Blog Post

Microsoft Sentinel Blog
6 MIN READ

Automatically disable On-prem AD User using a Playbook triggered in Azure

Inwafula's avatar
Inwafula
Icon for Microsoft rankMicrosoft
Feb 09, 2021
Many organizations have an on-premises Active Directory infrastructure that is synced to Azure AD in the cloud. However, given that the on-prem side is the authoritative source of truth, any changes,...
Updated Nov 01, 2021
Version 3.0
Inwafula's avatar
Icon for Microsoft rankMicrosoft
Joined November 11, 2017
View Profile
Microsoft Sentinel Blog

Microsoft Sentinel is a cloud-native SIEM, enriched with AI and automation to provide expansive visibility across your digital environment.

Dhaval Shastri's avatar
Dhaval Shastri
Copper Contributor
Apr 28, 2021

Hello

 

Do you have the following information

 

" Parse the JSON output from the Entities-Get Actions step above to extract the Azure User ID and SAM Account name needed to perform disable operations-first on Azure then on the On-Prem Active directory."   The picture is little blurry and I cant see the information.