Respond to Security Incidents · Topic 2 of 5
Identities, Defender for Identity and Sentinel Incidents
SC-200 identity response: compromised Entra identities, Defender for Identity alerts, Sentinel incidents, entities, bookmarks and the investigation graph.
- 6 min
- Disable user blocks sign in at once and keeps the data intact. Revoke sessions ends active sign ins.
- Defender for Identity uses sensors on domain controllers and detects reconnaissance, credential access, lateral movement and persistence.
- Kerberoasting risk falls with long random passwords, AES only and group managed service accounts.
What it is
Attackers go after identities, because a valid account lets them move freely. This page covers how to investigate and remediate compromised identities in Microsoft Entra ID, alerts from Microsoft Defender for Identity about on premises Active Directory, and incidents in Microsoft Sentinel.
How it works
Compromised identities in Entra ID
Microsoft Entra ID Protection scores user risk and sign in risk, and these detections appear in Defender XDR as alerts. To investigate a possible compromise:
- Open the user page and review the sign in history, the risk level, the devices used and the recent alerts.
- Look at risky sign ins and the detections behind them, such as an anonymous IP address, atypical travel or leaked credentials.
- Check what the account did: audit logs, mailbox rules, new authentication methods and app consent.
- Decide whether it is a true compromise.
Response actions for a compromised identity:
| Action | Effect |
|---|---|
| Confirm user compromised | Marks the user as high risk so risk based policies apply |
| Reset the password | Forces a new password |
| Revoke sessions | Ends existing sign ins by invalidating refresh tokens |
| Disable the user | Blocks sign in immediately but keeps the account, mailbox and data intact for investigation |
| Require MFA re-registration | Removes the attacker's authentication methods |
| Remove malicious inbox rules and app consent | Cleans up persistence |
If an executive's account is compromised and the SOC must block sign in at once while keeping the mailbox and data for the investigation, disable the user is the right action. Deleting the account removes the evidence, removing licences can affect mailbox data, and resetting the password alone does not end sessions that are already active.
Microsoft Defender for Identity
Defender for Identity uses sensors installed on domain controllers, and on AD FS and AD CS servers, to watch the traffic and events of on premises Active Directory. It detects attacks across the kill chain.
| Stage | Examples |
|---|---|
| Reconnaissance | Account enumeration, network mapping, reconnaissance by DNS or SMB |
| Credential access | Brute force, Kerberoasting, password spray, DCSync |
| Lateral movement | Pass the ticket, pass the hash, overpass the hash |
| Persistence and domain dominance | Golden ticket, Skeleton key, DCShadow |
For example, a workstation that requests Kerberos service tickets for many service accounts raises a Kerberoasting alert. Defender for Identity builds identity timelines and lets you take actions on the account: disable the user, force a password reset and mark the user as compromised. It also reports identity security posture recommendations, such as service accounts with old passwords or unsafe delegation.
Reducing the risk of Kerberoasting means giving service accounts long, random passwords, using group managed service accounts where the service supports them, and restricting accounts to AES encryption. Resetting the krbtgt password addresses golden ticket attacks, not service ticket cracking.
Investigating incidents in Microsoft Sentinel
Sentinel groups alerts from analytics rules and connected products into incidents. With Sentinel in the Defender portal, they appear in the same queue as Defender XDR incidents, and in the same unified view.
On an incident page you can:
- Review the timeline of alerts and the entities, such as accounts, hosts and IP addresses.
- Open the investigation graph, which shows relationships between entities and lets you expand to related alerts and activity.
- Add bookmarks from hunting results, which preserve rows of evidence on the incident.
- Use tasks that guide the analyst through a standard process, and add comments.
- Run a playbook manually, for example to enrich an IP address or disable a user.
- Assign the incident, change its status and severity, and add tags.
- Close it with a classification, such as true positive, benign positive or false positive, and a reason.
Because Sentinel receives data from many vendors, the entities and the queries behind each alert are the starting point. Select an alert, view the query results that created it, and follow the entities into related events.
Choosing the response
| The situation | Action |
|---|---|
| Account compromised, mailbox must remain intact | Disable the user |
| Stolen session must end now | Revoke sessions |
| Kerberoasting against service accounts | Long random passwords, AES only, or group managed service accounts |
| A hunter found proof of lateral movement in logs | Add a bookmark to the incident |
| Need a standard process for every phishing incident | Incident tasks through an automation rule |
| Evidence of an attack path between entities | The investigation graph |
A worked scenario
An incident combines a risky sign in, a new mailbox rule that forwards mail externally and a Kerberos alert from Defender for Identity. The analyst opens the user page and confirms the compromise. She disables the account, revokes sessions, removes the forwarding rule and requires MFA registration again. Defender for Identity shows that the same workstation asked for tickets for two service accounts with passwords from 2016, so the team gives those accounts long random passwords and restricts them to AES. In Sentinel she adds a bookmark with the relevant sign in rows and closes the incident as a true positive.
What to remember for the exam
- Disable user blocks sign in at once and keeps the data intact. Revoke sessions ends active sign ins.
- Defender for Identity uses sensors on domain controllers and detects reconnaissance, credential access, lateral movement and persistence.
- Kerberoasting risk falls with long random passwords, AES only and group managed service accounts.
- Sentinel incident tools include entities, the investigation graph, bookmarks, tasks, comments and classifications.
- Sentinel incidents appear in the Defender portal queue.
"Block sign in but keep everything for the investigation" is Disable user, not Delete user or Reset password.
How the exam asks about this
- "Which response blocks a compromised executive's sign in and keeps the mailbox intact?" Disable user.
- "Which product watches domain controllers for DCSync and pass the ticket?" Microsoft Defender for Identity.
- "Which Sentinel feature keeps rows of hunting results on an incident?" A bookmark.
- "Reduce the risk of captured service tickets being cracked offline." A long random password and AES only.
Common mistakes
Only resetting the password. Active sessions can survive. Revoke them too.
Deleting the account to be safe. It destroys evidence.
Looking only at the alert. Follow the entities and the investigation graph.
Closing without a classification. It loses information for tuning.
Check yourself
Which action stops a compromised user signing in while preserving their data?
Disable the user.
What do Defender for Identity sensors monitor?
Domain controllers, and also AD FS and AD CS servers, for attacks on on premises Active Directory.
What is a bookmark in Sentinel?
A saved set of hunting result rows attached to an incident as evidence.
Topic 2 of 5 in Respond to Security Incidents
Test yourself on Respond to Security Incidents
The full Microsoft SC-200 question bank has 650 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by Microsoft. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.