Question

A financial services SOC uses Microsoft Sentinel integrated with Defender XDR. Leadership requires that high-confidence identity-based incidents (e.g., confirmed impossible-travel with a risky sign-in) trigger immediate containment, but any action that disables a production service account or an executive's account must require documented human approval before execution. The architect must design a SOAR response that balances speed with governance. Which design best meets these requirements?

Accepted Answer

Design tiered playbooks: fully automated containment for standard user accounts triggered by automation rules, and a separate playbook using a Logic Apps approval action (e.g., Teams/email adaptive card) that gates disablement of service accounts and VIP-tagged accounts pending approval.

Answer

Create a single Sentinel automation rule that runs a playbook to disable all affected accounts automatically, and rely on the incident audit trail for post-incident review.

Answer

Set Defender XDR automated investigation and remediation to 'Full - remediate threats automatically' for all device groups so that every identity incident is contained without SOC involvement.

Answer

Disable all automation and require analysts to manually triage every incident in the Sentinel portal so that no containment action occurs without a human present.