🛡️ Recipe · Security & Compliance

Investigate and Contain a Potentially Compromised User Account

Review recent Entra sign-ins, identify risk indicators, revoke sessions, reset credentials, remove risky app access, and document the response.

Complexity

Advanced

Impact

Security + Identity + Incident Response + Access Control + Compliance

Context

Why This Matters

Why this matters

A suspected account compromise is a time-sensitive security incident. A fast, structured response helps you contain unauthorized access, reduce the chance of data loss, and preserve evidence for follow-up investigation.

This recipe is for Microsoft 365 and Microsoft Entra ID environments where you need to investigate a user's recent authentication activity, check identity risk signals, remove persistence paths such as refresh tokens or delegated OAuth grants, and force the user back through a trusted sign-in path.

When to run it

Help desk or SOC reports suspicious user behavior.
A user reports unexpected MFA prompts, password changes, or sign-in alerts.
Identity Protection, Defender, or another security tool flags unusual sign-ins.
You need an audit-ready summary of actions taken during containment.

What problem it solves

This workflow consolidates investigation and containment into one repeatable process: review evidence, determine whether there are suspicious locations/IPs or risky sessions, revoke active sign-in state, reset the password, require MFA re-registration, review delegated app grants, and capture the outcome in a report.

Expected Outcomes

Expected outcomes

You identify the target user and review their recent sign-in activity for the chosen time window.
You capture evidence such as IP addresses, locations, applications, devices, and sign-in risk signals.
You revoke active sessions and refresh tokens to interrupt unauthorized access.
You reset the user's password and require a secure recovery path.
You clear existing authentication methods as appropriate so the user must re-register MFA.
You review and remove suspicious delegated OAuth permission grants.
You produce a summary report suitable for incident tracking or handoff.

Risks & Considerations

Warnings and considerations

Do not share temporary passwords by email. Use a secure out-of-band method such as phone verification, approved secure chat, or a Temporary Access Pass workflow.
Session revocation is disruptive. The user will be signed out of apps and devices and may temporarily lose access.
MFA method deletion can lock out the user if you do not have a recovery method planned. Consider issuing a Temporary Access Pass before removing all MFA methods.
Be careful with app consent removal. Removing delegated grants can break legitimate integrations until the user re-consents.
Sign-in logs may be incomplete due to licensing, retention limits, or log latency. No sign-ins in the last 7 days does not prove the account is safe.
Preserve evidence. Export or record relevant sign-in details before making destructive changes if your incident process requires it.
Resetting the password alone is not enough if the attacker has refresh tokens, MFA methods, mailbox rules, or app grants.

Required Permissions

Permission	Why It's Needed
AuditLog.Read.All	Read user sign-in logs and capture evidence such as IPs, locations, device details, and status.
IdentityRiskyUser.Read.All	Review Entra ID Identity Protection risky user records for the target account.
User.ReadWrite.All	Revoke sign-in sessions and update user account settings if needed during containment.
UserAuthenticationMethod.ReadWrite.All	List and remove authentication methods and reset the user's password through Graph authentication endpoints.
DelegatedPermissionGrant.ReadWrite.All	Review and remove delegated OAuth permission grants that may provide attacker persistence.
Directory.Read.All	Resolve the user, applications, and service principals referenced in grants and sign-in evidence.

The fastest way to get this done: just ask Dex. Copy the prompt below and paste it into your Dex conversation.

For IT Admins

Paste into Dex Pro

Investigate whether {user} may be compromised in Microsoft 365. Review the last {days} days of sign-in activity, identify suspicious IPs, locations, risky sign-ins, or unfamiliar devices, revoke all active sessions, reset the password, require MFA re-registration, remove suspicious OAuth consents, and generate an incident summary with evidence.

Try in Dex Pro

Manual steps in the Entra admin center

Open the Microsoft Entra admin center.
Locate the user.
Navigation: Identity > Users > All users
Search for {user_upn} or {display_name} and open the user record.
Review recent sign-ins.
Navigation: Identity > Users > All users > {user} > Sign-in logs
Set the time range to the last 7 days. Review:
- Result and failure reason
- IP address
- Location
- Application
- Client app / browser
- Device details
- Conditional Access results
- Risk detail and risk level, if shown
Export the log if your incident process requires evidence retention.
Check for identity risk.
Navigation: Protection > Identity Protection > Risky users
Search for the user and review Risk level, Risk state, and Detections.
Contain active sessions.
Navigation: Identity > Users > All users > {user} > Overview
Select Revoke sessions (or Revoke sign-in sessions, depending on portal view) and confirm.
Reset the password.
Navigation: Identity > Users > All users > {user} > Authentication methods
If your process uses password reset from the user pane, choose Reset password, generate or set a temporary password, and require the user to change it at next sign-in.
Alternative admin path: Microsoft 365 admin center > Users > Active users > {user} > Reset password.
Force MFA re-registration.
Navigation: Identity > Users > All users > {user} > Authentication methods
Review existing methods such as Microsoft Authenticator, phone, FIDO2 keys, software OATH, Windows Hello for Business, or email OTP. Remove suspicious or all registered MFA methods according to your incident process so the user must register again.
Safer option: Issue a Temporary Access Pass first if the user would otherwise be locked out.
Review delegated app access.
Navigation: Identity > Applications > Enterprise applications
Search for recently used or suspicious applications. Review the app's Permissions and user assignment. If your environment uses consent governance or user consent review, remove suspicious grants or block the application. In some tenants this may also be reviewed under the user's app access or consent records.
Check for follow-on impact outside Entra.
Navigation: Exchange admin center / Microsoft Defender / SharePoint admin center as applicable
Consider reviewing mailbox forwarding rules, inbox rules, file sharing anomalies, and recent alert activity.
Document the incident summary. Record:
- User identity
- Time window investigated
- Suspicious sign-ins or lack of evidence
- Risk detections
- OAuth grants removed
- Session revocation time
- Password reset completion
- MFA methods removed / re-registration required
- Recommended follow-up actions

Graph API procedure

Use Microsoft Graph to investigate evidence, contain the session, reset credentials, remove MFA methods, and revoke delegated grants.

1) Resolve the user

GET https://graph.microsoft.com/v1.0/users?$filter=userPrincipalName eq '{user_upn}'&$select=id,displayName,userPrincipalName,accountEnabled

Example response:

{"value":[{"id":"{user_id}","displayName":"{display_name}","userPrincipalName":"{user_upn}","accountEnabled":true}]}

2) Pull sign-in logs for the last 7 days

GET https://graph.microsoft.com/v1.0/auditLogs/signIns?$filter=userId eq '{user_id}' and createdDateTime ge {start_iso}&$orderby=createdDateTime desc&$top=200

Recommended fields to record from each event include createdDateTime, ipAddress, appDisplayName, status/errorCode, location, deviceDetail, riskDetail, riskLevelDuringSignIn, and conditionalAccessStatus.

Example response excerpt:

{"value":[{"createdDateTime":"2026-02-15T20:10:00Z","ipAddress":"203.0.113.10","appDisplayName":"Office 365 Exchange Online","status":{"errorCode":0},"location":{"city":"Seattle","countryOrRegion":"US"},"deviceDetail":{"displayName":"LAPTOP-1234","operatingSystem":"Windows"},"riskDetail":"none","riskLevelDuringSignIn":"none"}]}

3) Check risky user status

GET https://graph.microsoft.com/v1.0/identityProtection/riskyUsers?$filter=userPrincipalName eq '{user_upn}'

Example response:

{"value":[{"id":"{risky_user_id}","userPrincipalName":"{user_upn}","riskLevel":"medium","riskState":"atRisk"}]}

4) List authentication methods

GET https://graph.microsoft.com/v1.0/users/{user_id}/authentication/methods

Use this to determine whether MFA methods exist and which method IDs must be removed.

5) List password method and reset password

GET https://graph.microsoft.com/v1.0/users/{user_id}/authentication/passwordMethods

POST https://graph.microsoft.com/v1.0/users/{user_id}/authentication/passwordMethods/{password_method_id}/resetPassword
Content-Type: application/json

{
  "newPassword": "{temporary_password}"
}

A successful reset typically returns 202 Accepted.

6) Revoke active sessions

POST https://graph.microsoft.com/v1.0/users/{user_id}/revokeSignInSessions

Example response:

{"value":true}

7) Remove MFA methods to force re-registration

List methods first, then delete each non-password method individually. Common examples:

DELETE https://graph.microsoft.com/v1.0/users/{user_id}/authentication/microsoftAuthenticatorMethods/{method_id}
DELETE https://graph.microsoft.com/v1.0/users/{user_id}/authentication/phoneMethods/{method_id}
DELETE https://graph.microsoft.com/v1.0/users/{user_id}/authentication/fido2Methods/{method_id}
DELETE https://graph.microsoft.com/v1.0/users/{user_id}/authentication/softwareOathMethods/{method_id}
DELETE https://graph.microsoft.com/v1.0/users/{user_id}/authentication/windowsHelloForBusinessMethods/{method_id}
DELETE https://graph.microsoft.com/v1.0/users/{user_id}/authentication/emailMethods/{method_id}

Note: The password method itself is not deleted. Plan user recovery before removing all MFA methods.

8) Review and remove delegated OAuth grants

GET https://graph.microsoft.com/v1.0/users/{user_id}/oauth2PermissionGrants

For any suspicious grant, remove it:

DELETE https://graph.microsoft.com/v1.0/oauth2PermissionGrants/{grant_id}

You can enrich the evidence by resolving the client service principal:

GET https://graph.microsoft.com/v1.0/servicePrincipals/{client_sp_id}?$select=id,displayName,appId,publisherName,verifiedPublisher

9) Produce a report

At minimum, capture a JSON or CSV summary containing:

User details
Investigation time window
Sign-in event counts and suspicious IP/location findings
Risky user findings
Authentication methods removed
OAuth grants removed
Password reset and session revocation timestamps

PowerShell procedure

This approach uses the Microsoft Graph PowerShell SDK to automate investigation and containment. It is suitable for repeatable incident response and evidence collection.

Prerequisites

PowerShell 7 or Windows PowerShell 5.1
Microsoft Graph PowerShell SDK modules
An account with the required Graph permissions and admin roles

1) Install and connect

# Install once
Install-Module Microsoft.Graph -Scope CurrentUser

# Connect with the required scopes
Connect-MgGraph -Scopes "AuditLog.Read.All","IdentityRiskyUser.Read.All","User.ReadWrite.All","UserAuthenticationMethod.ReadWrite.All","DelegatedPermissionGrant.ReadWrite.All","Directory.Read.All"

2) Run the investigation and containment

# Example execution
.\Investigate-CompromisedUser.ps1 -UserPrincipalName "{user_upn}" -DaysBack 7 -ResetPassword -RevokeSessions -RequireMfaReregistration -RemoveOAuthGrants -ExportPath "C:\Reports"

3) What the script does

Resolves the target user.
Pulls sign-ins from the last {DaysBack} days using Graph.
Builds a summary of successful and failed sign-ins, unique IPs, locations, devices, and suspicious patterns.
Checks risky user status.
Lists authentication methods.
Optionally revokes sessions.
Optionally resets the password using the password method endpoint.
Optionally removes non-password MFA methods to force re-registration.
Optionally removes delegated OAuth grants.
Exports a JSON and CSV report.

4) Operational guidance

If you plan to remove all MFA methods, make sure the user has a recovery path such as a Temporary Access Pass.
Review the CSV and JSON exports before closing the incident.
If sign-in logs are empty, the script records that as an investigation finding rather than assuming no risk.

Next steps

More Security & Compliance recipes

Browse the rest of this category in the Dex Cookbook.

Automate this with Dex Pro

Let the autonomous IT engineer run this task under your policies.

Start free

Point Dex at a tenant and try it for 30 days, no credit card.