> For the complete documentation index, see [llms.txt](https://docs.expel.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.expel.io/workbench-setup/auto-remediations/disable-accounts/microsoft-entra-id-via-event-hub-disable-accounts.md).

# Microsoft Entra ID via Event Hub: Disable Accounts

*This guide is the first step of a larger process to enable auto remediations. After completing the steps on this page, you will be instructed to return to the* [*Enable an Auto Remediation in Workbench*](/workbench-setup/auto-remediations/enable-an-auto-remediation-in-workbench.md) *guide to finish your setup.*

This guide helps you set up your Microsoft Entra ID via Event Hub device so that you can enable the Disable Accounts auto remediation in Workbench. During the setup process, you will grant Expel all necessary permissions for the remediation to work.

## How It Works

If our SOC identifies an account (username or email address) that is compromised and must be disabled, Workbench completes the action automatically and logs the user out of their session. You have the option to restrict these actions to specific accounts by configuring an allow or deny list (the accounts must first be added as context, and then the list can be configured in Workbench; see [Step 2](#step-2-update-your-context)).

{% hint style="info" %}
Some vendors refer to disabling a user account as blocking a user, suspending a user, changing user status, removing a user from the org, or locking a user account.
{% endhint %}

### Endpoints Used <a href="#h_01kcq58zyx8ybb32hecxz7qhhp" id="h_01kcq58zyx8ybb32hecxz7qhhp"></a>

**Microsoft Graph API**

requires `User.ReadWrite.All`, same calls for cloud-only and hybrid/on-prem-synced users&#x20;

<table><thead><tr><th width="123.40625">Method</th><th>Endpoint</th><th>Purpose</th></tr></thead><tbody><tr><td>GET</td><td><code>v1.0/users/{userid}</code></td><td>Get user details; see if account is enabled for the pre-check</td></tr><tr><td>PATCH</td><td><code>v1.0/users/{userid}</code></td><td>Disable the account</td></tr><tr><td>POST</td><td><code>v1.0/users/{userid}/revokeSignInSessions</code></td><td>Revoke all sign-in sessions</td></tr><tr><td>POST</td><td><code>beta/users/{userid}/invalidateAllRefreshTokens</code></td><td>Revoke all refresh tokens</td></tr></tbody></table>

## Scope and Limitations

When choosing to enable this auto remediation, remember the following:

* After a previously logged-in account is disabled, it can still access some resources until the access token expires and requires re-authentication. *Default expiration is 60 to 90 minutes after the disabling; as a result, it is possible for a user to remain logged in and to access some of the resources for up to 90 minutes after an account is disabled.* It is therefore recommended that the Reset Credentials remediation is invoked immediately before this auto remediation.
* This auto remediation will not work on admin user accounts, or on any user who is assigned a privileged directory-level role or a privileged read-only role.
* While an account is disabled, the admin or user cannot reset the password. After the account is re-enabled, the account must be reset manually.

**If you have an on-prem Active Directory or hybrid Entra ID/ on-prem Active Directory environment**, consider the following safety precautions before enabling this auto remediation:

* This remediation action will perform Account Disablement in Entra ID and NOT in on-prem AD.&#x20;
* In hybrid environments, the On-prem AD configuration always takes precedence and is considered the "Source of Truth." Microsoft initiates automatic syncs from on-prem AD to Entra ID every 30-60 min.&#x20;
* For hybrid environments, the account disablement Expel pushes via Entra ID will be rolled back by Microsoft after the next sync. You must also lock the account in the on-prem environment before the next sync to keep the account locked.&#x20;
* **To safely disable accounts in on-prem or hybrid AD environments, Expel recommends using our Microsoft Defender for Endpoint: On-Prem/Hybrid Disable Accounts auto remediation. Enable this auto remediation via the** [**Microsoft Defender for Endpoint: Disable Accounts**](/workbench-setup/auto-remediations/disable-accounts/microsoft-defender-for-endpoint-disable-accounts.md) **setup guide.**

## Prerequisites

1. You must be an Azure admin for your organization, as you must have the ability to grant app permissions and add assignments.
2. You must have admin access in Workbench, as auto remediations are enabled at the organization level.
3. You must have already completed all of the steps in [Microsoft Entra ID via Event Hub Setup for Workbench](/connect-your-technology/l-p-integrations/microsoft/microsoft-entra-id-via-event-hub-setup-for-workbench.md).

## Step 1: Grant Necessary Permissions

The remediation actions the Expel SOC creates in Workbench will run in your vendor technology, so granting us certain permissions is required.

1. [Log in to Azure](https://portal.azure.com/).
2. Navigate to the **Microsoft Entra ID** service.
3. Go to **Manage > App registrations**.
4. Select the custom Entra ID app you created when you [set up your Expel integration](/connect-your-technology/l-p-integrations/microsoft/microsoft-entra-id-via-event-hub-setup-for-workbench.md#step-2-create-a-custom-entra-id-app).
5. Navigate to **Manage > API permissions**.
6. Locate the **Microsoft Graph** API and add the following two permissions:
   * `Directory.ReadWrite.All`
   * `User.EnableDisableAccount.All`
7. Make sure to **Grant admin consent** for both permissions.

## Step 2: Update Your Context <a href="#step-2-update-your-context" id="step-2-update-your-context"></a>

**If you do not want to specify any accounts for a "do not disable" or "always disable" list, and instead wish for Expel to automatically disable&#x20;*****all*****&#x20;identified accounts, skip to** [**Step 3**](#step-3-return-to-the-main-setup-guide)**.**

Working with your Customer Success Manager, prepare to create an allow or deny list by adding accounts as [org context](/workbench-setup/get-started/add-and-manage-org-context.md) for your environment. You will then be able to select those accounts as "Never disable" or "Always disable" assets when you enable the auto remediation in Workbench.

{% hint style="info" %}
If our SOC identifies an account that must be disabled and you have created either an allow ("Always disable") or deny ("Never disable") list in Workbench, any accounts falling outside of those parameters are assigned to you as actions rather than being disabled automatically.
{% endhint %}

## Step 3: Return to the Main Setup Guide <a href="#step-3-return-to-the-main-setup-guide" id="step-3-return-to-the-main-setup-guide"></a>

Your Microsoft Entra ID via Event Hub device is now ready for the Disable Accounts auto remediation. You should now do one of the following:

* **If you do not need to set up any other devices for this auto remediation**, you can return to the [Enable an Auto Remediation in Workbench](/workbench-setup/auto-remediations/enable-an-auto-remediation-in-workbench.md) guide to finish Step 2 of the process.
* **If you need to set up additional devices for this auto remediation, or wish to use this device with multiple auto remediations**, be sure to [complete those setup guides as well](/workbench-setup/auto-remediations.md) before returning to the [Enable an Auto Remediation in Workbench](/workbench-setup/auto-remediations/enable-an-auto-remediation-in-workbench.md) guide to finish Step 2 of the process. *Make sure to follow the setup guide that is specific to your auto remediation, as device setup instructions are unique to each auto remediation and device.*


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://docs.expel.io/workbench-setup/auto-remediations/disable-accounts/microsoft-entra-id-via-event-hub-disable-accounts.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.