject to automatic session revocation.

Depending on your environment, you may want to exclude:

• Service accounts
• Shared accounts
• Privileged or sensitive accounts

Excluded identities can still generate findings, but Identity Guardians won't automatically remediate them.

---

📊 Reporting and Notifications

Use the SpyCloud Console to monitor session revocation activity and understand the outcome of remediation actions.

Audit Log

The audit log records activity associated with session revocation, including matches, decisions, and remediation actions.

For manually approved remediation, the log also records the action taken during the review process.

See SpyCloud Console Audit Logs for more information.

Remediation History

Each finding shows its remediation outcome, including partial results if revocation succeeds on one tenant but fails on another.

If needed, select Retry to run the revocation again only against tenants that haven't yet been successfully revoked.

Notifications

Configure notifications in the SpyCloud Console to keep the appropriate teams informed about session revocation activity.

Notification summaries can include:

• Revoked sessions
• Findings pending review
• Failed remediation attempts
• Activity broken out by IdP tenant

Recipients are configured in Settings.

---

✅ Scope of Session Revocation

Session revocation addresses stolen authentication artifacts, but it doesn't replace other identity remediation actions.

What Session Revocation Does

• Revokes the active session and refresh token at the identity provider for supported Entra ID and Okta Workforce environments
• Requires the user to reauthenticate after the affected session is terminated

What Session Revocation Doesn't Do

🔑 Reset an Exposed Password

Session revocation and credential remediation address different risks. If SpyCloud identifies an exposed password, use the appropriate Identity Guardians credential remediation workflow in addition to session revocation.

Credential remediation: Credential reset is controlled within your Azure application for Entra ID Guardian and your Okta Workflows for Okta Workforce Guardian.

💻 Terminate the User's Local Device Session

Session revocation applies to supported cloud authentication sessions. It doesn't log the user out of the operating system on their laptop or desktop.

🔗 Terminate Every Downstream Application Session

Applications connected through your identity provider may maintain their own sessions after initial authentication. Their behavior depends on the application's session and identity provider configuration.

For Okta environments, enabling Universal Logout in your Okta environment extends termination to connected applications.

---

📚 Learn More

For additional information about configuring and using Identity Guardians, see:

• Identity Guardians
• Entra ID Guardian
• Okta Workforce Guardian
• Active Directory Guardian
• Identity Access – Severity 30 Records
• Audit Logging