Disable Account [FIX-9000]

The account object is not deleted; it is blocked. The action is reversible: an administrator can re-enable the account from the Entra admin center once the incident is resolved.

Rationale

When an account is confirmed compromised, the priority is to remove the attacker's access immediately. Disabling the account blocks all future sign-ins, while the accompanying session revocation resets refreshTokensValidFromDateTime so existing refresh tokens can no longer be exchanged for new access tokens. Together these close both the front door (new logins) and the side door (active sessions) in a single step.

Disabling is preferable to deletion during active incident response. It instantly neutralises the account while preserving the object, its group memberships, mailbox, and audit history for investigation. If analysis shows the account is legitimate, it can be re-enabled without data loss; if the account is confirmed malicious or no longer needed, it can be removed later as a deliberate, separate decision.

This remediation calls Microsoft Graph to PATCH accountEnabled = false, reads the user back to confirm the change, and POSTs to revokeSignInSessions. It requires the User.EnableDisableAccount.All and User.RevokeSessions.All permissions (or User.ReadWrite.All) on the Attic application; acting on accounts that hold an administrative role additionally requires a sufficiently privileged directory role.

Fix

An automated fix is available through Attic.

Manual steps:

1. Navigate to the Entra ID portal at https://entra.microsoft.com
2. Go to Users > All users
3. Search for and select the user account to disable
4. Click Revoke sessions to sign the user out of all devices
5. Under the user's profile, set Block sign-in to Yes
6. Click Save

Impact

• The user can no longer sign in to any Microsoft 365 service.
• All refresh tokens issued before the action are invalidated; existing access tokens expire within their lifetime (typically up to one hour).
• The account object, mailbox, group memberships, and history are preserved.
• The action is reversible: re-enable the account from the Entra admin center when appropriate.
• For a synced (hybrid) account, the enabled state is mastered on-premises and may be overwritten on the next sync; disable it in on-premises Active Directory as well.

Revert

Re-enabling the account restores sign-in; no re-registration or data recovery is needed.

1. Navigate to the Entra ID portal at https://entra.microsoft.com
2. Go to Users > All users and select the account
3. Set Block sign-in to No and click Save
4. Have the user sign in to confirm access is restored

For a synced (hybrid) account, re-enable it in on-premises Active Directory instead and wait for the next sync; a cloud-side change is overwritten.

Revoked sessions are not restored and do not need to be. The user simply signs in again.

More Information

• Microsoft Graph: update user
• Microsoft Graph: revokeSignInSessions
• Microsoft: Respond to a compromised account