Best practice: How to kick newly blocked users out of active sessions

Thanks for the reply. Is there a similar process for getting latest app_metadata? Or do we need to rely on regular API hits for that?