Microsoft Entra built-in rolePublic reference
Entra SOC Identity Responder
Perform identity containment actions for SOC incident response, including disabling users, revoking active sign-in sessions, and resetting passwords.
Role definition
Microsoft reference- Template ID
- Privileged label
- Marked privileged in Microsoft's reference
- Documented permissions
- 4 resource actions
- Reference accepted
- 22 Oct 2026
Public definitions do not establish assignments, PIM eligibility, effective tenant access or cloud availability. Coverage and collection limits.