Microsoft Entra built-in rolePublic reference

Entra SOC Identity Responder

Perform identity containment actions for SOC incident response, including disabling users, revoking active sign-in sessions, and resetting passwords.

Compare definitions Microsoft reference

Documented resource actions

4 documented actions

These are Microsoft's documented resource actions, separate from Graph OAuth permissions and tenant assignments. Descriptions are shown as supplied in the reference.

Action	Description
microsoft.directory/users/disable	Disable users
microsoft.directory/users/enable	Enable users
microsoft.directory/users/invalidateAllRefreshTokens	Force sign-out by invalidating user refresh tokens
microsoft.directory/users/password/update	Reset passwords for all users