Team: Huntress Managed Identity Threat Detection and Response (ITDR)
Product: Microsoft 365
Environment: Cloud
Summary: Understand which response actions Huntress takes during a Microsoft 365 identity incident, which actions need your approval, and which remediations your team completes.

In This Article

Response Actions
Password Reset Remediation
Rogue Device Removal
What Happens If Nobody Responds?
Approve or Reject Remediations
Notifications and Escalation
Test Before Activation
Frequently Asked Questions

Response Actions

Huntress provides multi-layered response capabilities to contain compromised accounts and remove adversary persistence in Microsoft 365.

Response actions fall into three distinct remediation categories:

• Active (containment): Huntress performs the action automatically as soon as the Security Operations Center (SOC) sends the incident report. No approval is needed.

• Assisted: Huntress performs the action only after you approve the remediation plan in the incident report.

• Manual: Huntress can't perform the action directly. A Microsoft 365 administrator completes it within the tenant.

The following table details available response actions, their system effects, and who executes them:

Password Reset Remediation (Available Nov 3)

Session revocation signs the attacker out, but an attacker who still knows the password can sign back in. The password reset remediation closes that gap.

How It Works

Understand how the assisted password reset functions during an incident:

• The SOC analyst adds "Reset Password" as an assisted remediation to the identity incident report.

• The reset does not run until you approve the remediation plan. If the activity is authorized or a false positive, reject the plan and the reset will not run.

• When approved, Huntress sets a new, randomly generated password and requires the user to change it at their next sign-in.

• Huntress never stores, displays, or sends the generated password. It is not included in the incident report or sent by email. Nobody, including Huntress, knows its value. Its sole purpose is to invalidate the attacker's credentials.

What This Means for Your Team

Plan for credential restoration following an assisted reset:

• The user can't sign in on their own after the reset because they do not know the temporary value. Plan for a Microsoft 365 administrator to restore access.

• Resolving the incident report re-enables a disabled identity, but it does not undo the password reset. The user still requires an administrator to restore access.

• Password reset is not available for identities synced from on-premises Active Directory (AD). For those users, reset the password directly in on-premises AD.

Rogue Device Removal (Available Nov 3)

After stealing a session, attackers often register their own device in Microsoft Entra ID. That device can allow them to regain access even after a password change.

When the SOC identifies an attacker-registered device, the analyst adds Delete Device to the incident report. When you approve the action, Huntress deletes the device from the tenant.

Windows Hello for Business keys are tied to the device where they were registered. Deleting the device is the primary method to remove an attacker's Windows Hello for Business persistence.

What Happens If Nobody Responds?

Huntress prioritizes immediate containment to protect your environment, even outside standard business hours.

If Identity Isolation is enabled, Huntress revokes the user's sessions and disables the identity when the SOC sends the incident report, even if nobody acknowledges the alert.

Assisted remediations, including password reset and device deletion, never run automatically. They wait until an authorized user approves the remediation plan. Manual, administrator-led actions also remain incomplete until your team performs them.

Approve or Reject Remediations

You can review, execute, or decline proposed remediation actions directly from the Huntress platform.

1. Open the incident report and select Review Remediation Plan.

2. Review each proposed step, then select Approve or Reject.

3. Track progress on the Remediations tab. Each step shows Success, In Progress, or Failure.

If you already remediated the findings, the activity is authorized, or the report is a false positive, reject the plan and choose a rejection reason (for example, Manually remediated or Approved Microsoft 365 user activity). For more details, see Reject Incident Report Remediations.

Notifications and Escalation

Huntress delivers multi-channel alerting to ensure critical threats receive prompt visibility.

Incident reports are sent by email and via professional services automation (PSA) when configured. Critical incidents also trigger an automated SMS text and/or phone call to configured contacts. The automated call directs the contact to the Huntress platform; it is an automated dispatch, not an analyst call.

Huntress supports one SMS text or phone call per unique identity or endpoint within a 24-hour period. The notification process does not guarantee retries, callbacks, overnight escalation, or a morning review. Huntress recommends partners define their own internal acknowledgment process, administrator coverage schedules, and escalation procedures.

For configuration instructions, see Incident Notifications - SMS Texts & Calls and Huntress Platform - Notification Categories and Routing.

Test Before Activation

You can safely validate your alert delivery and response workflows prior to live deployment.

The supported test is a Critical Incident Simulation. For Microsoft 365, the selected identity's sessions are revoked, and the identity is disabled within seconds. You then receive a simulated incident report and notifications. Approving the remediation plan resolves the incident and re-enables the identity. Simulated reports do not include assisted remediations such as password reset.

Frequently Asked Questions

How will I receive the new password after a reset?

You will not receive it. Huntress never stores, displays, or transmits the generated password. A Microsoft 365 administrator must restore the user's access using your organization's standard credential recovery process.

Will Huntress reset a password automatically?

No. Password reset is an assisted remediation. It runs only after an authorized partner approves the remediation plan on the incident report.

Can I request a password reset outside of an active incident?

No. Password reset and device deletion execute strictly as assisted remediations tied to an active incident report.

What is required to receive these new assisted remediations?

Tenants on version 6 of the Huntress application automatically receive the required permissions. To locate tenants running older configurations, check the Integration Version column on the Integrations page. Reauthorize outdated tenants by following Reauthorize Huntress Managed ITDR Integration.

Why did I receive a Privileged Identity Management (PIM) notification or see a new role assignment in Microsoft Entra ID?

The password reset remediation requires Huntress to hold the Privileged Authentication Administrator role, which covers all directory users, including administrators. Device deletion requires the Device.ReadWrite.All Graph permission. PIM notifications and role assignment alerts are expected. For details, see Huntress Managed ITDR Permissions Breakdown.