Microsoft Entra ID via Event Hub: Reset Credentials

This guide is the first step of a larger process to enable auto remediations. After completing the steps on this page, you will be instructed to return to the Enable an Auto Remediation in Workbench guide to finish your setup.

This guide helps you set up your Microsoft Entra ID via Event Hub device so that you can enable the Reset Credentials auto remediation in Workbench. During the setup process, you will grant Expel all necessary permissions for the remediation to work.

Scope and Limitations

When choosing to enable this auto remediation, remember the following:

• This auto remediation will not work on admin user accounts or on accounts that Microsoft considers Privileged (as these accounts cannot be forced to change their password).
• While an account is temporarily disabled, the user cannot have their credentials reset. It is therefore recommended that, in the event of a suspected compromised user, this remediation is applied directly before the Disable Accounts remediation is applied.

If you have an on-prem Active Directory or hybrid Entra ID/ on-prem Active Directory environment, consider the following safety precautions before enabling this auto remediation:

• In hybrid environments, the on-prem AD configuration always takes precedence and is considered the "source of truth." Microsoft initiates automatic syncs from on-prem AD to Entra ID every 30-60 minutes. Make sure to enable password writeback so that password changes made in Microsoft Entra ID are synchronized back to your local active directory (password writeback is not enabled by default in a hybrid environment).
• The Reset Credentials auto remediation will not prompt the affected user to set a new password until the account in question has been unlocked. If an account unlocks (due to sync) prior to client engagement, there is a risk that the bad actor with access to the account could reset credentials and maintain access before client engagement. This risk can be addressed by MFA implementation, as required by Microsoft for all Azure sign-in attempts.

How It Works

This remediation forces a password change at the next login, and revokes sessions and refresh tokens. It does not set a new password.

Endpoints Used

Microsoft Graph API

v1.0, beta

Method	Endpoint	Purpose
GET	v1.0/users/{userid}	Get user; read passwordProfile for the pre-check
PATCH	v1.0/users/{userid}	Force change at next sign-in; sets passwordProfile.forceChangePasswordNextSignInWithMfa (falls back to forceChangePasswordNextSignIn)
POST	v1.0/users/{userid}/revokeSignInSessions	Revoke all sign-in sessions
POST	beta/users/{userid}/invalidateAllRefreshTokens	Revoke all refresh tokens

Prerequisites

1. You must be an Azure admin for your organization, as you must have the ability to grant app permissions and add assignments.
2. You must have admin access in Workbench, as auto remediations are enabled at the organization level.
3. You must have already completed all of the steps in Microsoft Entra ID via Event Hub Setup for Workbench.
4. Make sure all end user accounts have MFA enabled, to allow the auto remediation to run properly.
5. Make sure to enable password writeback so that password changes made in Microsoft Entra ID are synchronized back to your local active directory (password writeback is not enabled by default in a hybrid environment).

Step 1: Grant Necessary Permissions

The remediation actions the Expel SOC creates in Workbench will run in your vendor technology, so granting us certain permissions is required.

1. Log in to Azure.
2. Navigate to the Microsoft Entra ID service.
3. Go to Manage > App registrations.
4. Select the custom Entra ID app you created when you set up your Expel integration.
5. Navigate to Manage > API permissions.
6. Locate the Microsoft Graph API and add the following two permissions:

   • Directory.ReadWrite.All
   • User.RevokeSessions.All
7. Make sure to Grant admin consent for both permissions.

Step 2: Update Your Context

If you do not want to specify any credentials for a "do not reset" or "always reset" list, and instead wish for Expel to automatically reset all identified credentials, skip to Step 3.

Working with your Customer Success Manager, prepare to create an allow or deny list by adding credentials as context for your environment. You will then be able to select those credentials as "Never reset" or "Always reset" assets when you enable the auto remediation in Workbench.

If our SOC identifies credentials that must be reset and you have created either an allow ("Always reset") or deny ("Never reset") list in Workbench, any credentials falling outside of those parameters are assigned to you as actions rather than being reset automatically.

Step 3: Return to the Main Setup Guide

Your Microsoft Entra ID via Event Hub device is now ready for the Reset Credentials auto remediation. You should now do one of the following:

• If you do not need to set up any other devices for this auto remediation, you can return to the Enable an Auto Remediation in Workbench guide to finish Step 2 of the process.
• If you need to set up additional devices for this auto remediation, or wish to use this device with multiple auto remediations, be sure to complete those setup guides as well before returning to the Enable an Auto Remediation in Workbench guide to finish Step 2 of the process. Make sure to follow the setup guide that is specific to your auto remediation, as device setup instructions are unique to each auto remediation and device.