Compromised account - killed sessions in Entra but user still had active access in AWS and Slack

Suspicious login alert. Killed all sessions in Entra. Checked and they showed terminated. Same account was still active in AWS and Slack ten minutes later pulling data.

Entra only kills Microsoft sessions. AWS keeps its own session tokens that don't care if you revoke at the IdP. Slack has separate session management. Each platform that uses SSO maintains independent sessions that live past IdP revocation. Had to get into AWS console and manually force logout. Then Slack admin panel. Then remember what else they might be logged into. Took me probably 30 minutes going through different systems while the attacker was downloading stuff from S3. No way to hit one button and kill every session everywhere. Just separate admin tools where you're guessing at what's still active and hoping you didn't miss one.