Skip to main content
Response Actions are write operations that let you contain a threat directly from inside RAIDEN, without opening a separate Microsoft admin portal. They cover the most time-critical containment steps: cutting off active sessions, disabling an account, blocking further access via Conditional Access, and cleaning up malicious inbox rules.
Response Actions can be triggered manually by clicking the button in the case at any time. They can also run automatically — but only if you opt in. Automated response is off by default. You choose what RAIDEN is permitted to do on its own, and you can turn it off again at any time.

​
Automated response (opt-in)

By default, RAIDEN never takes a write action on its own — it investigates, reaches a verdict, and recommends. If you want RAIDEN to act autonomously on the clearest threats, you can opt in from Settings → Automation. When automated response is enabled, RAIDEN only acts when all of the following are true:
  • You have turned on automated response for the tenant (auto_remediate_on_high_confidence) — off by default
  • The AI investigation reaches a True Positive verdict at high or medium confidence
  • The case is High or Critical severity
When those conditions are met, RAIDEN automatically revokes the user’s active sessions, removes any malicious inbox rules it found, recalls confirmed-malicious sent emails (when the case includes malicious send / send-as activity), records a suppression entry, and writes a detailed note to the case explaining exactly what it did and why. Everything it does is also available as a manual one-click action, so nothing happens that you couldn’t have done yourself from the case view. Disabling the account is a separate, second opt-in. Automatically disabling a compromised account is controlled by its own toggle (auto_disable_account) — also off by default — because it is the most disruptive action. You can enable session revocation and inbox-rule cleanup as your automated baseline while still requiring a human to approve a full account disable.
For AD-synced accounts (on-premises Active Directory synced to Entra ID), an automatic disable creates a Conditional Access block in Entra ID rather than setting the cloud account to disabled. This stops Microsoft 365 sign-ins, but you must still disable the on-prem AD account to fully contain the user. See Hybrid AD Setup.

​
Available actions

​
Revoke all active sessions

Immediately invalidates all active login sessions for the selected user. The user is signed out of every device and application connected to your M365 tenant. Use this as your first containment step when you suspect an account has been compromised. It forces the attacker out while you investigate further.

​
Disable account

Prevents the user from signing in entirely. Unlike revoking sessions, disabling the account stops any new authentication attempts until the account is re-enabled.

​
Re-enable account

Restores sign-in access for a previously disabled account. Use this once you have confirmed the threat is resolved and the account is safe to hand back to the user.

​
Create Conditional Access block policy

Creates a Conditional Access policy in your M365 tenant that blocks the targeted user from signing in. This is a persistent block that remains in place until you remove the policy from your Azure AD / Entra ID admin centre.
This action creates a real policy in your Microsoft tenant. To remove it, go to your Entra ID admin centre and delete the policy from the Conditional Access section.

​
Read and delete inbox rules

Reads and removes malicious inbox rules from the user’s mailbox. Attackers commonly create inbox rules to forward emails to external addresses or hide security alerts from the compromised user.
Review the inbox rules listed before deleting. Deleted inbox rules cannot be restored through RAIDEN.

​
How to use Response Actions

Response Actions are available in the Remediation panel inside a case view.
1

Open the case

Go to Cases and open the case you are investigating.
2

Find the Remediation panel

Scroll to the Remediation panel within the case view.
3

Review the recommended actions

Read the Recommended Actions listed for the case. These are written in plain language and tell you which response actions are most appropriate for this specific threat.
4

Click the action button

Click the button for the action you want to take. RAIDEN will execute it immediately against your Microsoft 365 tenant.
5

Document in Case Notes

Record what action you took and when using Case Notes. This creates an audit trail for the investigation.
These permissions are requested during initial setup so they are available the moment you need them. By default they are only exercised when you click a button. If you opt in to automated response in Settings → Automation, RAIDEN may also invoke session revocation and inbox-rule cleanup automatically on high- or medium-confidence True Positive cases — see Automated response (opt-in) above. Automated response is off by default and fully configurable.