Available actions
Revoke all active sessions
Immediately invalidates all active login sessions for the selected user. The user is signed out of every device and application connected to your M365 tenant. Use this as your first containment step when you suspect an account has been compromised. It forces the attacker out while you investigate further.| Detail | Value |
|---|---|
| Permission used | User.RevokeSessions.All |
| Effect | Signs the user out of all active sessions immediately |
| Reversible | Yes — the user can sign back in with their credentials |
Disable account
Prevents the user from signing in entirely. Unlike revoking sessions, disabling the account stops any new authentication attempts until the account is re-enabled.| Detail | Value |
|---|---|
| Permission used | User.EnableDisableAccount.All |
| Effect | Blocks all sign-in attempts for the account |
| Reversible | Yes — use Re-enable account when ready |
Re-enable account
Restores sign-in access for a previously disabled account. Use this once you have confirmed the threat is resolved and the account is safe to hand back to the user.| Detail | Value |
|---|---|
| Permission used | User.EnableDisableAccount.All |
| Effect | Restores sign-in access |
| Reversible | Yes — you can disable again at any time |
Create Conditional Access block policy
Creates a Conditional Access policy in your M365 tenant that blocks the targeted user from signing in. This is a persistent block that remains in place until you remove the policy from your Azure AD / Entra ID admin centre.This action creates a real policy in your Microsoft tenant. To remove it, go to your Entra ID admin centre and delete the policy from the Conditional Access section.
| Detail | Value |
|---|---|
| Permission used | Policy.ReadWrite.ConditionalAccess |
| Effect | Creates a persistent sign-in block policy in Entra ID |
| Reversible | Yes — delete the policy from Entra ID |
Read and delete inbox rules
Reads and removes malicious inbox rules from the user’s mailbox. Attackers commonly create inbox rules to forward emails to external addresses or hide security alerts from the compromised user.| Detail | Value |
|---|---|
| Permission used | MailboxSettings.ReadWrite |
| Effect | Reads existing inbox rules and deletes selected ones |
| Reversible | No — deleted rules cannot be recovered through RAIDEN |
How to use Response Actions
Response Actions are available in the Remediation panel inside a case view.Review the recommended actions
Read the Recommended Actions listed for the case. These are written in plain language and tell you which response actions are most appropriate for this specific threat.
Click the action button
Click the button for the action you want to take. RAIDEN will execute it immediately against your Microsoft 365 tenant.
These permissions are requested during initial setup so they are available when needed. By default they are only exercised when you click a button. If you enable automation in Settings → Automation, RAIDEN may also invoke them automatically for high-confidence detections — automated actions are off by default and fully configurable.