From the security event details page accessible in the Report section by clicking on an event, or through the "View event in Office Protect" link in the security events notifications, you can now perform remediation actions to act quickly and avoid potential damage if there is a compromise on your organization.
Please note the Office Protect team is focused on adding new remediations. If you have any suggestions, feel free to contact us at feedback@office-protect.com.
REMEDIATION ACTIONS
Permissions
If the Office Protect health status is Healthy on your tenant: to perform Block User actions, new Delegated Permissions have been automatically added to your Office Protect application, including offline_access and Directory.AccessAsUser.
To be able to remove applications, some Application permissions have been added to Office Protect: AppCatalog.ReadWrite.All, TeamsAppInstallation.ReadWriteForUser.All, TeamsAppInstallation.ReadWriteForTeam.All, TeamsAppInstallation.ReadWriteForChat.All, TeamSettings.ReadWrite.All and Chat.ReadWrite.All.
You can review Office Protect application permissions in the Entra ID admin portal.
If the Office Protect health status is Unhealthy on your tenant: you first need to remediate the situation from the Health Status section.
To perform user disabling actions on administrators, Office Protect needs a Global Administrator to grant new delegated permissions to Office Protect, including offline_access and Directory.AccessAsUser.
If the permissions have not been granted, a consent page will be displayed when clicking on "Block user" on an admin for the first time.
This consent cannot be granted by the tenant's partner: only a Global Administrator on the tenant can grant these permissions. Once the delegated permissions have been granted on behalf of the organizations, partner users with the right roles will be able to disable Admin users in addition to regular non-admin users.
Block user
On which security events?
Any event raised by and/or on a user. Each user on which a remediation action is available will have a dedicated remediation section.
Actions - you can select any of the following actions to be applied when blocking a user:
- Disable user: user will not be able to sign-in until unblocked.
How to unblock: from the M365 admin portal (click on the user - Unblock sign-in), or through the Entra Identity admin portal (click on a user - Edit properties - Settings - "Account enabled" checkbox).
Important Note: If an Entra ID synchronization solution is configured on your tenant, it may revert the disabling action after a few minutes. However, the revoke session action cannot be reverted.
- Revoke sessions: revokes all the user's active sessions to cuts off the access to the potentially compromised user. The user will have to sign-in again. This action alone does not prevent a malicious user from connecting again. It must be combined with other actions such as resetting the password and/or disabling the user.
This action cannot be undone. - Remove mail forwarding: available only if user has a mailbox in your tenant - removes the Email forwarding options set on the user in the Exchange admin center.
This action cannot be undone. - Disable inbox rules: available only if user has a mailbox in your tenant - hackers can create malicious inbox rules for data extraction purposes, to hide phishing attacks or to prevent the user to be contacted.
Inbox rules can be reviewed in Exchange on the mailbox directly. Rules are not permanently deleted, so after reviewing the rules you or the impacted user can re-enable the legitimate rules and delete the malicious ones. - Reset password: currently under development, it is strongly recommended to perform this action manually along with the above. You can reset a user's password from the M365 admin portal (click on the user - Reset password), or through the Entra Identity admin portal.
Office Protect recommends at a bare minimum, disabling the user, revoking active sessions, and resetting the password. It is also important to keep a close eye on the suspicious user after the reactivating them, in case they are compromised anew.
Who can you block?
- Regular users & Guest users with no admin roles: you can immediately disable these users from Office Protect with no further steps.
- Privileged administrators, Administrators: to disable these users, you will be prompted to sign-in with a user that has a Privileged Authentication Administrator or Global Administator role in the tenant. You cannot block the user you have signed-in with.
These roles can be granted to the tenant's user accounts (guests / regular) or through the DAP/GDAP partner relationship and associated security groups. - System: you cannot block system users like "app@sharepoint".
- Anonymous users: you cannot block anonymous users. Anonymous users are temporary access users generated when a file that has been shared anonymously using sharepoint, onedrive, or teams, is accessed from outside the organization.
Remove app
On which security events?
- User Consented to an App
- New Teams app installed
- Application Permissions Change
Actions:
- Remove app: will remove the application and/or service principal from your organization (Entra Identity/ Teams)
How to restore an application: you can restore the application from the App Registrations section - Deleted applications in the Entra Identity admin portal.
You can block a Teams application from being installed in your organization through the Teams admin portal - Teams apps section.
Which applications can you remove?
- Entra Identity applications
- Teams applications
Reset Password
On which security events?
Any event raised by and/or on a user.
Actions:
- Reset password: will reset the user's password. Once the user's password is reset, a temporary password will be displayed once on screen. The user will need to change it at their next sign-in.
You can also choose to receive the temporary password by email, or send it by email to any Office Protect user who has access to the organization.
To reset a user's password, you will be asked to sign-in with a user who has a Global Administrator or Privileged Authentication Admin role on the tenant.
This action cannot be undone.
Which passwords can you reset?
Any user hosted in your Entra ID.
FAQ
Why aren't remediations available for my event?
If no remediation is available at the time, or no action can be performed on the user/the application, this banner is displayed:
The Office Protect team is actively working to add new remediations and handle more use cases.
Why are some of the actions greyed out?
If some of the Block user actions are greyed out, it means they cannot apply to the concerned user. Example: the user has no mailbox in the tenant, so you cannot perform actions on it.
My remediation action failed, what should I do?
If the Disable user action fails on an administrator, make sure the user you signed-in with has the right role to perform the action, and that you are not trying to disable the user you have signed-in with.
You can try to refresh the page and re-apply the remediation. If the issue remains, please contact us at support@office-protect.com to get assistance.
Please note the Office Protect team is currently working to add more details on actions failures.
I have an idea for a remediation. How can I share it with you?
The Office Protect team will be happy to get your feedback and suggestions! You can contact us at feedback@office-protect.com.