Microsoft Sentinel
A scalable, cloud-native solution for security information event management and security orchestration automated response. Previously known as Azure Sentinel.
1,218 questions
Microsoft Defender for identity auto disable user account.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(272, 78%, 36%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EB%3C/text%3E%3C/svg%3E)
brichardi
331
Reputation points
Hello,
Recently, we are experiencing a lot of user accounts being automatically disable by Microsoft Defender for Identity when they authenticated by Exchange Online. Somehow, Defender think the user's accounts being attacked, and just disabled users account. We are not able to pinpoint the policy which cause this issue.
Any suggestion on how to fix this issue is greatly appreciated.
{count} votes
-
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(188.79999999999998, 26%, 28%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EN%3C/text%3E%3C/svg%3E)
Navya 15,150 Reputation points Microsoft Vendor2025-02-11T08:42:36.5666667+00:00 Hi @brichardi
Thank you for posting this in Microsoft Q&A.
I understand you are experiencing a lot of user accounts being automatically disable by Microsoft Defender for Identity when they authenticated by Exchange Online.
Microsoft Defender for Identity allows you to respond to compromised users by disabling their accounts or resetting their password.
To perform remediation actions in Microsoft Defender for Identity please follow steps which mentioned in this document: https://learn.microsoft.com/en-us/defender-for-identity/remediation-actions
Hope this helps. Do let us know if you any further queries.
Sign in to comment
Sign in to answer