Microsoft Defender for Identity
Identity protectionRemediation Actions
In brief
The Defender for Identity remediation-actions table now lists Security Operator among the roles for the Revoke session action.
What Defender admins need to know
Administrators can include this role when reviewing or assigning permissions for session revocation.
Summaries are generated from the documentation change itself.
Documentation change
View on Microsoft LearnThe comparison below shows only the changed extract. Use the full-page view for complete context.
| Remediation Action | Active Directory | Microsoft Entra ID | Okta, SailPoint, CyberArk | Supported SaaS apps |
|---|---|---|---|---|
| Disable | See Required permissions Defender for Identity in Microsoft Defender XDR | Global Administrator, User Administrator, Authentication Administrator, Privileged Authentication Administrator, Directory Writers, SOC Identity |
See Required permissions Defender for Identity in Microsoft Defender XDR | Global Administrator, Security Administrator, Cloud App Security Administrator |
| Enable | See Required permissions Defender for Identity in Microsoft Defender XDR | Global Administrator, User Administrator, Authentication Administrator, Privileged Authentication Administrator, Directory |
See Required permissions Defender for Identity in Microsoft Defender XDR | Global Administrator, Security Administrator, Cloud App Security Administrator |
| Revoke session | N/A | Global Administrator, User Administrator, Authentication Administrator, Privileged Authentication Administrator, Directory Writers, Helpdesk Administrator, SOC Identity |
See Required permissions Defender for Identity in Microsoft Defender XDR | N/A |
| Mark as compromised | N/A | Global Administrator, Security Administrator, Security Operator, SOC Identity Responder | N/A | N/A |
| Force password change | See Required permissions Defender for Identity in Microsoft Defender XDR | Global Administrator, Privileged Authentication Administrator, Authentication Administrator, User Administrator, Password Administrator, Helpdesk Administrator, SOC Identity |
N/A | N/A |
Note
@@ -97,11 +97,11 @@ The following table lists the remediation actions supported by Defender for Iden
| Remediation Action | Active Directory | Microsoft Entra ID | Okta, SailPoint, CyberArk | Supported SaaS apps |
| --- | --- | --- | --- | --- |
-| Disable | See [Required permissions Defender for Identity in Microsoft Defender XDR](/en-us/defender-for-identity/role-groups#required-permissions-defender-for-identity-in-microsoft-defender-xdr) | Global Administrator, User Administrator, Authentication Administrator, Privileged Authentication Administrator, Directory Writers, SOC Identity Responder | See [Required permissions Defender for Identity in Microsoft Defender XDR](/en-us/defender-for-identity/role-groups#required-permissions-defender-for-identity-in-microsoft-defender-xdr) | Global Administrator, Security Administrator, Cloud App Security Administrator |
-| Enable | See [Required permissions Defender for Identity in Microsoft Defender XDR](/en-us/defender-for-identity/role-groups#required-permissions-defender-for-identity-in-microsoft-defender-xdr) | Global Administrator, User Administrator, Authentication Administrator, Privileged Authentication Administrator, Directory Writers | See [Required permissions Defender for Identity in Microsoft Defender XDR](/en-us/defender-for-identity/role-groups#required-permissions-defender-for-identity-in-microsoft-defender-xdr) | Global Administrator, Security Administrator, Cloud App Security Administrator |
-| Revoke session | N/A | Global Administrator, User Administrator, Authentication Administrator, Privileged Authentication Administrator, Directory Writers, Helpdesk Administrator, SOC Identity Responder | See [Required permissions Defender for Identity in Microsoft Defender XDR](/en-us/defender-for-identity/role-groups#required-permissions-defender-for-identity-in-microsoft-defender-xdr) | N/A |
+| Disable | See [Required permissions Defender for Identity in Microsoft Defender XDR](/en-us/defender-for-identity/role-groups#required-permissions-defender-for-identity-in-microsoft-defender-xdr) | Global Administrator, User Administrator, Authentication Administrator, Privileged Authentication Administrator, Directory Writers, SOC Identity Responder, Security Operator | See [Required permissions Defender for Identity in Microsoft Defender XDR](/en-us/defender-for-identity/role-groups#required-permissions-defender-for-identity-in-microsoft-defender-xdr) | Global Administrator, Security Administrator, Cloud App Security Administrator |
+| Enable | See [Required permissions Defender for Identity in Microsoft Defender XDR](/en-us/defender-for-identity/role-groups#required-permissions-defender-for-identity-in-microsoft-defender-xdr) | Global Administrator, User Administrator, Authentication Administrator, Privileged Authentication Administrator, Directory Writers, SOC Identity Responder, Security Operator | See [Required permissions Defender for Identity in Microsoft Defender XDR](/en-us/defender-for-identity/role-groups#required-permissions-defender-for-identity-in-microsoft-defender-xdr) | Global Administrator, Security Administrator, Cloud App Security Administrator |
+| Revoke session | N/A | Global Administrator, User Administrator, Authentication Administrator, Privileged Authentication Administrator, Directory Writers, Helpdesk Administrator, SOC Identity Responder, Security Operator | See [Required permissions Defender for Identity in Microsoft Defender XDR](/en-us/defender-for-identity/role-groups#required-permissions-defender-for-identity-in-microsoft-defender-xdr) | N/A |
| Mark as compromised | N/A | Global Administrator, Security Administrator, Security Operator, SOC Identity Responder | N/A | N/A |
-| Force password change | See [Required permissions Defender for Identity in Microsoft Defender XDR](/en-us/defender-for-identity/role-groups#required-permissions-defender-for-identity-in-microsoft-defender-xdr) | Global Administrator, Privileged Authentication Administrator, Authentication Administrator, User Administrator, Password Administrator, Helpdesk Administrator, SOC Identity Responder | N/A | N/A |
+| Force password change | See [Required permissions Defender for Identity in Microsoft Defender XDR](/en-us/defender-for-identity/role-groups#required-permissions-defender-for-identity-in-microsoft-defender-xdr) | Global Administrator, Privileged Authentication Administrator, Authentication Administrator, User Administrator, Password Administrator, Helpdesk Administrator, SOC Identity Responder, Security Operator | N/A | N/A |
Note