Remove Red Canary Active Remediation Access from Your Microsoft Defender Console
- 16 Jul 2024
- 1 Minute to read
- PDF
Remove Red Canary Active Remediation Access from Your Microsoft Defender Console
- Updated on 16 Jul 2024
- 1 Minute to read
- PDF
Article summary
Did you find this summary helpful?
Thank you for your feedback
Removing permissions for the Red Canary Cyber Incident Response Team (CIRT) requires deleting the Active Remediation access package. This access package, created using Microsoft Identity Governance, contains an elevated permissions role within Microsoft Defender for Endpoint necessary for Red Canary's Active Remediation service.
Step 1: Azure–Delete the Microsoft Azure identity governance access package for Active Remediation
Note: If Red Canary services are still going to be used, do not delete the standard Red Canary access package. You only need to delete the Red Canary Active Remediation access package.
From your Azure portal, log in with your global administrator account.
Expand the navigation pane, and then click Azure Active Directory.
Click Identity Governance, and then click Catalogs.
Select Red Canary catalog.
From the Manage section, click Access Packages, and then click Red Canary Active Remediation Access Package.
From the access package overview screen, click Delete.
Click Yes.
Step 2: Azure–Delete the Active Remediation security group
From your Azure portal, log in with your global administrator account.
Expand the navigation pane, and then click Azure Active Directory.
Click Groups, and then click New Group.
Search for the Red Canary Active Remediation group.
Select Red Canary Active Remediation, and then click Delete.
Click Yes at the confirmation prompt.
Step 3: Microsoft Defender XDR–Delete the role-based access permissions in Microsoft Defender for Endpoint
From your Microsoft Defender XDR portal, log in with your global administrator account.
Click Settings, and then click Endpoints.
Click Roles.
Select the Red Canary Active Remediation role.
At the confirmation screen, click Delete.
Was this article helpful?
