{"id":18076,"date":"2026-08-26T08:01:55","date_gmt":"2026-08-25T23:01:55","guid":{"rendered":"https:\/\/m365jp.net\/?p=18076"},"modified":"2026-08-26T08:03:42","modified_gmt":"2026-08-25T23:03:42","slug":"mc1461704-microsoft-defender-xdr-unified-response-actions-across-identity-accounts","status":"publish","type":"post","link":"https:\/\/m365jp.net\/index.php\/2026-08-26-mc1461704-microsoft-defender-xdr-unified-response-actions-across-identity-accounts","title":{"rendered":"MC1461704 | Microsoft Defender XDR: Unified response actions across identity accounts"},"content":{"rendered":"
\n
\n
\n\n\n\n
MC1461704 | Microsoft Defender XDR: Unified response actions across identity accounts<\/th>\n<\/tr>\n<\/tbody>\n<\/table>\n
\n\n\n\n\n\n\n\n\n
Classification<\/th>\nplanForChange<\/td>\n<\/tr>\n
Last Updated<\/th>\n08\/25\/2026 22:21:35<\/td>\n<\/tr>\n
Start Time<\/th>\n08\/25\/2026 22:21:28<\/td>\n<\/tr>\n
End Time<\/th>\n12\/21\/2026 08:00:00<\/td>\n<\/tr>\n
Message Content<\/th>\n\n

[What and why:]<\/b><\/p>\n

Microsoft Defender XDR is expanding identity response actions into a unified experience across linked accounts.
Security teams will be able to apply supported response actions to all supported accounts associated with an identity,
or to selected accounts, from a single workflow. <\/p>\n

Available actions depend on the identity system or connector managing the account and may include: <\/p>\n

    <\/p>\n
  • Disable account<\/li>\n

    <\/p>\n

  • Enable account<\/li>\n

    <\/p>\n

  • Revoke session<\/li>\n

    <\/p>\n

  • Mark as compromised<\/li>\n

    <\/p>\n

  • Force password change<\/li>\n

    <\/ul>\n

    Supported identity systems and applications include: <\/p>\n

      <\/p>\n
    • Active Directory<\/li>\n

      <\/p>\n

    • Microsoft Entra ID<\/li>\n

      <\/p>\n

    • Okta<\/li>\n

      <\/p>\n

    • CyberArk Identity<\/li>\n

      <\/p>\n

    • SailPoint Identity Security Cloud<\/li>\n

      <\/p>\n

    • Google Workspace<\/li>\n

      <\/p>\n

    • Salesforce<\/li>\n

      <\/p>\n

    • Box<\/li>\n

      <\/ul>\n

      This enhancement helps security operations teams respond more quickly and consistently to compromised identities across connected identity providers and SaaS applications. <\/p>\n

      [Rollout schedule:]<\/b><\/p>\n

        <\/p>\n
      • Worldwide, GCC, GCC High, DoD:<\/b> Rollout begins mid-October 2026 and is expected to complete by mid-October 2026.<\/li>\n<\/ul>\n

        Who is affected<\/b><\/p>\n

          <\/p>\n
        • Security Operations Center (SOC) analysts<\/li>\n

          <\/p>\n

        • Incident responders<\/li>\n

          <\/p>\n

        • Identity administrators<\/li>\n

          <\/p>\n

        • Administrators managing Microsoft Defender-connected identity systems<\/li>\n

          <\/ul>\n

          Platforms and services<\/b><\/p>\n

            <\/p>\n
          • Microsoft Defender XDR<\/li>\n

            <\/p>\n

          • Microsoft Defender for Identity<\/li>\n

            <\/p>\n

          • Microsoft Defender for Cloud Apps<\/li>\n

            <\/p>\n

          • Microsoft Entra ID<\/li>\n

            <\/p>\n

          • Supported third-party identity provider and SaaS application connectors<\/li>\n

            <\/ul>\n

            What will happen<\/b><\/p>\n

              <\/p>\n
            • Authorized analysts can initiate supported response actions from the Identity page, Identity side panel, Advanced Hunting, or Action center.<\/li>\n

              <\/p>\n

            • Available response actions vary based on the identity system or connector managing each account.<\/li>\n

              <\/p>\n

            • Administrators can review action status in Action center and in audit records generated by the target system.<\/li>\n

              <\/p>\n

            • No account changes occur unless an authorized analyst initiates a response action or Microsoft Defender Automatic Attack Disruption applies a supported automated response action.<\/li>\n

              <\/ul>\n

              [Action required \/ Recommendations:]<\/b><\/p>\n

              No action is required to enable this capability. However, we recommend that administrators: <\/p>\n

Machine Translation<\/th>\n\n

[\u4f55\u3092\u3001\u306a\u305c:]<\/b><\/p>\n

Microsoft Defender XDR\u306f\u3001\u9023\u7d50\u3055\u308c\u305f\u30a2\u30ab\u30a6\u30f3\u30c8\u9593\u3067\u30a2\u30a4\u30c7\u30f3\u30c6\u30a3\u30c6\u30a3\u5fdc\u7b54\u30a2\u30af\u30b7\u30e7\u30f3\u3092\u7d71\u5408\u3055\u308c\u305f\u4f53\u9a13\u306b\u62e1\u5f35\u3057\u3066\u3044\u307e\u3059\u3002
\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u30c1\u30fc\u30e0\u306f\u3001ID\u306b\u95a2\u9023\u3059\u308b\u3059\u3079\u3066\u306e\u30b5\u30dd\u30fc\u30c8\u30a2\u30ab\u30a6\u30f3\u30c8\u306b\u5bfe\u3057\u3066\u30b5\u30dd\u30fc\u30c8\u5fdc\u7b54\u30a2\u30af\u30b7\u30e7\u30f3\u3092\u9069\u7528\u3067\u304d\u308b\u3088\u3046\u306b\u306a\u308a\u307e\u3059\u3002
\u307e\u305f\u306f\u3001\u5358\u4e00\u306e\u30ef\u30fc\u30af\u30d5\u30ed\u30fc\u304b\u3089\u9078\u629e\u3055\u308c\u305f\u30a2\u30ab\u30a6\u30f3\u30c8\u3078\u3002<\/p>\n

\u5229\u7528\u53ef\u80fd\u306a\u30a2\u30af\u30b7\u30e7\u30f3\u306f\u3001\u30a2\u30ab\u30a6\u30f3\u30c8\u3092\u7ba1\u7406\u3059\u308b\u30a2\u30a4\u30c7\u30f3\u30c6\u30a3\u30c6\u30a3\u30b7\u30b9\u30c6\u30e0\u307e\u305f\u306f\u30b3\u30cd\u30af\u30bf\u306b\u4f9d\u5b58\u3057\u3001\u4ee5\u4e0b\u306e\u3088\u3046\u306a\u3082\u306e\u304c\u542b\u307e\u308c\u308b\u5834\u5408\u304c\u3042\u308a\u307e\u3059:<\/p>\n