Comments on: Revoke user access in case of an emergency with a single click  https://inthecloud247.com/revoke-user-access-in-case-of-an-emergency-with-a-single-click/ Intune, Windows, Office 365, Microsoft 365, Azure, Automation Fri, 14 Feb 2025 08:22:15 +0000 hourly 1 By: John https://inthecloud247.com/revoke-user-access-in-case-of-an-emergency-with-a-single-click/#comment-241766 Mon, 18 Nov 2024 09:25:31 +0000 https://inthecloud247.com/?p=12646#comment-241766 How about privileged accounts such as admins? Least privileged access ive found is directory.readwrite.all for the SP.
Ive build a similar solution (not with logic apps) that uses powershell -> into a small GUI where the SOC can simply launch it, select the user, all users and then what action. However, for privileged accounts (which are usually more critical to address quickly) the directory.readwrite.all was required.

Also, revoking all MFA methods will not always work when some methods are set as preferred and no else is present, same for old entries (if they registered their methods long time ago). I have an error rate of 2-5% on a tenant with those (i usually roll out MFA to 15k+ environment and in many cases they cant use CA in the process, only registration campaign or registration policy, the registration policy however only looks for “true” or “false” under MFA-methods registered for user so therefor i revoke them very often). Have you encountered the same and is that solved with logic app?

]]>