Scenario 07 — Identity Risk Response Playbook

Business Problem

IDSentinel Solutions' Security Operations team had no standardized process for responding to identity-based alerts surfaced by Entra Identity Protection. When risky sign-in events fired, analysts were triaging them manually through the Entra portal — no documented runbook, no consistent remediation steps, and no audit trail proving the event was investigated and closed.

A P1 incident involving a compromised contractor account exposed the gap: the analyst who responded documented nothing, the remediation actions were inconsistent with what policy required, and the post-incident review had no evidence to work from.

Risk

No documented runbook means inconsistent response quality depending on who is on-call
Manual triage through the Entra portal adds 20–40 minutes to MTTR per incident
No RCA template means repeat incidents cannot be tracked or trended
Missing audit trail fails SOC 2 CC7.2 (incident response) and CC7.3 (incident documentation) controls
Risky sign-in events left unactioned allow attackers to maintain persistence

Playbook Scope — 5 Phases

Phase	NIST SP 800-61 Equivalent	Actions
Detection	Detect	Identity Protection alert fires on anonymized IP
Investigation	Analyze	Graph API pulls risk detail, detections, sign-in logs
Containment	Contain	Account disabled, all sessions revoked
Remediation	Eradicate	Password reset, account re-enabled, risk dismissed
Post-Incident	Recover + Document	RCA completed, SOC 2 evidence packaged

Solution Design

The playbook uses the existing OAuth2 app registration from Scenario 06 — no new app registration required. Additional permissions added: IdentityRiskyUser.ReadWrite.All and IdentityRiskEvent.Read.All.

All investigation and containment steps are performed programmatically via Graph API rather than manual portal triage — producing a documented, reproducible evidence trail that satisfies SOC 2 audit requirements.

Implementation

01

Simulate Risky Sign-In and Confirm Detection
Tor Browser used to authenticate as test user wking@IDSentinelSolutions.com through a Tor exit node. Entra Identity Protection classified this as an anonymizedIPAddress risk event and flagged the user as at-risk.
02

Update App Registration Permissions
Existing app registration updated with additional permissions required for risk investigation and dismissal. No new service principal required.

03

Investigate via Graph API

All three investigation queries run programmatically via Postman:

Query 1 — Risky User Detail

GET /v1.0/identityProtection/riskyUsers
  ?$filter=userDisplayName eq 'wking'
  &$select=id,riskLevel,riskState,riskLastUpdatedDateTime

Query 2 — Risk Detection Events

GET /v1.0/identityProtection/riskDetections
  ?$filter=userDisplayName eq 'wking'
  &$select=riskEventType,riskLevel,detectedDateTime,ipAddress,location

Query 3 — Sign-In Log Correlation

GET /v1.0/auditLogs/signIns
  ?$filter=userPrincipalName eq 'wking@IDSentinelSolutions.com'
           and createdDateTime ge 2026-05-13T00:00:00Z

04

Containment — Account Disable + Session Revocation

PowerShell — Disable Account

# Disable account
$body = @{ accountEnabled = $false } | ConvertTo-Json
Invoke-MgGraphRequest -Method PATCH `
  -Uri "https://graph.microsoft.com/v1.0/users/$userId" `
  -Body $body

# Revoke all active sessions
Invoke-MgGraphRequest -Method POST `
  -Uri "https://graph.microsoft.com/v1.0/users/$userId/revokeSignInSessions"

05

Remediation — Password Reset + Risk Dismissal
Password reset performed via Active Directory on-premises — wking is a directory-synced user. Passwords are mastered on-prem; Entra reflects the change after the next sync cycle. Account re-enabled and risk state dismissed via Graph API POST to /identityProtection/riskyUsers/dismiss. Risk state confirmed dismissed.
06

Post-Incident Documentation + RCA
Root cause identified: CA risk policy was scoped to High risk only — Medium risk sign-ins were logged but not challenged. CA policy updated to challenge Medium risk with MFA step-up. RCA filed as SOC 2 CC7.2/CC7.3 evidence. Playbook added to SOC runbook library as INC-TYPE-001.

Outcome

End-to-end Identity Risk Response Playbook built and documented across 5 NIST-mapped phases

Graph API automation replaces manual portal triage — containment in under 5 minutes following runbook

Hybrid identity behavior correctly handled — on-prem password sync documented in runbook

Risk state confirmed dismissed via Graph API following all remediation steps

CA policy gap identified — Medium risk sign-ins now challenge with MFA step-up

RCA filed as SOC 2 CC7.2/CC7.3 evidence — complete audit trail from detection to closure

Incident Summary

Field	Value
Incident ID	INC-2026-007
Severity	P2 — Medium Risk
Affected User	wking@IDSentinelSolutions.com
Detection Source	Entra Identity Protection
Risk Event Type	anonymizedIPAddress (Tor exit node)
Detection Time	2026-05-13 UTC
SOC 2 Controls	CC7.2, CC7.3
Root Cause	CA risk policy scoped to High risk only — Medium risk sign-ins not challenged
Corrective Action	CA policy updated to challenge Medium risk with MFA step-up

Files

scripts/Invoke-IdentityRiskContainment.ps1PowerShell — account disable and session revocation
runbooks/INC-TYPE-001-Identity-Risk-Response.mdSOC runbook — full 5-phase playbook
templates/RCA-Template.mdRoot cause analysis template
evidence/INC-2026-007/Complete evidence package for this incident
diagrams/risk-response-flow.pngNIST-mapped response flow diagram
screenshots/Evidence of implementation — detection, investigation queries, containment, remediation, RCA

Identity Risk Response Playbook

Business Problem

Risk

Playbook Scope — 5 Phases

Solution Design

Implementation

Simulate Risky Sign-In and Confirm Detection

Update App Registration Permissions

Investigate via Graph API

Containment — Account Disable + Session Revocation

Remediation — Password Reset + Risk Dismissal

Post-Incident Documentation + RCA

Outcome

Incident Summary

Files

References