Question

A multi-stage incident in Microsoft Defender XDR shows a user whose Entra ID sign-in was flagged as high risk, followed by mailbox rule creation and OAuth token replay. After investigating, you have strong evidence the account was genuinely taken over by an attacker. In the Defender XDR incident, within the Entra ID user (identity) entity actions, which response BEST feeds accurate signal back to Entra ID Identity Protection and forces immediate remediation of the identity?

Accepted Answer

Select 'Confirm user as compromised' to raise the user risk to high and trigger risk-based Conditional Access enforcement

Answer

Select 'Dismiss user risk' so the alert stops generating noise while you continue the investigation

Answer

Select 'Mark user as safe' to add the account to an allow list and prevent future risk detections

Answer

Select 'Suspend user in on-premises Active Directory' from the identity entity page to disable the account at the domain controller