---
title: "Response Actions for Entra ID"
slug: "response-actions-for-entra-id"
updated: 2026-09-09T16:09:35Z
published: 2026-09-09T16:09:35Z
canonical: "docs.redcanary.com/response-actions-for-entra-id"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://docs.redcanary.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Response Actions for Entra ID

> [!NOTE]
> **Note:** Red Canary is now Zscaler MDR. Please bear with us while we update the naming in our third-party integrations.

The Zscaler MDR [Automation](/doc/docs/automation) interface provides the following four response actions for Microsoft Entra ID:

**Clear User Sessions** Invalidates all refresh tokens and session cookies for a user account, forcing them to re-authenticate with any applications they've previously authorized.

**Suspend User** Disables the user account within Entra ID and the associated on-prem AD identity (when possible).

**Unsuspend User** Re-enables the user account within Entra ID and the associated on-prem AD identity (when possible).

**Force Password Reset** Updates the user account in Entra ID to require a password reset at the next login. Note that this doesn't log the user out, so typically you'll combine it with a Clear User Sessions action to properly deal with potentially compromised credentials.

The necessary Azure permissions will be requested automatically when you add an action to a playbook. For more information about the permissions required, see [Permission Requirements for Microsoft](/doc/docs/permission-requirements-for-microsoft).

## **Prerequisites**

- You have the Global Administrator role in Azure
- You know your Azure Tenant ID
- You have an active Zscaler MDR integration that streams the relevant Microsoft Entra ID identity logs. Typically this will be either an [Entra ID integration](/doc/docs/integrate-microsoft-entra-id-with-red-canary) or a [Office 365 integration](/doc/docs/connect-red-canary-to-office-365).

> [!NOTE]
> Important!
> 
> If you need these actions to work for users with elevated permissions such as Global Administrators, you’ll also need to assign Zscaler MDR the Privileged Authentication Administrator role in Entra ID. See [Assigning the Privileged Auth Admin Role](/doc/docs/response-actions-for-entra-id#assigning-the-privileged-auth-admin-role) for details.

## Adding Entra ID Response Actions to a Playbook

To add one or more Entra ID response actions to an Automate playbook:

1. From the Zscaler MDR portal navigation menu, select **Automation > Playbooks**.
2. In the **Playbooks** section, open an existing Automate playbook or make a new one by clicking **+Create New Playbook**.
3. Assign or edit the playbook name and description, then click **+Add Action**. ![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/entraresponse-1_01.png?sv=2026-02-06&spr=https&st=2026-11-01T16%3A23%3A20Z&se=2026-11-01T17%3A23%3A20Z&sr=c&sp=r&sig=TZwDYU01V3bksz93CQUGcn6Kn7rInrpJvjzj26OJoI4%3D)
4. From the **Microsoft Entra ID** section, add the required action to the playbook. ![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/entraresponse-1_02.png?sv=2026-02-06&spr=https&st=2026-11-01T16%3A23%3A20Z&se=2026-11-01T17%3A23%3A20Z&sr=c&sp=r&sig=TZwDYU01V3bksz93CQUGcn6Kn7rInrpJvjzj26OJoI4%3D)
5. Enter your **Azure Tenant ID**. ![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/entraresponse-1_03.png?sv=2026-02-06&spr=https&st=2026-11-01T16%3A23%3A20Z&se=2026-11-01T17%3A23%3A20Z&sr=c&sp=r&sig=TZwDYU01V3bksz93CQUGcn6Kn7rInrpJvjzj26OJoI4%3D)
6. In order to set the required Entra ID permissions for this action, click **this consent link** and log in to your Microsoft account as a Global Administrator. ![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/entraresponse-1_04.png?sv=2026-02-06&spr=https&st=2026-11-01T16%3A23%3A20Z&se=2026-11-01T17%3A23%3A20Z&sr=c&sp=r&sig=TZwDYU01V3bksz93CQUGcn6Kn7rInrpJvjzj26OJoI4%3D)
7. Review the permissions requested by the Zscaler MDR app and click **Accept**. ![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/entraresponse-1_05.png?sv=2026-02-06&spr=https&st=2026-11-01T16%3A23%3A20Z&se=2026-11-01T17%3A23%3A20Z&sr=c&sp=r&sig=TZwDYU01V3bksz93CQUGcn6Kn7rInrpJvjzj26OJoI4%3D)

> [!NOTE]
> Note
> 
> The first time you add an Entra ID response action, accepting these permissions will automatically install the Red Canary + Azure AD Response Actions enterprise app in Azure.
8. After you’ve accepted the permissions request, check the **Confirm Microsoft Automate API Access Granted** box. ![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/entraresponse-1_06.png?sv=2026-02-06&spr=https&st=2026-11-01T16%3A23%3A20Z&se=2026-11-01T17%3A23%3A20Z&sr=c&sp=r&sig=TZwDYU01V3bksz93CQUGcn6Kn7rInrpJvjzj26OJoI4%3D)
9. [OPTIONAL] Check the **Require Approval** box and provide contact details if you want someone to approve this action before it executes. This will apply to both manual and automatically-triggered executions. ![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/entraresponse-1_07.png?sv=2026-02-06&spr=https&st=2026-11-01T16%3A23%3A20Z&se=2026-11-01T17%3A23%3A20Z&sr=c&sp=r&sig=TZwDYU01V3bksz93CQUGcn6Kn7rInrpJvjzj26OJoI4%3D)
10. Click **Save**.

## Manually Executing the Response Actions

To execute the Entra ID response actions manually:

1. Open the playbook and click **Run**. ![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/entraresponse-1_08.png?sv=2026-02-06&spr=https&st=2026-11-01T16%3A23%3A20Z&se=2026-11-01T17%3A23%3A20Z&sr=c&sp=r&sig=TZwDYU01V3bksz93CQUGcn6Kn7rInrpJvjzj26OJoI4%3D)
2. Search for the user identity in the dropdown list then click **Run**. ![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/entraresponse-1_09.png?sv=2026-02-06&spr=https&st=2026-11-01T16%3A23%3A20Z&se=2026-11-01T17%3A23%3A20Z&sr=c&sp=r&sig=TZwDYU01V3bksz93CQUGcn6Kn7rInrpJvjzj26OJoI4%3D)
3. Click the **Follow along…** link to view the results of the action. ![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/entraresponse-1_10.png?sv=2026-02-06&spr=https&st=2026-11-01T16%3A23%3A20Z&se=2026-11-01T17%3A23%3A20Z&sr=c&sp=r&sig=TZwDYU01V3bksz93CQUGcn6Kn7rInrpJvjzj26OJoI4%3D) If you set the action to **Require Approval**, you’ll need to approve it before it can execute.

![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/entraresponse-1_11.png?sv=2026-02-06&spr=https&st=2026-11-01T16%3A23%3A20Z&se=2026-11-01T17%3A23%3A20Z&sr=c&sp=r&sig=TZwDYU01V3bksz93CQUGcn6Kn7rInrpJvjzj26OJoI4%3D)

## Automatically Executing the Response Actions

To execute the Entra ID response actions automatically, link an appropriate trigger to the playbook. For more information, see [Customize When a Playbook is Run With Triggers](/doc/docs/customize-when-a-playbook-is-run-with-triggers).

## Assigning the Privileged Auth Admin Role

If you want to run Entra ID response actions on privileged users, you’ll need to log in to your Azure portal and grant the [Privileged Authentication Administrator](https://learn.microsoft.com/en-us/entra/identity/role-based-access-control/permissions-reference#privileged-authentication-administrator) role to the Red Canary app.

1. From your Azure homepage, select the **Microsoft Entra ID** Azure service**.**
2. In the navigation pane, go to **Manage > Roles and administrators**.

![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/entraresponse-3_01.png?sv=2026-02-06&spr=https&st=2026-11-01T16%3A23%3A20Z&se=2026-11-01T17%3A23%3A20Z&sr=c&sp=r&sig=TZwDYU01V3bksz93CQUGcn6Kn7rInrpJvjzj26OJoI4%3D)
3. Use the search bar to locate and open the **Privileged Authentication Administrator** role.

![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/entraresponse-3_02.png?sv=2026-02-06&spr=https&st=2026-11-01T16%3A23%3A20Z&se=2026-11-01T17%3A23%3A20Z&sr=c&sp=r&sig=TZwDYU01V3bksz93CQUGcn6Kn7rInrpJvjzj26OJoI4%3D)
4. Go to the **Active assignments** tab and click **Add assignments**. ![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/entraresponse-3_03.png?sv=2026-02-06&spr=https&st=2026-11-01T16%3A23%3A20Z&se=2026-11-01T17%3A23%3A20Z&sr=c&sp=r&sig=TZwDYU01V3bksz93CQUGcn6Kn7rInrpJvjzj26OJoI4%3D)
5. Under **Select member(s)**, click **No member selected**.

![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/entraresponse-3_04.png?sv=2026-02-06&spr=https&st=2026-11-01T16%3A23%3A20Z&se=2026-11-01T17%3A23%3A20Z&sr=c&sp=r&sig=TZwDYU01V3bksz93CQUGcn6Kn7rInrpJvjzj26OJoI4%3D)
6. Choose the **Red Canary + Azure AD Response Actions** enterprise application and click **Select**.

![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/entraresponse-3_05.png?sv=2026-02-06&spr=https&st=2026-11-01T16%3A23%3A20Z&se=2026-11-01T17%3A23%3A20Z&sr=c&sp=r&sig=TZwDYU01V3bksz93CQUGcn6Kn7rInrpJvjzj26OJoI4%3D)
7. Click **Next >**. ![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/entraresponse-3_06.png?sv=2026-02-06&spr=https&st=2026-11-01T16%3A23%3A20Z&se=2026-11-01T17%3A23%3A20Z&sr=c&sp=r&sig=TZwDYU01V3bksz93CQUGcn6Kn7rInrpJvjzj26OJoI4%3D)
8. Set the assignment duration to **Permanently assigned** and enter a justification note.

![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/entraresponse-3_07.png?sv=2026-02-06&spr=https&st=2026-11-01T16%3A23%3A20Z&se=2026-11-01T17%3A23%3A20Z&sr=c&sp=r&sig=TZwDYU01V3bksz93CQUGcn6Kn7rInrpJvjzj26OJoI4%3D)
9. Click **Assign**.