Skip to content

Commit 875aa33

Browse files
Stacyrch140Stacyrch140
authored
Merge branch 'main' into docs-editor/protect-azure-1777550528
2 parents 2af0932 + 5f64e56 commit 875aa33

7 files changed

Lines changed: 210 additions & 111 deletions

File tree

‎defender-for-identity/entity-tags.md‎

Lines changed: 55 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -76,6 +76,61 @@ In addition to these groups, Defender for Identity identifies the following high
7676
- DHCP Server
7777
- DNS Server
7878
- Microsoft Exchange Server
79+
- Replicating Directory Changes Permissions
80+
81+
## Defender for Identity Integrations
82+
83+
The following roles are designated as Sensitive by Microsoft Defender for Identity. Any entity assigned membership in these roles is automatically classified as sensitive.
84+
85+
### Okta
86+
87+
- Super Administrator
88+
- Application Administrator
89+
- Group Administrator
90+
- API Access Management Administrator
91+
- Group Membership Administrator
92+
- Help Desk Administrator
93+
- Mobile Administrator
94+
- Organization Administrator
95+
- Read-only Administrator
96+
- Report Administrator
97+
98+
### CyberArk
99+
100+
- Administration Role
101+
- Cloud Onboarding Admin
102+
- Connector Management Admin
103+
- Flows Admin
104+
- Privilege Cloud Administrators
105+
- Privilege Cloud Administrators Basic
106+
- Privilege Cloud Administrators Lite
107+
- Privilege Cloud Safe Managers
108+
- Privilege Cloud Safe Managers Basic
109+
- Privilege Cloud Safe Managers Lite
110+
- Privilege Cloud Session Admin
111+
- Privilege Cloud Session Risk Managers
112+
- System Administrator
113+
114+
### SailPoint
115+
116+
#### Entra Id Roles
117+
- Global Administrator
118+
- User Administrator
119+
- Authentication Administrator
120+
- Privileged Authentication Administrator
121+
- Helpdesk Administrator
122+
- Agent ID Administrator
123+
- Application Administrator
124+
- Directory Writers
125+
- Domain Name Administrator
126+
- Password Administrator
127+
- Privileged Role Administrator
128+
- Hybrid Identity Administrator
129+
- Cloud Application Administrator
130+
131+
#### SailPoint Roles
132+
133+
- IdentityNow Administrator
79134

80135

81136
## Related content

‎defender-for-identity/remediation-actions.md‎

Lines changed: 65 additions & 33 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
---
22
title: Remediation actions
33
description: Learn how to respond to compromised users with remediation actions in Microsoft Defender for Identity
4-
ms.date: 08/28/2023
4+
ms.date: 03/05/2026
55
ms.topic: how-to
66
---
77

@@ -16,57 +16,89 @@ Microsoft Defender for Identity allows you to respond to compromised users by di
1616

1717
The response actions on users are available directly from the user page, the user side panel, the advanced hunting page, or in the action center.
1818

19-
Watch the following video to learn more about remediation actions in Defender for Identity:
19+
## How remediation actions work
2020

21-
<br>
21+
Remediation actions are initiated by a user in the Microsoft Defender portal and are authorized using role-based access control (RBAC) based on Microsoft Entra ID roles. If the initiating user isn’t authorized, the action is blocked before execution.
2222

23-
> [!VIDEO https://www.youtube.com/embed/tpTJiJCgdck?si=prONSe2wj_KZBcKl]
23+
After authorization, the action is executed by the identity system that manages the affected account:
2424

25+
- **Active Directory**
26+
Actions are executed by the Microsoft Defender for Identity sensor on the domain controller. The sensor impersonates the **LocalSystem** account to perform the action.
2527

26-
## Prerequisites
28+
- **Microsoft Entra ID**
29+
Microsoft Defender for Identity creates and uses a Microsoft‑managed enterprise application to execute remediation actions in Entra ID.
30+
- **Application name:** *Microsoft Defender for Identity*. In older tenants, the application might appear with the name *Radius Aad Syncer*.
31+
- **Application ID:** `60ca1954-583c-4d1f-86de-39d835f3e452`
2732

28-
To perform any of the [supported actions](#supported-actions), you need to:
33+
- **Supported non‑Microsoft identity providers (IdPs)**
34+
Actions are executed using the source IdP’s APIs based on the credentials configured for the integration.
2935

30-
- Configure the account that Microsoft Defender for Identity will use to perform them. By default, the Microsoft Defender for Identity sensor installed on a domain controller will impersonate the *LocalSystem* account of the domain controller and perform the above actions. However, you can change this default behavior by [setting up a gMSA account](manage-action-accounts.md) and scope the permissions as you need.
36+
Remediation actions are recorded by the identity system where the action is executed and are visible in Microsoft Defender audit logs.
3137

32-
- Be signed into Microsoft Defender XDR to with relevant permissions. For Defender for Identity actions, you'll need a custom role with **Response (manage)** permissions. For more information, see [Create custom roles with Microsoft Defender unified RBAC](/microsoft-365/security/defender/create-custom-rbac-roles).
38+
## Remediation actions in Automatic Attack Disruption
39+
40+
Remediation actions can also be applied automatically by Microsoft Defender's automatic attack disruption. When an active attack is detected, attack disruption uses Defender for Identity remediation capabilities to contain the threat without manual intervention. For details, see [automatic attack disruption](/defender-xdr/automatic-attack-disruption).
3341

3442
## Supported actions
3543

36-
The following Defender for Identity actions can be performed on Identities:
44+
The following Defender for Identity actions can be performed on Identities.
3745

38-
| Remediation Action | Description | Scope |
39-
| ------------------------------------- | ------------------------------------------------------------ | ------------------------------------------------------------ |
40-
|Disable | You can choose to disable **all accounts linked to an identity** or **only one of them**. Disabling an identity prevents sign-in and access to network resources until the accounts are re-enabled. This action doesn’t delete the identity profile or associated data such as documents, calendar events, or email messages. | Active Directory, Microsoft Entra ID, and Okta
41-
|Enable | Re-enables accounts that were previously disabled for the selected identity. | Active Directory, Microsoft Entra ID, and Okta
42-
|Revoke session | Revoke an identity's active session. | Microsoft Entra ID and Okta
43-
|Mark as compromised | Marks all accounts linked to the selected identity as compromised in Microsoft Entra ID. | Microsoft Entra ID
44-
|Force password change| Force a password change for one or more accounts linked to the selected identity. This prompts the identity to change their password on the next logon, ensuring that this account can't be used for further impersonation attempts.| Active Directory
45-
|Deactivate | This action can be used when a non-legit malicious account was detected, to deactivate the account permanently | Okta
46-
|Set account risk to High/Medium/Low |Set account risk scoring to one of the defined levels. This action is only available if [Risk Scoring](https://help.okta.com/en-us/Content/Topics/Security/Security_Risk_Scoring.htm) feature is enabled | Okta
46+
Depending on your Microsoft Entra ID roles, you might see additional Microsoft Entra ID actions, such as requiring users to sign in again and confirming a user as compromised. For more information, see [Remediate risks and unblock users](/entra/id-protection/howto-identity-protection-remediate-unblock).
4747

48+
| Remediation Action | Description | Supported Identity systems |
49+
| ------------------ | ----------- | ------ |
50+
| Disable | Disables all accounts linked to an identity or a specific account. Disabling prevents sign-in and access to network resources until the accounts are re-enabled. This action doesn't delete the identity profile or associated data such as documents, calendar events, or email messages. | <ul><li>Active Directory</li><li>Microsoft Entra ID</li><li>Okta</li></ul> |
51+
| Enable | Re-enables accounts that were previously disabled for the selected identity. | <ul><li>Active Directory</li><li>Microsoft Entra ID</li><li>Okta</li></ul> |
52+
| Revoke session | Revokes active sessions for the selected identity. | <ul><li>Microsoft Entra ID</li><li>Okta</li></ul> |
53+
| Mark as compromised | Marks all accounts linked to the selected identity as compromised in Microsoft Entra ID. | Microsoft Entra ID |
54+
| Force password change | Forces a password change for one or more accounts linked to the selected identity. The user must change their password at next sign-in, which prevents further use of compromised credentials. | Active Directory |
55+
| Deactivate | Permanently deactivates a non-legitimate malicious account. | Okta |
56+
| Set account risk to High/Medium/Low | Sets account risk scoring to one of the defined levels. Available only when the [Risk Scoring](https://help.okta.com/en-us/Content/Topics/Security/Security_Risk_Scoring.htm) feature is enabled in Okta. | Okta |
57+
58+
## Roles and permissions
59+
60+
This table lists the remediation actions supported by Defender for Identity and the roles required to initiate each action.
61+
62+
| Remediation Action | Active Directory |Microsoft Entra ID | Okta |
63+
| ---- | ---- | ---- | ---- |
64+
| Disable | See [Required permissions Defender for Identity in Microsoft Defender XDR](/defender-for-identity/role-groups#required-permissions-defender-for-identity-in-microsoft-defender-xdr) | <ul><li>Global Administrator</li><li>User Administrator</li><li>Authentication Administrator</li><li>Privileged Authentication Administrator</li><li>Directory Writers</li></ul> | A custom role defined with permissions for Response (manage) or one of the following Microsoft Entra roles: <ul><li>Security Operator</li><li>Security Administrator</li><li>Global Administrator</li></ul> |
65+
| Enable | See [Required permissions Defender for Identity in Microsoft Defender XDR](/defender-for-identity/role-groups#required-permissions-defender-for-identity-in-microsoft-defender-xdr) |<ul><li>Global Administrator</li><li>User Administrator</li><li>Authentication Administrator</li><li>Privileged Authentication Administrator</li><li>Directory Writers</li></ul> | A custom role defined with permissions for Response (manage) or one of the following Microsoft Entra roles: <ul><li>Security Operator</li><li>Security Administrator</li><li>Global Administrator</li></ul> |
66+
| Revoke session | N/A |<ul><li>Global Administrator</li><li>User Administrator</li><li>Authentication Administrator</li><li>Privileged Authentication Administrator</li><li>Directory Writers</li><li>Helpdesk Administrator</li></ul> | A custom role defined with permissions for Response (manage) or one of the following Microsoft Entra roles: <ul><li>Security Operator</li><li>Security Administrator</li><li>Global Administrator</li></ul> |
67+
| Mark as compromised | N/A |<ul><li>Global Administrator</li><li>Security Administrator</li><li>Security Operator</li></ul> | N/A |
68+
| Force password change | See [Required permissions Defender for Identity in Microsoft Defender XDR](/defender-for-identity/role-groups#required-permissions-defender-for-identity-in-microsoft-defender-xdr) | N/A | N/A |
69+
| Deactivate | N/A | N/A | A custom role defined with permissions for Response (manage) or one of the following Microsoft Entra roles: <ul><li>Security Operator</li><li>Security Administrator</li><li>Global Administrator</li></ul> |
70+
| Set identity risk to High/Medium/Low | N/A | N/A | A custom role defined with permissions for Response (manage) or one of the following Microsoft Entra roles: <ul><li>Security Operator</li><li>Security Administrator</li><li>Global Administrator</li></ul> |
4871

49-
Depending on your Microsoft Entra ID roles, you might see additional Microsoft Entra ID actions, such as requiring users to sign in again and confirming a user as compromised. For more information, see [Remediate risks and unblock users](/entra/id-protection/howto-identity-protection-remediate-unblock).
72+
> [!NOTE]
73+
> There are some limitations for Microsoft Entra ID when performing certain actions on other roles. For more information, see the [Graph API documentation](/graph/api/resources/users?view=graph-rest-1.0&preserve-view=true).
5074
51-
## Roles and Permissions
75+
## Prerequisites
5276

53-
| Remediation Action | Active Directory |Microsoft Entra ID | Okta |
54-
|--|--|--|--|
55-
|Disable | Refer to [Required permissions Defender for Identity in Microsoft Defender XDR](/defender-for-identity/role-groups#required-permissions-defender-for-identity-in-microsoft-defender-xdr) | Microsoft Entra Roles: <br> - Global Administrator <br> - User Administrator <br> - Authentication Administrator <br> - Privileged Authentication Administrator <br> - Directory Writers <br> | A custom role defined with permissions for Response (manage) or one of the following Microsoft Entra roles: <br> - Security Operator <br> - Security Administrator <br> - Global Administrator |
56-
| Enable | Refer to [Required permissions Defender for Identity in Microsoft Defender XDR](/defender-for-identity/role-groups#required-permissions-defender-for-identity-in-microsoft-defender-xdr) | Microsoft Entra Roles: <br> - Global Administrator <br> - User Administrator <br> - Authentication Administrator <br> - Privileged Authentication Administrator <br> - Directory Writers <br> | A custom role defined with permissions for Response (manage) or one of the following Microsoft Entra roles: <br> - Security Operator <br> - Security Administrator <br> - Global Administrator |
57-
| Revoke session |N\A | Microsoft Entra Roles: <br> - Global Administrator <br> - User Administrator <br> - Authentication Administrator <br> - Privileged Authentication Administrator <br> - Directory Writers <br> - Helpdesk Administrator <br>| A custom role defined with permissions for Response (manage) or one of the following Microsoft Entra roles: <br> - Security Operator <br> - Security Administrator <br> - Global Administrator |
58-
| Mark as compromised |N\A | Microsoft Entra Roles: <br> - Global Administrator <br> -Security Administrator <br> - Security Operator <br> | N/A|
59-
| Force password change| Refer to [Required permissions Defender for Identity in Microsoft Defender XDR](/defender-for-identity/role-groups#required-permissions-defender-for-identity-in-microsoft-defender-xdr) | N\A | N\A
60-
| Deactivate | N\A | N\A | A custom role defined with permissions for Response (manage) or one of the following Microsoft Entra roles: <br> - Security Operator <br> - Security Administrator <br> - Global Administrator
61-
| Set identity risk to High/Medium/Low | N\A | N\A | A custom role defined with permissions for Response (manage) or One of the following Microsoft Entra roles: <br> - Security Operator <br> - Security Administrator <br> - Global Administrator
77+
To perform any of the [supported actions](#supported-actions), you need to:
6278

63-
> [!NOTE]
64-
> There are some limitations for Microsoft Entra ID when performing certain actions on other roles. For more information, see the [Graph API documentation](/graph/api/resources/users?view=graph-rest-1.0&preserve-view=true ).
79+
- **Configure the account that Microsoft Defender for Identity uses to perform actions.** By default, the Microsoft Defender for Identity sensor installed on a domain controller impersonates the **LocalSystem** account of the domain controller to perform Active Directory actions. For more information, see [Microsoft Defender for Identity action accounts](deploy/manage-action-accounts.md).
80+
- **Sign in to the Microsoft Defender portal with the required permissions.** For Defender for Identity actions, you need a custom role with **Response (Manage)** permissions. For more information, see [Create custom roles with Microsoft Defender XDR Unified RBAC](/microsoft-365/security/defender/create-custom-rbac-roles). For details on the specific roles required for each action, see [Roles and permissions](#roles-and-permissions).
81+
82+
## Apply a remediation action
83+
84+
To apply a remediation action to an identity:
85+
86+
1. In the [Microsoft Defender portal](https://security.microsoft.com), go to one of the following locations:
87+
- **Identity page**: Go to **Assets** > **Identities**, and select the identity you want to act on.
88+
- **Advanced hunting page**: Go to **Hunting** > **Advanced hunting**, and identify a result that includes an identity entity.
89+
- **Action center**: Go to **Actions & submissions** > **Action center** to review and manage pending or completed actions.
90+
91+
1. Select **Actions** or right-click the identity to open the actions menu.
92+
93+
1. Select the remediation action you want to apply, such as **Disable**, **Revoke session**, or **Force password change**.
94+
95+
1. Confirm the action when prompted.
6596

97+
The action is submitted and executed by the relevant identity system. You can track the status in the **Action center**.
6698

67-
## Related videos
99+
## Related video
68100

69-
[Remediation actions in Defender for Identity](https://learn-video.azurefd.net/vod/player?id=adc6068b-225c-457d-b053-db6b64dedb79)
101+
- [Remediation actions in Microsoft Defender for Identity](https://learn-video.azurefd.net/vod/id/adc6068b-225c-457d-b053-db6b64dedb79)
70102

71103
## See also
72104

0 commit comments

Comments
 (0)