Microsoft Entra ID - Disable Users

This incident response workflow allows you to disable one or more users in Microsoft Entra ID from a playbook. When using this workflow in a playbook, the user selects which users to disable. Supported observables: user, email

Target: Microsoft Entra ID

Steps:

• Detect the start type and extract the supported observables
• Check if any supported observables were found (if not, end the workflow)
• For each observable:
  • Check this observable's type:
    • If a user, set the local username variable
    • If an email, set the local email variable
  • Search for a matching user
  • Check if the user was found:
    • If not, update the result and continue to the next user
  • Attempt to extract the first match's user ID:
    • If this fails, update the result and continue to the next user
  • Check if the user is already disabled:
    • If so, update the result and continue to the next user
  • Attempt to disable the user
  • Check if the user was disabled and update the workflow results accordingly