Field Notes

Offboarding is where ticket-driven shops leak access. Someone disables the AD account, forgets the refresh tokens are still valid for another hour, and the leaver keeps reading mail from a phone. This is the single pass I run — hybrid AD plus Entra plus Exchange — written to be idempotent so a half-finished run is safe to repeat.

# Disable-ADAccount needs RSAT-AD; Graph: User.ReadWrite.All, Group.ReadWrite.All
param([Parameter(Mandatory)][string]$Upn)

$log = { param($m) "{0}  {1}" -f (Get-Date -f s), $m |
         Tee-Object "./leaver-$($Upn.Split('@')[0]).log" -Append }

# 1. on-prem AD
$sam = (Get-ADUser -Filter "UserPrincipalName -eq '$Upn'").SamAccountName
if ($sam) { Disable-ADAccount $sam; & $log "AD disabled: $sam" }

# 2. Entra: block sign-in + invalidate refresh tokens (safe to re-run)
$u = Get-MgUser -UserId $Upn
Update-MgUser -UserId $u.Id -AccountEnabled:$false
Revoke-MgUserSignInSession -UserId $u.Id | Out-Null
& $log "Entra blocked + tokens revoked"

# 3. mailbox -> shared (no-op if already shared)
if ((Get-Mailbox $Upn).RecipientTypeDetails -ne 'SharedMailbox') {
  Set-Mailbox $Upn -Type Shared; & $log "mailbox -> shared"
}

# 4. strip licenses + group memberships
$skus = (Get-MgUserLicenseDetail -UserId $u.Id).SkuId
if ($skus) { Set-MgUserLicense -UserId $u.Id -AddLicenses @() -RemoveLicenses $skus | Out-Null }
Get-MgUserMemberOf -UserId $u.Id | Where-Object { $_.AdditionalProperties['@odata.type'] -eq '#microsoft.graph.group' } |
  ForEach-Object { Remove-MgGroupMemberByRef -GroupId $_.Id -DirectoryObjectId $u.Id -ErrorAction SilentlyContinue }
& $log "licenses + groups stripped"

The token revocation is the step everyone skips — disabling the account alone leaves issued refresh tokens live until expiry. Run AD disable first so dirsync doesn’t re-enable the cloud object mid-script, and note dynamic groups ignore Remove-MgGroupMemberByRef; fix the membership rule instead.

A detection fires and the clock starts. Before I escalate, before I write a single note, I do three things: read the process tree in the detection graph to find the actual parent and command line, network-contain the host so it can still talk to Falcon but nothing else, then drop into Real Time Response and grab the volatile state before the attacker’s tooling rotates it. Memory, sockets, and scheduled tasks don’t survive a reboot or a re-injection — pull them first.

Once contained, open an RTR session and run the sequence in order. Each command writes to the session log, so the queue captures provenance automatically:

# RTR session — volatile artifact capture (run top to bottom)
ps                                  # live process tree, PIDs, parents
netstat                             # active connections before they drop
ls C:\Windows\System32\Tasks        # persistence: scheduled tasks
reg query HKLM\Software\Microsoft\Windows\CurrentVersion\Run
memdump --pid 4821 dump.bin         # targeted memory of the suspect PID
get dump.bin                        # exfil artifact to Falcon cloud
get C:\Windows\System32\Tasks\<task>.xml
runscript -CloudFile=collect_prefetch

The gotcha: memdump of a full image is slow and can tip off an active operator, so dump the specific PID from ps, not the whole host. Contain first — if you RTR before containment, beaconing keeps flowing and your get uploads race the C2. Network containment keeps the sensor reachable, so the session never drops.

Stale accounts are the quietest attack surface in any tenant. This is the script I reach for when an audit turns up a pile of “hasn’t logged in since last year” objects. It runs dry by default — nothing changes until you pass -Commit.

# Requires: Microsoft.Graph module, Directory.ReadWrite.All + AuditLog.Read.All
param(
  [int]$InactiveDays = 90,
  [switch]$Commit
)

Connect-MgGraph -Scopes "User.ReadWrite.All","AuditLog.Read.All" | Out-Null
$cutoff = (Get-Date).AddDays(-$InactiveDays).ToString("o")

$stale = Get-MgUser -All -Property "id,displayName,userPrincipalName,accountEnabled,signInActivity" |
  Where-Object {
    $_.AccountEnabled -and
    $_.SignInActivity.LastSignInDateTime -and
    $_.SignInActivity.LastSignInDateTime -lt $cutoff
  }

"Found $($stale.Count) accounts inactive > $InactiveDays days" | Write-Host -ForegroundColor Yellow

foreach ($u in $stale) {
  "{0,-40} last: {1}" -f $u.UserPrincipalName, $u.SignInActivity.LastSignInDateTime | Write-Host
  if ($Commit) {
    Update-MgUser -UserId $u.Id -AccountEnabled:$false
    Add-Content -Path "./disabled-$(Get-Date -f yyyyMMdd).log" -Value $u.UserPrincipalName
  }
}

if (-not $Commit) { Write-Host "`nDRY RUN. re-run with -Commit to apply." -ForegroundColor Cyan }

Notes that bit me: signInActivity requires an Entra ID P1 license on the tenant and the AuditLog.Read.All scope, or the property comes back null and every account looks “stale.” Always confirm the property populates before you trust the filter.

Every out-of-the-box impossible-travel rule drowns you in false positives the moment someone connects through a corporate VPN egress in another region. This is the tuned version — it joins against a watchlist of known egress IPs and only fires when the velocity is physically implausible AND the ASN isn’t trusted.

let knownEgress = _GetWatchlist('CorpVpnEgress') | project IPAddress;
SigninLogs
| where ResultType == 0
| where isnotempty(LocationDetails.geoCoordinates.latitude)
| extend lat = todouble(LocationDetails.geoCoordinates.latitude),
         lon = todouble(LocationDetails.geoCoordinates.longitude)
| where IPAddress !in (knownEgress)
| sort by UserPrincipalName asc, TimeGenerated asc
| serialize
| extend prevLat = prev(lat), prevLon = prev(lon),
         prevTime = prev(TimeGenerated), prevUser = prev(UserPrincipalName)
| where UserPrincipalName == prevUser
| extend km = geo_distance_2points(lon, lat, prevLon, prevLat) / 1000.0
| extend hours = datetime_diff('minute', TimeGenerated, prevTime) / 60.0
| where hours > 0
| extend kmh = km / hours
| where kmh > 900   // faster than a commercial jet = impossible
| project TimeGenerated, UserPrincipalName, IPAddress, km, hours, kmh

The serialize + prev() pattern is the trick — it lets you compare each sign-in to the user’s previous one without an expensive self-join. Threshold of 900 km/h is deliberately above cruising speed so layovers don’t trip it. Pair it with a CrowdStrike Identity Protection policy for the response side.

The default Contributor role is a loaded gun — it can do almost everything except grant access, which means an ops engineer with Contributor can still delete your resource locks, rewrite policy assignments, and nuke a whole RG. This custom role keeps day-to-day power but removes the destructive governance verbs.

{
  "Name": "Ops Engineer (Constrained)",
  "Description": "Manage compute/network/storage. No RBAC, policy, or lock changes.",
  "Actions": [
    "Microsoft.Compute/*",
    "Microsoft.Network/*",
    "Microsoft.Storage/*",
    "Microsoft.Resources/subscriptions/resourceGroups/read",
    "Microsoft.Insights/*/read"
  ],
  "NotActions": [
    "Microsoft.Authorization/*/write",
    "Microsoft.Authorization/*/delete",
    "Microsoft.Authorization/locks/*",
    "Microsoft.Resources/subscriptions/resourceGroups/delete"
  ],
  "AssignableScopes": [
    "/subscriptions/00000000-0000-0000-0000-000000000000"
  ]
}

Deploy it with:

az role definition create --role-definition ops-constrained.json

The NotActions block is doing the real work here — Actions grants the wildcard, then NotActions carves out the governance surface. Scope it to a management group instead of a single subscription if you want it tenant-wide; just swap AssignableScopes. Keep the JSON in your IaC repo so the role is version-controlled, not click-opsed.

Every CA baseline I deploy starts with the same admission ticket: two cloud-only break-glass accounts, excluded from every policy, with 40-character random passwords sealed in the vault and alerting wired to their sign-ins. Build the exclusion group first, prove you can sign in with it, then layer policies. Skip that and the day MFA service has an outage you’re filing a support ticket from the parking lot.

# Microsoft.Graph; scopes: Policy.ReadWrite.ConditionalAccess, Group.Read.All
Connect-MgGraph -Scopes "Policy.ReadWrite.ConditionalAccess","Group.Read.All" | Out-Null

$bg = (Get-MgGroup -Filter "displayName eq 'CA-BreakGlass-Exclude'").Id

# Phishing-resistant MFA for all admin roles, break-glass excluded
$params = @{
  displayName = "BL-Admins-PhishResistantMFA"
  state       = "enabledForReportingButNotEnforced"   # report-only until verified
  conditions  = @{
    users = @{
      includeRoles    = @("62e90394-69f5-4237-9190-012177145e10") # Global Admin
      excludeGroups   = @($bg)
    }
    applications = @{ includeApplications = @("All") }
  }
  grantControls = @{
    operator        = "OR"
    authenticationStrength = @{ id = "00000000-0000-0000-0000-000000000004" } # phishing-resistant
  }
}
New-MgIdentityConditionalAccessPolicy -BodyParameter $params

Keep policies in enabledForReportingButNotEnforced for a week and read the sign-in logs before flipping to enabled — report-only shows you exactly who would have been blocked, including legacy-auth and non-compliant-device hits, without anyone losing access. Build separate policies for block-legacy-auth and require-compliant-device; one mega-policy is impossible to audit.

When one phish lands in hundreds of inboxes, deleting it user-by-user is how you lose the window. Scope it first in Defender (Explorer, or Get-MessageTrace) to pin the exact sender and subject, then let a Compliance Search action sweep the whole tenant in one pass.

# Scope it: confirm how many copies actually landed
Connect-ExchangeOnline
Get-MessageTrace -SenderAddress "no-reply@ac-payroll[.]com" `
  -StartDate (Get-Date).AddDays(-2) -EndDate (Get-Date) |
  Group-Object RecipientAddress | Sort-Object Count -Descending

# Build + run a tenant-wide content search on the unique markers
Connect-IPPSSession
New-ComplianceSearch -Name "Phish-AcPayroll" `
  -ExchangeLocation All `
  -ContentMatchQuery 'from:no-reply@ac-payroll.com AND subject:"Action required: payroll update"'
Start-ComplianceSearch -Identity "Phish-AcPayroll"
Get-ComplianceSearch -Identity "Phish-AcPayroll" | Select Status, Items

# Purge once the item count looks right
New-ComplianceSearchAction -SearchName "Phish-AcPayroll" `
  -Purge -PurgeType SoftDelete

The gotcha is -PurgeType. SoftDelete (the default) drops the message into Recoverable Items — users and IR can still pull it back, which is what you usually want. HardDelete marks it for permanent removal and is unrecoverable. A single purge action also caps at 10 items per mailbox, so run the search again after the action completes to confirm the count actually hit zero before you call it contained.