Small and medium business | Business Central, N...

How to force sign-out a user from Business Central instead of just cancelling the session?

(8) Share

Report

Posted on by AGBT900

148

In the Business Central Admin Center, under Environments → Manage Sessions, there is an option to Cancel Session.

When we cancel a session, the user side shows this message

"Dynamics 365 Business Central

We paused while you were away. Please refresh to continue."

(Refresh button appears)

However, this only pauses the session — the user can simply refresh and continue working.

Our client’s requirement is to forcefully sign out a user (so they must log in again), not just pause the session.

Is there any way to achieve this, either through Admin Center, API, or custom AL code?

If not, is this limitation by design or are there any planned enhancements around session management or forced logout in Business Central?

Categories:

Dynamics 365 Business Central

I have the same question (0)

All responses (10)

Answers (0)

Sort by

Suggested answer

Nimsara Jayathilaka. 5,128 Super User 2026 Season 1 on at

Like (9)

Report
Copy link

Link copied!

Hi

In Business Central, Cancel Session only pauses the user session — it doesn’t force sign-out. There’s no built-in way (Admin Center, API, or AL) to make users re-authenticate.
This is by design, as session control depends on Azure AD tokens.
To fully sign out users, use the Microsoft 365 Admin Center → Sign out from all sessions for that user.
No upcoming feature or AL workaround currently enables forced logout within BC itself.

Same Thread : https://learn.microsoft.com/en-us/answers/questions/4549440/how-can-i-force-a-logout-on-all-devices

Thanks

Nimsara

Was this reply helpful? Yes No
Suggested answer

OussamaSabbouh 17,645 Super User 2026 Season 1 on at

Like (4)

Report
Copy link

Link copied!

Hello,

Canceling a session in Business Central only pauses it, users can refresh and continue.

To sign users out, use Microsoft 365 Admin Center then Sign out of all sessions

Regards,

Oussama

1 people found this reply helpful.

Was this reply helpful? Yes No
Suggested answer

Aman Kakkar 3,532 Super User 2026 Season 1 on at

Like (4)

Report
Copy link

Link copied!

Hi,

As far as I know, there isn’t a direct way to force a sign-out specifically for Business Central.

You can either configure browser settings in all of the user's systems to clear cookies/cache after a certain time to remove session tokens, or temporarily revoke the user’s Permissions in Business Central if you want to stop their activity.

You can use the “Sign out all sessions” from the Microsoft 365 Admin Center, as described in this article: How to Revoke Microsoft Office 365 Access in Bulk and Save Hours of Time! - Ytria

Although this is supposed to sign users out of all Microsoft 365 applications, it didn’t actually sign the user out of Business Central in my experience. You can give it a try.

Hope this helps,
Aman K

1 people found this reply helpful.

Was this reply helpful? Yes No
Suggested answer

Grigorios Mavrogeorgis 2,539 Super User 2026 Season 1 on at

Like (4)

Report
Copy link

Link copied!
Hi,

Cancel Session in BC doesn’t sign people out. It just kills that one server session. If the user hits Refresh, they’re right back in. That’s how it’s designed.If you need a real sign-out (they must log in again), do it at the Microsoft Entra (Azure AD) layer:
Option A: Revoke their sessions (one user)

Microsoft Entra admin center → Users → pick the user

Revoke sign-in sessions (sometimes labeled “Sign out of all sessions”)
→ Their refresh tokens are invalidated. On next refresh/token renewal, BC will ask them to sign in.

Option B: Do it by script
# Requires Microsoft.Graph module and appropriate permissions
Revoke-MgUserSignInSession -UserId user@domain.com
Option C: Make re-auth happen regularly (org-wide or scoped)

Conditional Access policy for Dynamics 365 Business Central:

Set Sign-in frequency (e.g., 1 hour) so users must re-enter credentials periodically.

Consider Disable persistent browser session to avoid long-lived sign-ins.

This won’t kick them out immediately, but it prevents “stay signed in forever.”

What won’t do a true sign-out

Admin Center → Cancel session (what you tried)

Any Business Central API/AL trick—there’s no “log this user out now” endpoint

Restarting the environment just drops sessions; it still isn’t a sign-out

Bottom line: Forcing a logout is handled by Entra, not Business Central. There’s no BC-native “force sign out” today, and nothing public that says it’s coming. If you want, tell me which path (A, B, or C) you’re going with and I’ll give you a quick checklist tailored to your tenant setup.

If you find this helpful please mark it as verified

Was this reply helpful? Yes No
Suggested answer

YUN ZHU 101,995 Super User 2026 Season 1 on at

Like (4)

Report
Copy link

Link copied!

But even if you sign out the user, he can just log in again. What's the difference between this and a direct refresh session?

If you don't want this user to log in, block sign-in, or remove their BC license.

Hope this helps.

Thanks.

ZHU

Was this reply helpful? Yes No
Suggested answer

Khushbu Rajvi. 22,792 Super User 2026 Season 1 on at

Like (5)

Report
Copy link

Link copied!

There’s currently no way to force a true “sign-out” of a user in Business Central (SaaS). The “Cancel Session” button in the Admin Center only terminates the active session at the Business Central service level.

Was this reply helpful? Yes No
Suggested answer

Jeffrey Bulanadi 9,128 Super User 2026 Season 1 on at

Like (3)

Report
Copy link

Link copied!
Hi,

The Cancel Session feature in BC Admin Center only pauses the session. The user receives a message prompting them to refresh, and once they do, their session resumes without re-authentication. This behavior is intentional and tied to Azure AD token management, which BC inherits as part of its SaaS architecture.

Lemme explain you in 4 sections,

1. Why Forced Sign-Out Isn’t Available

BC uses Azure Active Directory (Entra ID) for authentication.

Once a user is authenticated, their access token remains valid until it expires or is revoked.

The Cancel Session action only interrupts the current session, not the token itself.

There is no AL event or API endpoint that can invalidate a user’s token or force re-authentication.

2. How to Force Sign-Out

To fully sign out a user, you must use the Microsoft 365 Admin Center:

Go to Users > Active Users

Select the user

Choose Sign out of all sessions

This revokes all active tokens and forces the user to log in again across all Microsoft 365 services, including BC

3. Workaround Options

If you need to block access temporarily:

Remove or restrict permissions in BC

Disable the user in Azure AD

Configure conditional access policies to enforce re-authentication or session limits

These are indirect methods but can be used to meet specific security or compliance needs.

4. Is This Limitation Permanent?

As of October 2025, there is no roadmap feature for forced logout within BC itself.

Microsoft’s design philosophy favors centralized identity control via Azure AD.

Any future enhancements would likely be tied to Entra ID session governance, not BC-specific logic.

Helpful Reference
Managing Sessions in BC – Microsoft Learn
How to sign out a Microsoft 365 user from all devices from a single location

If you find this helpful, feel free to mark this as the suggested or verified answer.

Cheers
Jeffrey

1 people found this reply helpful.

Was this reply helpful? Yes No
Suggested answer

Valentin Castravet 32,800 Super User 2026 Season 1 on at

Like (3)

Report
Copy link

Link copied!

Our client’s requirement is to forcefully sign out a user (so they must log in again), not just pause the session.

But why? Each Business Central user should already be signed in on their own computer, so what’s the point of making them log in again? Are they using a shared computer where multiple users log in?

Valentin Castravet
Work: Zander ERP Services
Blog: Dynamics 365 Business Central Insights
LinkedIn: www.linkedin.com/in/valentin-c-0500a247/

Was this reply helpful? Yes No
Suggested answer

Rishabh Kanaskar 6,231 Super User 2026 Season 1 on at

Like (1)

Report
Copy link

Link copied!

Hi,

There is currently no built-in way in Business Central to forcefully sign out a user. The "Cancel Session" option in the Admin Center only pauses the session. Users can refresh and continue working.

This behavior is by design. Business Central relies on Azure AD tokens for authentication, and session control is managed at the Microsoft 365 level. To truly sign out a user, you must use the Microsoft 365 Admin Center and select "Sign out from all sessions" for that user. There are no AL code or Business Central API options available to enforce logout.

Refer to this: How can you immediately Logout a user forcibly from Dynamics 365

Thanks

Rishabh

Was this reply helpful? Yes No
Suggested answer

Jainam M. Kothari 17,024 Super User 2026 Season 1 on at

Like (1)

Report
Copy link

Link copied!

Hello,

In the Business Central Admin Center, under Environments → Manage Sessions, administrators can cancel active user sessions, which results in a message on the user's screen stating, "We paused while you were away. Please refresh to continue."

However, this action merely pauses the session, allowing the user to resume work by simply refreshing the page.

The client’s requirement is to forcefully sign out users, requiring them to log in again, which is not currently achievable through the Admin Center, APIs, or AL code.

This appears to be a limitation by design, and the user is inquiring whether Microsoft has any plans to enhance session management capabilities to support forced logouts in future updates

Was this reply helpful? Yes No