Azure Cloud Direct: Disable Accounts

This guide helps you set up your Azure Cloud Direct device and grant necessary permissions so that you can enable the Disable Accounts auto remediation in Workbench.

This guide is the first step of a larger process to enable auto remediations. After completing the steps on this page, you will be instructed to return to the Enable an Auto Remediation in Workbench guide to finish your setup.

How It Works

If our SOC identifies an account (username or email address) that is compromised and must be disabled, Workbench completes the action automatically and logs the user out of their session. You have the option to restrict these actions to specific accounts by configuring an allow or deny list (the accounts must first be added as context, and then the list can be configured in Workbench; see Step 2).

Some vendors refer to disabling a user account as blocking a user, suspending a user, changing user status, removing a user from the org, or locking a user account.

Endpoints Used

Microsoft Graph API

requires User.ReadWrite.All, always targets the global graph.microsoft.com host

Method	Endpoint	Purpose
GET	v1.0/users/{userid}	Get user details; see if account is enabled for the pre-check
PATCH	v1.0/users/{userid}	Disable the account
POST	v1.0/users/{userid}/revokeSignInSessions	Revoke all sign-in sessions
POST	beta/users/{userid}/invalidateAllRefreshTokens	Revoke all refresh tokens

Scope and Limitations

When choosing to enable this auto remediation, remember the following:

• After a previously logged-in account is disabled, it can still access some resources until the access token expires and requires re-authentication. Default expiration is 60 to 90 minutes after the disabling; as a result, it is possible for a user to remain logged in and to access some of the resources for up to 90 minutes after an account is disabled.
• This auto remediation will not work on admin user accounts, or on any user who is assigned a privileged directory-level role or a privileged read-only role.
• While an account is disabled, the admin or user cannot reset the password. After the account is re-enabled, the account must be reset manually.

Prerequisites

1. You must be an Azure admin for your organization, as you must have the ability to grant app permissions and add assignments.
2. You must have admin access in Workbench, as auto remediations are enabled at the organization level.

Step 1: Grant Necessary Permissions

The option you choose in this section depends on how you initially onboarded your Azure Cloud device in Workbench.

• If you chose to enable the Azure Enterprise application, follow Option 1.
• If you chose to create a custom Microsoft Entra ID application, follow Option 2.

Option 1 (Azure Enterprise Applications)

New installation

No changes are required.

Existing installation

1. Navigate to the Expel Azure Integration > API Permissions.
2. Select the Grant admin consent button.
3. Consent to the new API permissions.

Option 2 (Microsoft Entra ID Applications)

New and existing installations

1. Follow all previous API permission steps for Option 2: Create Custom Microsoft Entra ID Application in Azure Cloud (Direct) Setup for Workbench.
2. Add this Microsoft Graph application permission to your custom Microsoft Entra ID application:

   • User.ReadWrite.All, User.Read.All

     
3. Verify User.ReadWrite.All is added, and then select Grant admin consent.

   

Step 2: Update Your Context

If you do not want to specify any accounts for a "do not disable" or "always disable" list, and instead wish for Expel to automatically disable all identified accounts, skip to Step 3.

If our SOC identifies an account that must be disabled and you have created either an allow ("Always disable") or deny ("Never disable") list in Workbench, any accounts falling outside of those parameters are assigned to you as actions rather than being disabled automatically.

Working with your Customer Success Manager, prepare to create an allow or deny list by adding accounts as org context for your environment. You will then be able to select those accounts as "Never disable" or "Always disable" assets when you enable the auto remediation in Workbench.

Step 3: Return to the Main Setup Guide

Your Azure Cloud Direct device is now ready for the Disable Accounts auto remediation. You should now do one of the following:

• If you do not need to set up any other devices for this auto remediation, you can return to the Enable an Auto Remediation in Workbench guide to finish Step 2 of the process.
• If you need to set up additional devices for this auto remediation, or wish to use this device with multiple auto remediations, be sure to complete those setup guides as well before returning to the Enable an Auto Remediation in Workbench guide to finish Step 2 of the process. Make sure to follow the setup guide that is specific to your auto remediation, as device setup instructions are unique to each auto remediation and device.