Disable Device [FIX-9009]

The target may be supplied as the device object id, the deviceId GUID, or the device displayName; sign-in and audit logs typically carry the deviceId and display name rather than the directory object id, so all three are accepted. Because a display name is not unique, a name that matches more than one device is refused and the matching devices are returned so you can re-run against a precise id. This acts on the Entra directory device object, not the Intune managed device.

Rationale

Registering or joining a device is a recognised persistence technique (MITRE ATT&CK T1098.005 – Account Manipulation: Device Registration). After compromising an account, an attacker can register their own device with the tenant; a registered or hybrid-joined device can then satisfy device-based Conditional Access controls and obtain a Primary Refresh Token, giving the adversary ongoing, trusted access that survives password resets. Because the device looks like a normal corporate endpoint, this persistence is easy to overlook.

Disabling the device blocks it from being used as a trusted sign-in artifact while keeping the object intact for investigation. Disable, rather than delete, is the safer default during incident response: it immediately removes the device's usefulness to the attacker, but if analysis shows the device is in fact a legitimate user endpoint, it can be re-enabled with no re-registration required. Reserve permanent deletion for devices that are confirmed malicious.

This remediation resolves the target to a device object, issues a PATCH setting accountEnabled = false on Microsoft Graph, and verifies the change. It requires the Device.ReadWrite.All permission on the Attic application; a Cloud Device Administrator (or equivalent) role is needed for delegated use.

Fix

An automated fix is available through Attic.

Manual steps:

1. Navigate to the Entra ID portal at https://entra.microsoft.com
2. Go to Devices > All devices
3. Search for and select the affected device
4. Click Disable and confirm
5. Verify the device now shows as disabled (re-enable later if it proves legitimate)

Impact

• The device's accountEnabled is set to false and it can no longer be used to satisfy device-based Conditional Access or as a trusted sign-in artifact.
• The action is reversible; the device object is preserved and can be re-enabled.
• The device is not deleted; its directory record, group memberships, and registration remain for investigation.
• If a display name matches more than one device, no change is made and the candidate object ids and deviceIds are returned so you can re-run against the correct one.
• This does not affect the Intune managed-device record; remove that separately if required.

Revert

Re-enabling the device restores it as a trusted sign-in artifact. The object was never deleted, so no re-registration or re-join is required.

1. Navigate to the Entra ID portal at https://entra.microsoft.com
2. Go to Devices > All devices
3. Search for the device by name or device id and select it
4. Click Enable and confirm
5. Verify the device shows as enabled, and have the user sign in from it to confirm device-based Conditional Access passes again

The same change can be made through Microsoft Graph by setting accountEnabled back to true on the device object.

A device that was deleted rather than disabled cannot be restored this way; it has to be re-registered or re-joined from the device itself.

More Information

• Microsoft Graph: update device
• MITRE ATT&CK T1098.005 – Account Manipulation: Device Registration
• Microsoft: Device identity and Conditional Access
• Microsoft: Primary Refresh Token (PRT)