Mark every active session whose expiry time has passed as expired using one EF Core database command.

• Capture now once before building the query.
• Pass cancellation to ExecuteUpdateAsync.
• Do not rely on tracked instances being refreshed automatically.
• Keep the predicate idempotent so rerunning affects zero rows.

I express both the target set and assigned values in the database command. ExecuteUpdateAsync bypasses entity materialization, change detection, and SaveChanges. That is ideal for a set-based maintenance operation, but any matching entities already tracked in the same context become stale.

public static Task<int> ExpireSessionsAsync(
    AppDbContext db,
    DateTimeOffset now,
    CancellationToken cancellationToken)
{
    return db.Sessions
        .Where(session =>
            !session.IsExpired &&
            session.ExpiresAtUtc <= now)
        .ExecuteUpdateAsync(
            setters => setters
                .SetProperty(session => session.IsExpired, true)
                .SetProperty(session => session.ExpiredAtUtc, now),
            cancellationToken);
}

The provider emits one conditional UPDATE and returns the affected-row count. An index supporting active sessions by expiry can reduce the scanned set. Entity interceptors and per-entity domain methods do not run, so this technique belongs only where set-based semantics are intentional.

• No sessions qualify.
• A session expires exactly at now.
• The context already tracks a qualifying session.
• The operation is cancelled before completion.

• Run the operation twice and expect the second count to be zero.
• Verify one SQL command is issued.
• Check that future and already-expired rows stay unchanged.
• Test any required audit behavior explicitly because entity callbacks are bypassed.

• Loading every session and updating in a loop.
• Calling SaveChangesAsync as if ExecuteUpdate used the tracker.
• Continuing to trust stale tracked instances.
• Using a bulk update when domain events or per-row rules must execute.