Create workflow for compromised users in Azure AD

Question

Hi,&nbsp;I work in a small security team, and we don't have 24/7 till now, so I would like to find a way to lock users which are High Risk users.By now we get an email alert of those.What I would like to know is if I can create any kind of workflow that whenever a user has a High Risk, sends the email and locks the user on Active Directory, until a team member will be able to check it manually.&nbsp;Is there any way to achieve it considering we don't have yet Sentinel (neither we can right now).&nbsp;Thanks

dean_gross · Answer

you use this https://docs.microsoft.com/en-us/azure/active-directory/authentication/tutorial-risk-based-sspr-mfa#:~:text=These%20policies%20work%20with%20existing%20Azure%20AD%20Conditional,an%20attempt%20to%20compromise%20your%20security%20is%20made.

pvanberlo · Answer

With ‘high risk’ I assume you’re referring to the user or sign-in risk of a user? Locking the account itself is not an option out of the box, but you can use Azure AD conditional access to block access until the user self remediates this. If you really would like to block sign in for such users you can either use a PowerShell script that runs regularly or when you do have Sentinel in place use a playbook for this.

christianjbergstrom · Answer

dmarquesgn&nbsp;What subscription do you have? I may state the obvious here but have you looked at AAD Identity Protection?
&nbsp;
How To: Configure and enable risk policies
&nbsp;
License requirements
&nbsp;
Azure AD Identity Protection policies | Microsoft Docs

Forum Discussion

Create workflow for compromised users in Azure AD

Share

Resources