Found this content helpful? Log in or sign up to leave a like!

Revoke Token Access on Suspended Accounts

Jump to solution
Steve_McKay
Community Member

I need some clarification on the status of access tokens if an account is suspended and all associated user sessions are terminated.

The info here is not clear and seems to say that even if an account is suspended, and all user sessions terminated, that access tokens have to be manually removed from the user's approved integrations to cease token access - https://community.canvaslms.com/t5/Admin-Guide/How-do-I-suspend-or-reactivate-users-in-an-account/ta...

However the API info on "Terminate all user sessions" here states that invoking it "Terminates all sessions for a user. This includes all browser-based sessions and all access tokens, including manually generated ones" - https://canvas.instructure.com/doc/api/all_resources.html#method.users.terminate_sessions

Will suspending an account and terminating all associated user sessions revoke all token access to the account's data going forward?

Labels (1)
0 Likes
1 Solution
chriscas
Community Coach
Community Coach

Hi @Steve_McKay,

As far as I know, suspending the account and terminating the user sessions should do the trick to remove any access the user had to Canvas.

-Chris

View solution in original post