SOLVED

Microsoft Defender for Identity: Native "response" actions

%3CLINGO-SUB%20id%3D%22lingo-sub-3074090%22%20slang%3D%22de-DE%22%3EMicrosoft%20Defender%20for%20Identity%3A%20Native%20%22response%22%20actions%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-3074090%22%20slang%3D%22de-DE%22%3E%3CP%3EHi%20all%2C%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EI've%20found%20the%20following%20Feature%20on%20the%20Roadmap%20which%20is%20acutally%20GA%3A%3C%2FP%3E%3CTABLE%3E%3CTBODY%3E%3CTR%3E%3CTD%3E%3CDIV%20class%3D%22%22%3E%3CP%20class%3D%22%22%3EMicrosoft%20Defender%20for%20Identity%3A%20Native%20%22response%22%20actions%3C%2FP%3E%3C%2FDIV%3E%3C%2FTD%3E%3CTD%3E%26nbsp%3B%3C%2FTD%3E%3C%2FTR%3E%3C%2FTBODY%3E%3C%2FTABLE%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Fwww.microsoft.com%2Fde-de%2Fmicrosoft-365%2Froadmap%3Ffilters%3D%26amp%3Bsearchterms%3D82077%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noreferrer%22%3Ehttps%3A%2F%2Fwww.microsoft.com%2Fde-de%2Fmicrosoft-365%2Froadmap%3Ffilters%3D%26amp%3Bsearchterms%3D82077%3C%2FA%3E%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EUnfortunately%20I%20cannot%20find%20any%20Documentation%20etc.%20how%20to%20configure%20this%20%2F%20get%20use%20of%20this%20Feature.%20I%20would%20really%20like%20to%20have%20the%20Option%20to%20automatically%20disable%20a%20AD%20User%20when%20AATP%20discover%20some%20really%20weird%20things%20on%20the%20Account.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EHope%20you%20can%20help%20me%20out.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3ERegards%2C%3C%2FP%3E%3CP%3EPi%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-3074154%22%20slang%3D%22en-US%22%3ERe%3A%20Microsoft%20Defender%20for%20Identity%3A%20Native%20%22response%22%20actions%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-3074154%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F1289007%22%20target%3D%22_blank%22%3E%40Magenta365%3C%2FA%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EThe%20feature%20is%20not%20GA%20just%20yet.%20It%20will%20be%20in%20a%20couple%20of%20weeks.%3C%2FP%3E%0A%3CP%3EWe'll%20update%20the%20roadmap%20to%20reflect%20that.%26nbsp%3B%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F40087%22%20target%3D%22_blank%22%3E%40Ricky%20Simpson%3C%2FA%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EFor%20now%2C%20you%20can%20go%20ahead%20and%20configure%20the%20gMSA%20with%20the%20proper%20permissions%20to%20take%20those%20actions%2C%20as%20described%20in%26nbsp%3B%3CA%20href%3D%22https%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Fdefender-for-identity%2Fmanage-action-accounts%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noreferrer%22%3EManage%20action%20accounts%20%7C%20Microsoft%20Docs%3C%2FA%3E%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-3074211%22%20slang%3D%22en-US%22%3ERe%3A%20Microsoft%20Defender%20for%20Identity%3A%20Native%20%22response%22%20actions%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-3074211%22%20slang%3D%22en-US%22%3EThanks%20Martin.%20I'll%20look%20to%20update%20this%20item%20ASAP.%3C%2FLINGO-BODY%3E
New Contributor

Hi all,

 

I've found the following Feature on the Roadmap which is acutally GA:

Microsoft Defender for Identity: Native "response" actions

 

https://www.microsoft.com/de-de/microsoft-365/roadmap?filters=&searchterms=82077

 

Unfortunately I cannot find any Documentation etc. how to configure this / get use of this Feature. I would really like to have the Option to automatically disable a AD User when AATP discover some really weird things on the Account.

 

Hope you can help me out.

 

Regards,

Pi

 

4 Replies
best response confirmed by Magenta365 (New Contributor)
Solution

@Magenta365 

 

The feature is not GA just yet. It will be in a couple of weeks.

We'll update the roadmap to reflect that. @Ricky Simpson 

 

For now, you can go ahead and configure the gMSA with the proper permissions to take those actions, as described in Manage action accounts | Microsoft Docs

Thanks Martin. I'll look to update this item ASAP.
Thanks for the speedy Response !