Can you explain more about the application used to perform attack disruption? Think it's called Radius Aad Syncer or Defender for Identity. It's slightly confusing because companies that don't have MDI deployed will still see an app named as MDI. What is the right workflow here? Attack disruption attempts to disable a user but due to no MDI, it fails. However Attack disruption is able to force user out of sessions and also mark them as compromised in entra id. It's a bit of a confusing experience.