GOV-04CriticalMaximum Security
Automate Threat Response with SOAR
Governance & Hygiene control for Microsoft 365 and Entra ID
Why This Control Matters
Manual incident response takes hours. Automated playbooks respond to threats in seconds. Level 3 organizations minimize attacker dwell time by automatically containing compromised accounts.
Expected State
When this control is compliant, your tenant should meet these criteria:
- 1High-risk detections trigger automated playbooks
- 2Compromised users have sessions revoked and accounts disabled automatically
- 3Security Operations Center (SOC) integration with escalation workflows
Enforcement
Default Mode
Strict
Zero-tolerance enforcement with immediate remediation
Auto-Remediation
Manual Only
Requires Microsoft Sentinel or equivalent SOAR platform
Ready to implement this control?
TrueConfig continuously monitors your Microsoft 365 tenant for compliance with this and 50+ other security controls.