Skip to content

Stop account takeover

Contain the account before it becomes lateral movement.

Account takeover is fast. The gap between a successful sign-in and the first lateral move is where the whole response lives, and it's usually measured in minutes.

Click through Identity Compromise in the Demo Center →

The situation

What this usually looks like

If more than two of these are true, the work below is the work you are already doing by hand.

  1. Identity risk detections fire into the same queue as everything else and wait their turn.

    The fastest attack class gets triaged at the speed of the slowest.

  2. Impossible travel and MFA fatigue are separate alerts about the same compromise.

    Two half-signals, neither strong enough to act on alone.

  3. Containment means finding someone with the right admin role at the right moment.

    Response time becomes a question of who is awake.

  4. Nobody connects the phishing click on Monday to the strange sign-in on Tuesday.

    The compromise gets dated from the sign-in, not from the click.

The mechanism

See, decide, act, and then wait.

Four movements, in order. The fourth is the one that matters: nothing destructive happens without a person releasing it.

  1. 1

    See

    Every account, continuously

    Entra ID sign-in logs, Identity Protection risk detections, the Microsoft 365 unified audit log and MFA event logs are read continuously, alongside signals handed over directly from the phishing agent.

    • Entra sign-in logs
    • Identity Protection
    • M365 audit log
    • MFA events
  2. 2

    Decide

    Six signals, one score

    Impossible travel, anonymous IP, legacy authentication, MFA fatigue, leaked credentials and a prior phishing click each contribute weighted points, weighted again for privilege across Finance, Exec, Admin and HR. Post-authentication behaviour raises it further: a new inbox forwarding rule, a mass download. The total buckets Low, Medium, High or Critical.

    • Impossible travel
    • MFA fatigue
    • Legacy auth
    • Privilege weighting
  3. 3

    Act

    Contained as one set, not four tickets

    Session and refresh-token revocation through Microsoft Graph, sign-in blocked, MFA re-enrolment forced, a Conditional Access rule applied against legacy protocols, and the user and their manager notified. Proposed together, approved once.

    • Revoke sessions
    • Disable account
    • Force MFA
    • Block legacy auth
  4. 4

    Gate

    Four hours, and a timeout does nothing

    The review queue is gated at four hours, and expiry doesn't release the containment. An analyst approves, rejects, or escalates. Recovery can re-enable the account, restore MFA methods and revert Conditional Access, with each step tracked and audited.

    • 4-hour SLA
    • No auto-contain on timeout
    • Recovery tracked

The gate

Where an alert goes

The composite score sets the lane, and the privilege of the account it concerns moves the score before the lane is picked.

Runs on its own

auto_contain

The score is high enough, and the action cheap enough to undo, that the containment set runs immediately.

The ruleEvery step is written to the audit trail with its actor.

Waits for a person

hitl

The queue surfaces pending, critical-risk and phishing-linked counts, with each alert's score, risk level and routing on the card.

The ruleThe four-hour SLA is a prompt, not a trigger. Nothing contains itself because nobody answered.

Logged only

monitor

The account is watched inside a monitoring window, not contained.

The ruleThe window escalates if the behaviour continues.

Risk buckets: Low 0-25, Medium 26-50, High 51-75, Critical 76-100. Privilege moves the number, not the bucket boundaries.

Who does the work

2 agents, each owning its part.

You can turn one on and add the others later. A connector configured for one is available to the rest.

Questions

The things people ask first.

  • Will it lock out a real user?

    That's what the four-hour gate is for, and why the gate doesn't act on timeout. Anything the model isn't confident about waits for a person, and everything it does is reversible: the account re-enables, MFA methods restore, and the Conditional Access change reverts.

  • How is this different from Identity Protection's own risk score?

    Identity Protection is one of six inputs. The composite score also weighs MFA fatigue, legacy authentication, anonymous IP, a prior phishing click, and post-authentication behaviour such as a new inbox forwarding rule, then weights the whole thing by the account's privilege.

  • What counts as privileged?

    Finance, Exec, Admin and HR accounts carry extra weight, so the same signal on a privileged account scores higher and reaches a lane sooner than it would on a standard one.

  • Can it contain without an admin on shift?

    Yes, where the score routes to auto_contain. Session revocation, sign-in block, forced MFA re-enrolment and the legacy-auth Conditional Access rule all execute through Microsoft Graph, not through a person holding a role.

  • How is a phishing click connected to a sign-in?

    The phishing agent hands over the identity of anyone who clicked a malicious URL, and the alert is flagged phishing-linked. The review queue counts those separately, because a click followed by an unusual sign-in is a different proposition to either on its own.

The other outcomes