Revoked the M365 Session? Attackers Can Still Read Mail for 90 Minutes
Eye Security found that revoking sessions or resetting a password leaves Graph, EWS and ActiveSync mail access open for up to 90 minutes; only disabling the account cuts it off immediately.