Google does seem to implement access token revocation, something Microsoft doesn’t.
Also Microsoft access token validity goes down to 10 minutes but I’m not sure what the length is per-app.
But Google doesn’t support access token revocation for JWT-based access tokens, same as Microsoft. I assume GMail doesn’t use JWTs since there aren’t complex access rules for email (or if there are it isn’t common).
I can't speak for their back-end. I wanted to test but I'll need to jump through a hoop first since it seems to be grouping "devices" by IP/location, this didn't use to happen ...
Comments
Also Microsoft access token validity goes down to 10 minutes but I’m not sure what the length is per-app.
https://learn.microsoft.com/en-us/entra/identity-platform/configurable-token-lifetimes#access-id-and-saml2-token-lifetime-policy-properties
https://cloud.google.com/apigee/docs/api-platform/security/oauth/using-jwt-oauth#usage-notes
Though maybe Google rejects QUIC session resumptions from different world regions.
Microsoft, lets you adjust the duration of tokens, but cannot instantly invalidate them once issued.