When an investigation recommends containing an identity, an analyst can run the action from the report instead of carrying it out in the Microsoft Entra admin center. Qevlar sends the call to Microsoft Graph, then records what was run, by whom, and what came back.
This page covers the four Entra ID identity actions. For how recommendations are produced and ordered, see Contextual Next Steps Recommendations.
Why it matters
- Scoped to the investigation : the action is already targeted at the observable the investigation identified, so an account name is never retyped into a production directory.
- Justified in place : the Why? explanation and the observable tags stay beside the Execute control, so the reason for acting is visible at the moment of acting.
- Recorded : every attempt, successful or failed, is written to the action log on the report with the analyst who ran it.
- Reversible where the action allows it : a disabled account can be re enabled from the same tab. Session revocation and password resets cannot be undone once executed.
- Analyst triggered : Qevlar recommends and executes on request. It does not run identity actions on its own.
Before you start
Three conditions have to be met before an action can run.
- The Entra ID integration is connected. Integrations → Microsoft Entra ID.
- The write permissions are granted and consented on the app registration. See Required permissions below.
- The account resolves to an Entra user ID during identity enrichment. Where it does not, no action is offered for that observable. This prevents Qevlar acting on the wrong target when two accounts resemble each other.
Available actions
| Action | What it does in Entra ID | Reversible from Qevlar |
|---|---|---|
| Disable account | Sets accountEnabled to false. The user cannot sign in | Yes, with Re enable account |
| Re enable account | Sets accountEnabled to true | Yes, with Disable account |
| Revoke sessions and tokens | Invalidates all active sessions and refresh tokens, forcing reauthentication | No. The user signs in again normally |
| Force password reset | Requires a new password at next sign in | No |
Where to find it
Open an investigation report and select the Next steps tab. Entra ID actions show an Execute control on the right of the recommendation card.
Running an action
- Read the recommendation and hover Why? to see what the investigation observed and the reasoning applied.
- Select Execute.
- The first time you run a given action type, a dialog states the specific outcome, for example that jsmith@acme.com will be disabled immediately and all active sessions will end. Confirm to continue. Select Don't show this again to skip the dialog for that action type in future. The setting is saved per analyst and per action type, so dismissing it for Revoke sessions and tokens does not dismiss it for Disable account.
- A 5 second countdown appears in the card with an Undo control. Nothing has been sent to Entra ID yet.
- When the countdown ends, Qevlar sends the call and the card shows Applied or Failed.
The undo window
During the 5 seconds no call has been made, so undoing means the action never happens: the card returns to its previous state, Execute reappears, and nothing is written to the action log. Once the countdown ends the call is on its way.
The action log
The action log sits beside the Next steps list and stays visible. It is read only, and all interaction happens on the recommendation cards.
Each entry records the timestamp, the action, the analyst, the result, and any error detail: Disabled user@client.com at 14:23:15 by Aurora Jones.
Failed attempts are logged as well as successful ones, so a retry after a fix leaves both entries in the record.
What Applied means
Applied means Microsoft Graph accepted the call without returning an error. Qevlar does not query Entra ID afterwards to confirm the directory state changed. In practice the two almost always agree.
When an action fails
The card shows Failed with the reason, and Retry reappears so the action can be run again. Qevlar does not retry automatically. A retry skips the confirmation dialog if it was dismissed for that action type, and starts a fresh 5 second countdown.
If the reason points to permissions or to the integration itself, resolve that first, then execute again. The action log keeps the failed attempt alongside the successful one.
Who can run actions
In this release, any analyst with access to the investigation can run actions. Role restrictions are configured per customer and are not yet available in the product. If execution needs to be limited to named analysts, raise it with your Qevlar contact.
Required permissions
Grant these as Microsoft Graph application permissions on the app registration Qevlar uses for Entra ID, then grant admin consent for the tenant. Permissions added without consent do not take effect.
| Permission | Grants |
|---|---|
User.RevokeSessions.All | Revoke sessions and refresh tokens |
User-PasswordProfile.ReadWrite.All | Force a password reset at next sign in |
User.EnableDisableAccount.All | Disable and re enable an account |
User.Read.All | Read the directory. Required in all cases, including to resolve the target account |
IdentityRiskyUser.Read.All is optional and improves identity enrichment.
The higher privileged User.ReadWrite.All and Directory.ReadWrite.All also cover these operations, but grant far more than the actions require. Use the least privileged permission unless your Entra ID administrator has a reason not to.
The app also needs a directory role that authorizes it against the target account: Helpdesk Administrator for session revocation and password reset, Authentication Administrator for disable and re enable.