Microsoft

Microsoft Azure Active Directory (now Microsoft Entra ID) is Microsoft's cloud-based identity and access management service that provides authentication, authorization, and directory services for Microsoft 365, Azure resources, and thousands of third-party SaaS applications. It manages billions of authentications daily across enterprise environments worldwide. 

For security response actions, Microsoft Azure/Entra ID provides extensive identity containment capabilities including disabling user accounts, forcing password changes, revoking all active sessions, confirming or dismissing user compromise status, managing inbox rules (to counter email-based persistence), performing email analysis, and looking up user details. These capabilities are critical for responding to identity-based attacks, account compromises, and business email compromise scenarios. 

Supported Response Actions: 

• Disable User
• Enable User
• Change Password
• Change Password at Next Login
• Revoke User Sessions
• Confirm User as Compromised
• Dismiss User as Compromised
• Disable Inbox Rule
• Enable Inbox Rule
• Lookup User
• Analyze Email