■Solution (Graph CommandVersion)

This can be resolved by using Microsoft Graph PowerShell commands to set
the "refreshTokensValidFromDateTime" attribute for the Azure AD user.

Note: The command used to check the value of "refreshTokensValidFromDateTime" is currently provided by Microsoft only as a beta version, so the command may change in the future.

Preparation

1. After launching PowerShell with administrator privileges, run the following commands to install the Microsoft Graph PowerShell Module and the Microsoft Graph PowerShell Beta Module.
   Note: The installation may take some time.
   

   Install-Module Microsoft.Graph 

   
   

   Install-Module Microsoft.Graph.Beta 

   
2. Connect to Microsoft 365.
   

   Connect-MgGraph -Scopes "User.ReadWrite.All"

   Note: After running this command, the Microsoft 365 login screen will appear in your browser. Please log in with a Microsoft 365 Global Administrator account.
   
   
3. Retrieve the beta version of the Get-MgUser command.
   

   Get-Command Get-MgBetaUser

   

Individual Configuration (When fixing a specific user individually)

1. Check whether the value of the target user's refreshTokensValidFromDateTime attribute is blank.
   

   Get-MgBetaUser -UserId "UPN of user" | select-object UserPrincipalName, refreshTokensValidFromDateTime

   
2. For users whose refreshTokensValidFromDateTime attribute is blank, set the attribute.
   

   Revoke-MgUserSignInSession -UserId "UPN of user"

   
   
   
3. Check that a value has been set for the target user's refreshTokensValidFromDateTime attribute.
   

   Get-MgBetaUser -UserId "UPN of user" | select-object UserPrincipalName, refreshTokensValidFromDateTime

   
4. Disconnect from Microsoft 365.
   

   Disconnect-MgGraph

Bulk Configuration (When fixing multiple users in a domain at once)

1. Display the list of users and extract the accounts whose refreshTokensValidFromDateTime attribute is blank.
   Note: Users whose refreshTokensValidFromDateTime attribute already has a value are not displayed.
   

   Get-MgBetaUser -All | where{ $_.refreshTokensValidFromDateTime -eq $null }

   
   Note: If no target users exist, bulk configuration is not needed, so disconnect from Microsoft 365 using the method described in step 4.
   Note: If you want to target only users in a specific domain, change the "*@example.com" portion to your specific domain and run the command below.
   

   Get-MgBetaUser -All | where{ $_.refreshTokensValidFromDateTime -eq $null } | where{ $_.UserPrincipalName -like ( "*@example.com" ) }

2. Set the value for each user whose refreshTokensValidFromDateTime attribute is blank.
   Note: A "True" response will be displayed on screen for each target user
   

   foreach($user in Get-MgBetaUser -All | where{ $_.refreshTokensValidFromDateTime -eq $null }){Revoke-MgUserSignInSession -UserId $user.id}

   Note: If you want to target only users in a specific domain, run the following command.
   

   foreach($user in Get-MgBetaUser -All | where{ $_.refreshTokensValidFromDateTime -eq $null } | where{ $_.UserPrincipalName -like ( "*@example.com" ) }){Revoke-MgUserSignInSession -UserId $user.id}

3. Check that users whose refreshTokensValidFromDateTime attribute now has a value are no longer displayed in the list.
   

   Get-MgBetaUser -All  | where{ $_.refreshTokensValidFromDateTime -eq $null }

4. Disconnect from Microsoft 365.
   

   Disconnect-MgGraph

■Additional Notes　

• If an error occurs when running a command
  

  Please try reinstalling the Microsoft Graph and Microsoft Graph.Beta modules.
  Note: If running the following uninstall commands could affect your environment, please refrain from running them.

  Uninstall-Module -Name Microsoft.Graph -AllVersions

  Uninstall-Module -Name Microsoft.Graph.Beta -AllVersions