Forum Discussion
Defender Confirm User Compromised
Triggering the "Confirm User Compromised" selection on Defender XDR after an Alert and Investigation has limited guidance. Can someone help point me at the documentation of what is triggered, how ca...
I had assumed and am still blown away that "Confirm user compromised" does not already automatically revoke refresh tokens / log off all sessions. Seems like a no brainer, yet my assumption was my own weakness. Had a colleague call me out on the incorrect assumption, thankfully.
I created a feedback post for this.
https://feedbackportal.microsoft.com/feedback/idea/75b8849b-d633-ef11-a296-000d3a044d12
https://feedbackportal.microsoft.com/feedback/idea/75b8849b-d633-ef11-a296-000d3a044d12