Session revocation
Session revocation ends a user's active sessions and invalidates refresh or access tokens, so a stolen session stops working. Disabling an account alone does not do this, because existing tokens can stay valid. It is a core identity containment action and often paired with a password reset.
Definition
Token theft makes session revocation the right first move for many cloud account compromises. It is less disruptive than disabling the account.
Platforms differ on whether they can revoke in the identity provider, in a cloud provider or both. The scorecard counts the identity and cloud versions as separate actions.
Session revocation in Tines's documentation
Tines publishes a Microsoft Graph template that revokes a user's sign-in sessions and an Okta template that ends a current user session, both as pre-built actions. vendor claim tines.com, read
The example names a vendor and its own page. A vendor's use of Session revocation may differ from the definition above; the rubric uses the definition on this page.