In your admin portal, navigate to Access/Users. select the specific user, and select REVOKE SESSIONS. Their sessions will sign out immediately (in some cases tokens may take 10 minutes to timeout if there is a cache).