> For the complete documentation index, see [llms.txt](https://docs.expel.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.expel.io/workbench-setup/auto-remediations/disable-accounts/microsoft-defender-for-endpoint-disable-accounts.md).

# Microsoft Defender for Endpoint: Disable Accounts

This guide helps you set up your Microsoft Defender for Endpoint device and grant necessary permissions so that you can enable the On-Prem/Hybrid Disable Accounts auto remediation in Workbench.

*This guide is the first step of a larger process to enable auto remediations. After completing the steps on this page, you will be instructed to return to the* [*Enable an Auto Remediation in Workbench*](/workbench-setup/auto-remediations/enable-an-auto-remediation-in-workbench.md) *guide to finish your setup.*

## How It Works <a href="#h_01kcq57nmvm6yat269p4wpscb4" id="h_01kcq57nmvm6yat269p4wpscb4"></a>

If our SOC identifies an account (username or email address) that is compromised and must be disabled, Workbench completes the action automatically and logs the user out of their session.

This remediation action will attempt to perform both on-premise (domain controller) and cloud (Entra ID) disablement for a user. It will first attempt to disable the user account on specified Domain Controller(s) (domain controller host names are set up via context; see [Step 2](#h_01kcsp5bjygeny4ax81k7xajj3)) using Microsoft Defender for Endpoint Live Response, before attempting to force a cloud sync. Even if this sync attempt fails, a separate task is executed via Microsoft Graph to ensure the user account is also disabled in Entra ID.

Active user sessions and refresh tokens for the disabled account are revoked via Microsoft Graph. You have the option to restrict these actions to specific accounts by configuring an allow or deny list (the accounts must first be added as context, and then the list can be configured in Workbench; see [Step 3](#h_01kcspj3vvdk6xb2b8a4h2eqt7)).

{% hint style="info" %}
Some vendors refer to disabling a user account as blocking a user, suspending a user, changing user status, removing a user from the org, or locking a user account.
{% endhint %}

### Endpoints Used <a href="#h_01kcq58zyx8ybb32hecxz7qhhp" id="h_01kcq58zyx8ybb32hecxz7qhhp"></a>

**Microsoft Graph API (for Cloud/Entra ID users)**

<table><thead><tr><th width="123.40625">Method</th><th>Endpoint</th><th>Purpose</th></tr></thead><tbody><tr><td>GET</td><td><code>v1.0/users/{userid}</code></td><td>Get user details (check if user exists, if on premise sync is enabled, and if the account is enabled)</td></tr><tr><td>PATCH</td><td><code>v1.0/users/{userid}</code></td><td>Disable the account</td></tr><tr><td>POST</td><td><code>v1.0/users/{userid}/revokeSignInSessions</code></td><td>Revoke all sign-in sessions</td></tr><tr><td>POST</td><td><code>beta/users/{userid}/invalidateAllRefreshTokens</code></td><td>Revoke all refresh tokens</td></tr></tbody></table>

**Microsoft Defender for Endpoint API (for On-Prem/Hybrid users)**

<table><thead><tr><th width="123.40625">Method</th><th>Endpoint (IAM Action)</th><th>Purpose</th></tr></thead><tbody><tr><td>GET</td><td><code>api/machines/{id}</code></td><td>Get machine details (OS platform)</td></tr><tr><td>POST</td><td><code>api/machines/{id}/runliveresponse</code></td><td>Execute PowerShell script on domain controller</td></tr><tr><td>GET</td><td><code>api/machineactions/{id}</code></td><td>Poll for action completion status</td></tr><tr><td>POST</td><td><code>api/libraryfiles</code></td><td>Upload PowerShell script to library</td></tr></tbody></table>

## Scope and Limitations <a href="#h_01kcq5eztav8pyj62wr1w0r9ex" id="h_01kcq5eztav8pyj62wr1w0r9ex"></a>

When choosing to enable this auto remediation, remember the following:

* This remediation will work for on-prem-only, hybrid, or cloud-only Entra ID/Active Directory environments, meaning account disablement in Entra ID will not be rolled back after an Active Directory sync in hybrid AD environments. However, if you have a cloud-only Entra ID environment, we recommend you instead leverage the [Microsoft 365: Disable Accounts](/workbench-setup/auto-remediations/disable-accounts/microsoft-365-disable-accounts.md) remediation action.
* After a previously logged-in account is disabled, it can still access some resources until the access token expires and requires re-authentication. Default expiration is 60 to 90 minutes after the disabling; as a result, it is possible for a user to remain logged in and to access some of the resources for up to 90 minutes after an account is disabled.
* This auto remediation will not work on admin user accounts, or on any user who is assigned a privileged directory-level role or a privileged read-only role.
* While an account is disabled, the user cannot reset the password. After the account is re-enabled, the account must be reset manually.

## Prerequisites <a href="#h_01kcq5hx4rea8x67re9r32f4mb" id="h_01kcq5hx4rea8x67re9r32f4mb"></a>

1. You must be an Azure admin for your organization, as you must have the ability to grant app permissions and add assignments.
2. You must have admin access in Workbench, as auto remediations are enabled at the organization level.
3. You must have a valid license for Microsoft Defender for Endpoint Plan 2 (P2) or Microsoft 365 E5/A5/G5 (which includes P2).
4. Your Live Response target devices must belong to a device group with an automation level of at least `Semi – require approval for all folders`. This level of access is necessary for us to make Live Response commands via API; see [Step 2](#h_01kcsp5bjygeny4ax81k7xajj3) for more information.

## Step 1: Grant Necessary Permissions <a href="#h_01kcq5k599jrmnfwv6ak0wvtar" id="h_01kcq5k599jrmnfwv6ak0wvtar"></a>

The remediation actions the Expel SOC creates in Workbench will run in your vendor technology, so granting us certain permissions is required.

The option you choose in this section depends on how you initially onboarded your Microsoft Defender for Endpoint device in Workbench.

* If you chose to enable the Microsoft Defender for Endpoint integration, follow [Option 1](#h_01kcsmn27ggefkex683wdbx0x1).
* If you chose to create a custom Azure application, follow [Option 2](#h_01kcsmsmmh9wjmdp8gpxq4kwme).

### Option 1 (Microsoft Defender for Endpoint Integrations) <a href="#h_01kcsmn27ggefkex683wdbx0x1" id="h_01kcsmn27ggefkex683wdbx0x1"></a>

#### **New installation** <a href="#h_01kd3far7jwfefbc0n0a0t3ns0" id="h_01kd3far7jwfefbc0n0a0t3ns0"></a>

No changes are required.

#### **Existing installation** <a href="#h_01kd3fav39jq65ys7r6yg4wwg4" id="h_01kd3fav39jq65ys7r6yg4wwg4"></a>

1. Open **Expel Microsoft Defender for Endpoint Integration > API Permissions**.
2. Select **Grant admin consent**.
3. Consent to the new API permissions.

### Option 2 (Custom Azure Applications) <a href="#h_01kcsmsmmh9wjmdp8gpxq4kwme" id="h_01kcsmsmmh9wjmdp8gpxq4kwme"></a>

**New and existing installations:**

1. Follow all previous API permission steps in [Microsoft Defender for Endpoint Setup for Workbench](/connect-your-technology/l-p-integrations/microsoft/microsoft-defender-for-endpoint-setup-for-workbench.md).
2. Add these Microsoft Graph application permissions to your custom Azure application:
   * Directory.ReadWrite.All
   * User.EnableDisableAccount.All
   * User.ManageIdentities.All
   * User.Read.All
   * User.RevokeSessions.All
3. Add these WindowsDefenderATP application permissions to your custom Azure application:
   * Library.Manage
   * Machine.LiveResponse
   * Machine.ReadWrite.All

     <div align="left"><figure><img src="https://2371323735-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F82234aPbNfd179j5U4ti%2Fuploads%2Fi2ufy7Wk4CdtjKM10Fr6%2FMS-permissions.png?alt=media&amp;token=fb7f4185-b829-4e79-af69-da7cb01efe89" alt="The Microsoft Graph and WindowsDefenderATP permissions are added to the Admin consent list." width="563"><figcaption></figcaption></figure></div>

## Step 2: Enable Live Response <a href="#h_01kcsp5bjygeny4ax81k7xajj3" id="h_01kcsp5bjygeny4ax81k7xajj3"></a>

In order to enable on-prem/hybrid disablement of accounts, you must allow Expel to run PowerShell commands via Microsoft Live Response on a domain controller.

{% hint style="warning" %}
Your target devices must belong to a device group with an automation level of at least `Semi – require approval for all folders`, but you may also choose `Full - remediate threats automatically`. If device groups are not used, ensure the default `Ungrouped devices (default)` group is updated to meet the minimum setting. This level of access is necessary for us to make Live Response commands via API.

Refer to the [Microsoft Documentation](https://learn.microsoft.com/en-us/defender-endpoint/automation-levels) for more information about automation levels.
{% endhint %}

**Ensure Domain Controllers are Onboarded with Live Response**

1. Go to the Microsoft Defender portal and sign in.
2. Check Domain Controller Onboarding Status:
   * Go to **Assets > Devices** in the Microsoft Defender portal.
   * Search for your Domain Controller hostnames.
   * Ensure their status is **Active** and the Onboarding status is **Onboarded**.

**Enable Live Response Advanced Features**

1. In the navigation pane, select **Settings > Endpoints > Advanced features**.
2. Ensure the following features are **enabled**:
   * Live Response
   * Live Response on Servers
   * Live Response unsigned script execution
3. Select **Save preferences**.

   <div align="left"><figure><img src="https://2371323735-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F82234aPbNfd179j5U4ti%2Fuploads%2FF24lDGzti60PrPU3E36G%2Flive-response-advanced-features.png?alt=media&amp;token=296096d1-69ac-417f-821f-8bf2c1b1591b" alt="The three features are toggled to the On position." width="375"><figcaption></figcaption></figure></div>

{% hint style="info" %}
Expel will only use the Microsoft Defender for Endpoint Live Response “unsigned script execution” permission to issue remediation commands to your Domain Controllers via the Live Response channel. These commands are limited to the remediation actions you opt into in org settings. Expel uses the Live Response “unsigned script execution” permission for the following Microsoft Defender for Endpoint remediation actions:

* Account disablement and enablement (in case a disabled account should be reverted)
* Process termination (as part of the **Kill Processes** remediation action)
* File deletion (as part of the **Delete Malicious Files** remediation action)&#x20;

Enabling this option **does not** alter the local PowerShell Execution Policy enforced by GPO on the server. It strictly permits the execution of unsigned scripts only when initiated through the authenticated Live Response session. It does not allow users logged directly into the server to run unsigned scripts. Furthermore, execution via Live Response is restricted to users with specific RBAC permissions (e.g., Global/Security Admins) within the Microsoft Defender portal.
{% endhint %}

## Step 3: Update Your Context <a href="#h_01kcspj3vvdk6xb2b8a4h2eqt7" id="h_01kcspj3vvdk6xb2b8a4h2eqt7"></a>

Working with your Customer Success Manager:

1. (Optional) Create an allow or deny list by adding accounts as [org context](/workbench-reference/expel-terminology.md#org-context) for your environment.
2. Specify the hostnames of one or more domain controllers which should be used for on-prem disablement via Live Response (mandatory for on-prem/hybrid disablement).

In order for the remediation action to identify your domain controllers’ hostnames, ensure they are tagged with the Domain Controller detection tag in Workbench:

<div align="left"><figure><img src="https://2371323735-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F82234aPbNfd179j5U4ti%2Fuploads%2Fi4kTv03H5yUEhh2N7oUQ%2Fadd-context.png?alt=media&amp;token=6af1ee42-189c-43cf-bd79-4ff8a53e73e9" alt="The Domain controller tag is added in the Add detection tags field of Workbench." width="375"><figcaption></figcaption></figure></div>

{% hint style="info" %}
If our SOC identifies an account that must be disabled and you have created either an allow ("Always disable") or deny ("Never disable") list in Workbench, any accounts falling outside of those parameters are assigned to you as actions rather than being disabled automatically.
{% endhint %}

## Step 4: Return to the Main Setup Guide <a href="#h_01kcspnxec7tqv6gqg2t3n4sn8" id="h_01kcspnxec7tqv6gqg2t3n4sn8"></a>

Your **Microsoft Defender for Endpoint** device is now ready for the On-Prem/Hybrid **Disable Accounts** auto remediation. You should now do one of the following:

* **If you do not need to set up any other devices for this auto remediation**, you can return to the [Enable an Auto Remediation in Workbench](/workbench-setup/auto-remediations/enable-an-auto-remediation-in-workbench.md) guide to finish Step 2 of the process.
* **If you need to set up additional devices for this auto remediation, or wish to use this device with multiple auto remediations**, be sure to [complete those setup guides as well](/workbench-setup/auto-remediations.md) before returning to the [Enable an Auto Remediation in Workbench](/workbench-setup/auto-remediations/enable-an-auto-remediation-in-workbench.md) guide to finish Step 2 of the process. *Make sure to follow the setup guide that is specific to your auto remediation, as device setup instructions are unique to each auto remediation and device.*


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://docs.expel.io/workbench-setup/auto-remediations/disable-accounts/microsoft-defender-for-endpoint-disable-accounts.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.