> For the complete documentation index, see [llms.txt](https://docs.expel.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.expel.io/workbench-setup/auto-remediations/disable-accounts/microsoft-defender-for-endpoint-disable-accounts.md).

# Microsoft Defender for Endpoint: Disable Accounts

*This guide is the first step of a larger process to enable auto remediations. After completing the steps on this page, you will be instructed to return to the* [*Enable an Auto Remediation in Workbench*](/workbench-setup/auto-remediations/enable-an-auto-remediation-in-workbench.md) *guide to finish your setup.*

## How It Works <a href="#h_01kcq57nmvm6yat269p4wpscb4" id="h_01kcq57nmvm6yat269p4wpscb4"></a>

If our SOC identifies an account (username or email address) that is compromised and must be disabled, Workbench completes the action automatically and logs the user out of their session.

This remediation action will attempt to perform both on-premise (domain controller) and cloud (Entra ID) disablement for a user. It will first attempt to disable the user account on specified Domain Controller(s) (domain controller host names are set up via context; see [Step 2](#h_01kcsp5bjygeny4ax81k7xajj3)) using Microsoft Defender for Endpoint Live Response, before attempting to force a cloud sync. Even if this sync attempt fails, a separate task is executed via Microsoft Graph to ensure the user account is also disabled in Entra ID.

Active user sessions and refresh tokens for the disabled account are revoked via Microsoft Graph.

You have the option to restrict these actions to specific accounts by configuring an allow or deny list (the accounts must first be added as context, and then the list can be configured in Workbench; see [Step 3](#h_01kcspj3vvdk6xb2b8a4h2eqt7)).

{% hint style="info" %}
Some vendors refer to disabling a user account as blocking a user, suspending a user, changing user status, removing a user from the org, or locking a user account.
{% endhint %}

### Endpoints Used <a href="#h_01kcq58zyx8ybb32hecxz7qhhp" id="h_01kcq58zyx8ybb32hecxz7qhhp"></a>

**MS Graph API Endpoints (for Cloud/Entra ID users)**

| **Method** | **Endpoint**                                   | **Purpose**                                                                    |
| ---------- | ---------------------------------------------- | ------------------------------------------------------------------------------ |
| GET        | v1.0/users/{userid}                            | Get user details (check if user exists, onPremisesSyncEnabled, accountEnabled) |
| PATCH      | v1.0/users/{userid}                            | Update user - sets accountEnabled: false to disable                            |
| POST       | v1.0/users/{userid}/revokeSignInSessions       | Revoke all sign-in sessions                                                    |
| POST       | beta/users/{userid}/invalidateAllRefreshTokens | Revoke all refresh tokens                                                      |

**Microsoft Defender for Endpoint API (for On-Prem/Hybrid users)**

| **Method** | **Endpoint**                      | **Purpose**                                    |
| ---------- | --------------------------------- | ---------------------------------------------- |
| GET        | api/machines/{id}                 | Get machine details (OS platform)              |
| POST       | api/machines/{id}/runliveresponse | Execute PowerShell script on domain controller |
| GET        | api/machineactions/{id}           | Poll for action completion status              |
| POST       | api/libraryfiles                  | Upload PowerShell script to library            |

## Scope and Limitations <a href="#h_01kcq5eztav8pyj62wr1w0r9ex" id="h_01kcq5eztav8pyj62wr1w0r9ex"></a>

When choosing to enable this auto remediation, remember the following:

* This remediation will work for on-prem-only, hybrid, or cloud-only Entra ID/Active Directory environments, meaning account disablement in Entra ID will not be rolled back after an Active Directory sync in hybrid AD environments. However, if you have a cloud-only Entra ID environment, we recommend you instead leverage the [Microsoft 365: Disable Accounts](/workbench-setup/auto-remediations/disable-accounts/microsoft-365-disable-accounts.md) remediation action.
* After a previously logged-in account is disabled, it can still access some resources until the access token expires and requires re-authentication. Default expiration is 60 to 90 minutes after the disabling; as a result, it is possible for a user to remain logged in and to access some of the resources for up to 90 minutes after an account is disabled.
* This auto remediation will not work on admin user accounts, or on any user who is assigned a privileged directory-level role or a privileged read-only role.
* While an account is disabled, the user cannot reset the password. After the account is re-enabled, the account must be reset manually.

## Prerequisites <a href="#h_01kcq5hx4rea8x67re9r32f4mb" id="h_01kcq5hx4rea8x67re9r32f4mb"></a>

1. You must be an Azure admin for your organization, as you must have the ability to grant app permissions and add assignments.
2. You must have admin access in Workbench, as auto remediations are enabled at the organization level.
3. You must have a valid license for Microsoft Defender for Endpoint Plan 2 (P2) or Microsoft 365 E5/A5/G5 (which includes P2).

## Step 1: Grant Necessary Permissions <a href="#h_01kcq5k599jrmnfwv6ak0wvtar" id="h_01kcq5k599jrmnfwv6ak0wvtar"></a>

The remediation actions the Expel SOC creates in Workbench will run in your vendor technology, so granting us certain permissions is required.

The option you choose in this section depends on how you initially onboarded your Microsoft Defender for Endpoint device in Workbench.

* If you chose to enable the Microsoft Defender for Endpoint integration, follow [Option 1](#h_01kcsmn27ggefkex683wdbx0x1).
* If you chose to create a custom Azure application, follow [Option 2](#h_01kcsmsmmh9wjmdp8gpxq4kwme).

### Option 1 (Microsoft Defender for Endpoint Integrations) <a href="#h_01kcsmn27ggefkex683wdbx0x1" id="h_01kcsmn27ggefkex683wdbx0x1"></a>

#### **New installation** <a href="#h_01kd3far7jwfefbc0n0a0t3ns0" id="h_01kd3far7jwfefbc0n0a0t3ns0"></a>

No changes are required.

#### **Existing installation** <a href="#h_01kd3fav39jq65ys7r6yg4wwg4" id="h_01kd3fav39jq65ys7r6yg4wwg4"></a>

1. Open **Expel Microsoft Defender for Endpoint Integration > API Permissions**.
2. Select **Grant admin consent**.
3. Consent to the new API permissions.

### Option 2 (Custom Azure Applications) <a href="#h_01kcsmsmmh9wjmdp8gpxq4kwme" id="h_01kcsmsmmh9wjmdp8gpxq4kwme"></a>

**New and existing installations:**

1. Follow all previous API permission steps in [Microsoft Defender for Endpoint Setup for Workbench](/connect-your-technology/l-p-integrations/microsoft/microsoft-defender-for-endpoint-setup-for-workbench.md).
2. Add these Microsoft Graph application permissions to your custom Azure application:
   * Directory.ReadWrite.All
   * User.EnableDisableAccount.All
   * User.ManageIdentities.All
   * User.Read.All
   * User.RevokeSessions.All
3. Add these WindowsDefenderATP application permissions to your custom Azure application:
   * Library.Manage
   * Machine.LiveResponse
   * Machine.ReadWrite.All

     <div align="left"><figure><img src="/files/900RRJ7ZCBYry9kQqy0m" alt="The Microsoft Graph and WindowsDefenderATP permissions are added to the Admin consent list." width="563"><figcaption></figcaption></figure></div>

## Step 2: Enable Live Response <a href="#h_01kcsp5bjygeny4ax81k7xajj3" id="h_01kcsp5bjygeny4ax81k7xajj3"></a>

In order to enable on-prem/hybrid disablement of accounts, you must allow Expel to run Powershell commands via Microsoft Live Response. To enable the running of these commands on domain controllers, follow these steps:

**Ensure Domain Controllers are Onboarded with Live Response**

1. Go to the Microsoft Defender portal and sign in.
2. Check Domain Controller Onboarding Status:
   * Go to **Assets > Devices** in the Microsoft Defender portal.
   * Search for your Domain Controller hostnames.
   * Ensure their status is **Active** and the Onboarding status is **Onboarded**.

**Enable Live Response Advanced Features**

1. In the navigation pane, select **Settings > Endpoints > Advanced features**.
2. Ensure the following features are **enabled**:
   * Live Response
   * Live Response on Servers
   * Live Response unsigned script execution
3. Select **Save preferences**.

   <div align="left"><figure><img src="/files/SrVMfINgQm6Mf1gWxuhG" alt="The three features are toggled to the On position." width="375"><figcaption></figcaption></figure></div>

{% hint style="info" %}
Expel will only use the Microsoft Defender for Endpoint Live Response “unsigned script execution” permission to issue remediation commands to your Domain Controllers via the Live Response channel. These commands are limited to the remediation actions you opt into in org settings. Expel uses the Live Response “unsigned script execution” permission for the following Microsoft Defender for Endpoint remediation actions:

* Account disablement and enablement (in case a disabled account should be reverted)
* Process termination (as part of the **Kill Processes** remediation action)
* File deletion (as part of the **Delete Malicious Files** remediation action)&#x20;

Enabling this option **does not** alter the local PowerShell Execution Policy enforced by GPO on the server. It strictly permits the execution of unsigned scripts only when initiated through the authenticated Live Response session. It does not allow users logged directly into the server to run unsigned scripts. Furthermore, execution via Live Response is restricted to users with specific RBAC permissions (e.g., Global/Security Admins) within the Microsoft Defender portal.
{% endhint %}

## Step 3: Update Your Context <a href="#h_01kcspj3vvdk6xb2b8a4h2eqt7" id="h_01kcspj3vvdk6xb2b8a4h2eqt7"></a>

Working with your Customer Success Manager:

1. (Optional) Create an allow or deny list by adding accounts as [org context](/workbench-reference/expel-terminology.md#org-context) for your environment.
2. Specify the hostnames of one or more domain controllers which should be used for on-prem disablement via Live Response (mandatory for on-prem/hybrid disablement).

In order for the remediation action to identify your domain controllers’ hostnames, ensure they are tagged with the Domain Controller detection tag in Workbench:

<div align="left"><figure><img src="/files/8v5Nm7WhSgbbo0KDhdoP" alt="The Domain controller tag is added in the Add detection tags field of Workbench." width="375"><figcaption></figcaption></figure></div>

{% hint style="info" %}
If our SOC identifies an account that must be disabled and you have created either an allow ("Always disable") or deny ("Never disable") list in Workbench, any accounts falling outside of those parameters are assigned to you as actions rather than being disabled automatically.
{% endhint %}

## Step 4: Return to the Main Setup Guide <a href="#h_01kcspnxec7tqv6gqg2t3n4sn8" id="h_01kcspnxec7tqv6gqg2t3n4sn8"></a>

Your **Microsoft Defender for Endpoint** device is now ready for the On-Prem/Hybrid **Disable Accounts** auto remediation. You should now do one of the following:

* **If you do not need to set up any other devices for this auto remediation**, you can return to the [Enable an Auto Remediation in Workbench](/workbench-setup/auto-remediations/enable-an-auto-remediation-in-workbench.md) guide to finish Step 2 of the process.
* **If you need to set up additional devices for this auto remediation, or wish to use this device with multiple auto remediations**, be sure to [complete those setup guides as well](/workbench-setup/auto-remediations.md) before returning to the [Enable an Auto Remediation in Workbench](/workbench-setup/auto-remediations/enable-an-auto-remediation-in-workbench.md) guide to finish Step 2 of the process. *Make sure to follow the setup guide that is specific to your auto remediation, as device setup instructions are unique to each auto remediation and device.*


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://docs.expel.io/workbench-setup/auto-remediations/disable-accounts/microsoft-defender-for-endpoint-disable-accounts.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.