Public mode

No access to your tenant or devices. Every item links to its source. What this means

Some sources or documents need attention: 262/264 feeds/APIs · 418/442 docs · checked 20:00 UTC Customize Public modeDiscuss ChangeIntel on Discord

Entra SOC Identity Responder

Perform identity containment actions for SOC incident response, including disabling users, revoking active sign-in sessions, and resetting passwords.

Documented resource actions

4 documented actions

These are Microsoft's documented resource actions, separate from Graph OAuth permissions and tenant assignments. Descriptions are shown as supplied in the reference.

ActionDescription
microsoft.directory/users/disableDisable users
microsoft.directory/users/enableEnable users
microsoft.directory/users/invalidateAllRefreshTokensForce sign-out by invalidating user refresh tokens
microsoft.directory/users/password/updateReset passwords for all users
ChangeIntel

An IT change radar: releases, security, known issues, retirements, documentation changes, and service status from public sources. Every item links to supporting evidence; dates and statuses can change after they are read.

Sources read 22 Oct 20:00 UTC · 262 of 264 readable · 260 fully read · documentation 418/442 current