Sentinel Playbook: Lock suspicious User Account

[KBraun94]

Hello toghether, 

I hope somebody had the same Use case. 
In Sentinel I like to run an Playbook which lock an User in the Azure (Cloud) and on Prem (AD), after an Analytic rule has triggerd / found suspicious activity. 

Best regards 
Kevin

[#2]

Hello,

There is a block user (Entra) example https://github.com/Azure/Azure-Sentinel/tree/3a2c56770d6dcf43028d34c90ae5d00a92200942/Solutions/Micr...

Here is another example: https://github.com/Azure/Azure-Sentinel/tree/3a2c56770d6dcf43028d34c90ae5d00a92200942/Playbooks/Bloc...

Searching for keywords like "lock" in the Github may help you find more, example: https://github.com/search?q=repo%3AAzure%2FAzure-Sentinel%20lock&type=code

[#3]

Hi,

You can also revoke the user session using this new way using a logic app:

https://techcommunity.microsoft.com/t5/azure-integration-services-blog/using-logic-app-to-revoke-sig...