Identity containment actions
5 actions in the scorecard's Identity domain: which of eighteen platforms document each against a named target, and the vendor page that shows it. Read 2026-11-03 and 2026-11-04.
5actions
The grid for this domain
- native, vendor-documented
- partner or third-party documented
- custom step only
- not documented on the pages read
| Platform | Identity | ||||
|---|---|---|---|---|---|
| Disable user | Force password reset | Revoke sessions or tokens | Require MFA re-enrolment | Remove from group or role | |
| Cyware5 of 5 documented | |||||
| Palo Alto Cortex XSOAR5 of 5 documented | |||||
| ServiceNow Security Operations5 of 5 documented | |||||
| Swimlane5 of 5 documented | |||||
| Tines5 of 5 documented | |||||
| BlinkOps4 of 5 documented, not ranked | BlinkOps: Require MFA re-enrolment, not documented | ||||
| D3 Security4 of 5 documented | D3 Security: Require MFA re-enrolment, not documented | ||||
| Google Security Operations4 of 5 documented | Google Security Operations: Require MFA re-enrolment, not documented | ||||
| Splunk SOAR (Cisco)4 of 5 documented | Splunk SOAR (Cisco): Require MFA re-enrolment, not documented | ||||
| Torq4 of 5 documented | Torq: Remove from group or role, not documented | ||||
| Exabeam3 of 5 documented, not ranked | Exabeam: Revoke sessions or tokens, not documented | Exabeam: Require MFA re-enrolment, not documented | |||
| Microsoft Sentinel3 of 5 documented | Microsoft Sentinel: Force password reset, not documented | Microsoft Sentinel: Require MFA re-enrolment, not documented | |||
| Dropzone AI2 of 5 documented | Dropzone AI: Force password reset, not documented | Dropzone AI: Require MFA re-enrolment, not documented | Dropzone AI: Remove from group or role, not documented | ||
| CrowdStrike Falcon Fusion SOAR0 of 5 documented, docs behind login | CrowdStrike Falcon Fusion SOAR: Disable user, not documented | CrowdStrike Falcon Fusion SOAR: Force password reset, not documented | CrowdStrike Falcon Fusion SOAR: Revoke sessions or tokens, not documented | CrowdStrike Falcon Fusion SOAR: Require MFA re-enrolment, not documented | CrowdStrike Falcon Fusion SOAR: Remove from group or role, not documented |
| Mate Security0 of 5 documented | Mate Security: Disable user, not documented | Mate Security: Force password reset, not documented | Mate Security: Revoke sessions or tokens, not documented | Mate Security: Require MFA re-enrolment, not documented | Mate Security: Remove from group or role, not documented |
| Prophet Security0 of 5 documented | Prophet Security: Disable user, not documented | Prophet Security: Force password reset, not documented | Prophet Security: Revoke sessions or tokens, not documented | Prophet Security: Require MFA re-enrolment, not documented | Prophet Security: Remove from group or role, not documented |
| Revelstoke (Arctic Wolf)0 of 5 documented, not ranked | Revelstoke (Arctic Wolf): Disable user, not documented | Revelstoke (Arctic Wolf): Force password reset, not documented | Revelstoke (Arctic Wolf): Revoke sessions or tokens, not documented | Revelstoke (Arctic Wolf): Require MFA re-enrolment, not documented | Revelstoke (Arctic Wolf): Remove from group or role, not documented |
| ThreatConnect0 of 5 documented, not ranked | ThreatConnect: Disable user, not documented | ThreatConnect: Force password reset, not documented | ThreatConnect: Revoke sessions or tokens, not documented | ThreatConnect: Require MFA re-enrolment, not documented | ThreatConnect: Remove from group or role, not documented |
13of 18 document it
Disable user
Disable, suspend or deactivate a user account in the identity provider so no new sign-in succeeds.
Typical targets: Okta, Microsoft Entra ID, Google Workspace, Active Directory.
- Cyware, native: Microsoft Active Directory v2: Disable user account; Okta: Deactivate User, Suspend User. techdocs.cyware.com, read
- Palo Alto Cortex XSOAR, native: Okta: okta-suspend-user, okta-deactivate-user; Microsoft Entra ID (Graph User): msgraph-user-account-disable. github.com, read
- ServiceNow Security Operations, native: Okta spoke: Suspend User; Microsoft Entra ID spoke: User Offboarding sample flow (disables the Entra account). servicenow.com, read
- Swimlane, native: Okta Identity Management: Deactivate User, Suspend User. docs.swimlane.com, read
- Tines, native: Okta: Deactivate a User template; Microsoft Entra ID: Disable User template; Google Workspace: Suspend User template. tines.com, read
- BlinkOps, native: Okta: Suspend User, Deactivate User. docs.blinkops.com, read
- D3 Security, native: Microsoft Entra ID: Disable User; Okta: Deactivate Users; Cisco ISE: Disable User. docs.d3security.com, read
- Google Security Operations, native: Okta: Disable User; Azure AD: Disable Account. cloud.google.com, read
- Splunk SOAR (Cisco), native: Okta: disable user; Microsoft Entra ID (Azure AD app): disable user; AWS IAM: disable user. github.com, read
- Torq, native: Okta: Disable and Contain a Specific Compromised User template; Microsoft Entra ID: Disable and Contain a Specific User template; Google Cloud Identity: Disable a Specific User template; Active Directory: Disable Account step. kb.torq.io, read
- Exabeam, native: Microsoft Active Directory service: Disable user account. docs.exabeam.com, read
- Microsoft Sentinel, native: Microsoft Entra ID: Block-AADUserOrAdmin playbook template (disables the user). raw.githubusercontent.com, read
- Dropzone AI, native: Google Workspace Remediator: Suspend User. docs.dropzone.ai, read
Not documented on the pages read (5): CrowdStrike Falcon Fusion SOAR, Mate Security, Prophet Security, Revelstoke (Arctic Wolf), ThreatConnect.
11of 18 document it
Force password reset
Invalidate the current credential and require a new password at next sign-in.
Typical targets: Okta, Microsoft Entra ID, Google Workspace, Active Directory.
- Cyware, native: Okta: Reset User Password; Microsoft Active Directory v2: Expire password. techdocs.cyware.com, read
- Palo Alto Cortex XSOAR, native: Microsoft Entra ID (Graph User): msgraph-user-force-reset-password; Okta: okta-expire-password; Google Workspace: gsuite-user-reset-password. github.com, read
- ServiceNow Security Operations, native: Okta spoke: Expire User Password, Reset to Temporary Password; Microsoft Entra ID spoke: Reset Password. servicenow.com, read
- Swimlane, native: Okta Identity Management: Force User Password Reset; Microsoft Graph IAM: reset password. docs.swimlane.com, read
- Tines, native: Okta: Reset Password, Expire the password templates; Microsoft Entra ID: Reset Users Password template. tines.com, read
- BlinkOps, native: Okta: Reset Password. docs.blinkops.com, read
- D3 Security, native: Okta: Reset User Passwords; Microsoft Entra ID: Reset Password. docs.d3security.com, read
- Google Security Operations, native: Okta: Reset Password; Azure AD: Reset User Password. cloud.google.com, read
- Splunk SOAR (Cisco), native: Okta: reset password, set password; Microsoft Entra ID (Azure AD app): reset password. github.com, read
- Torq, native: Microsoft Entra ID: Reset MFA Methods and Password template; Okta: compromised user template (password reset). kb.torq.io, read
- Exabeam, native: Microsoft Active Directory service: Reset password, Expire Password. docs.exabeam.com, read
Not documented on the pages read (7): Microsoft Sentinel, Dropzone AI, CrowdStrike Falcon Fusion SOAR, Mate Security, Prophet Security, Revelstoke (Arctic Wolf), ThreatConnect.
12of 18 document it
Revoke sessions or tokens
End active sessions and revoke refresh or access tokens for a user.
Typical targets: Okta, Microsoft Entra ID, Google Workspace.
- Cyware, native: Okta: Clear User Sessions; Microsoft Entra ID: Revoke Session of a User. techdocs.cyware.com, read
- Palo Alto Cortex XSOAR, native: Okta: okta-clear-user-sessions; Microsoft Entra ID (Graph User): msgraph-user-session-revoke; Google Workspace: gsuite-user-signout, gsuite-token-revoke. github.com, read
- ServiceNow Security Operations, native: Okta spoke: Clear User Session; Microsoft Entra ID spoke: Revoke User SignIn Sessions. servicenow.com, read
- Swimlane, native: Okta Identity Management: Clear User Session; Microsoft Graph IAM: revokeSignInSessions. docs.swimlane.com, read
- Tines, native: Microsoft Graph: Revoke user's sign in sessions template; Okta: End a current user session template. tines.com, read
- BlinkOps, native: Okta: Revoke All User Sessions; Microsoft Entra ID: Revoke User Sessions; Google Admin Console: Delete All Directory Tokens. docs.blinkops.com, read
- D3 Security, native: Okta: Revoke User Sessions; Microsoft Entra ID: Revoke SignIn Sessions. docs.d3security.com, read
- Google Security Operations, native: Okta: Clear Okta User Session; Azure AD: Revoke User Session; Google Workspace: Revoke User Sessions; Microsoft Graph Security: Kill User Session. cloud.google.com, read
- Splunk SOAR (Cisco), native: Okta: clear user sessions; Microsoft Entra ID (Azure AD app): disable tokens. github.com, read
- Torq, native: Okta: Clear Okta sessions for specific users template. kb.torq.io, read
- Microsoft Sentinel, native: Microsoft Entra ID (Logic Apps connector): Refresh tokens (invalidate all refresh tokens for a user). learn.microsoft.com, read
- Dropzone AI, native: Google Workspace Remediator: Revoke User Sessions. docs.dropzone.ai, read
Not documented on the pages read (6): Exabeam, CrowdStrike Falcon Fusion SOAR, Mate Security, Prophet Security, Revelstoke (Arctic Wolf), ThreatConnect.
6of 18 document it
Require MFA re-enrolment
Reset or delete a user's registered MFA factors so the user must enrol again.
Typical targets: Okta (reset factors), Microsoft Entra ID (delete authentication methods), AWS IAM (deactivate MFA device).
- Cyware, native: Okta: Reset Factors For User. techdocs.cyware.com, read
- Palo Alto Cortex XSOAR, native: Okta: okta-reset-factor; Microsoft Entra ID (Graph User): msgraph-user-authenticator-method-delete and the other method-delete commands; AWS IAM: aws-iam-deactivate-mfa-devices. github.com, read
- ServiceNow Security Operations, native: Okta spoke: Reset User Factors; AWS IAM spoke: Deactivate MFA Device. servicenow.com, read
- Swimlane, native: Microsoft Graph IAM: Delete Microsoft Authenticator Auth Method, Delete Phone Authentication Method, Delete FIDO2 Authentication Method. docs.swimlane.com, read
- Tines, native: Okta: Reset all Factors template; AWS IAM: Delete MFA Device template. tines.com, read
- Torq, native: Microsoft Entra ID: Reset MFA Methods and Password template; Okta: reset factors (compromised user template). kb.torq.io, read
Not documented on the pages read (12): BlinkOps, D3 Security, Google Security Operations, Splunk SOAR (Cisco), Exabeam, Microsoft Sentinel, Dropzone AI, CrowdStrike Falcon Fusion SOAR, Mate Security, Prophet Security, Revelstoke (Arctic Wolf), ThreatConnect.
11of 18 document it
Remove from group or role
Remove a user from a security group or revoke a role assignment to cut inherited access.
Typical targets: Okta, Microsoft Entra ID, Active Directory, Google Workspace, AWS IAM.
- Cyware, native: Okta: Remove User From Group; Microsoft Active Directory v2: Remove User From Group; AWS IAM: Remove User from Group. techdocs.cyware.com, read
- Palo Alto Cortex XSOAR, native: Okta: okta-remove-from-group; AWS IAM: aws-iam-remove-user-from-group; Google Cloud IAM: gcp-iam-project-iam-member-remove. github.com, read
- ServiceNow Security Operations, native: Okta spoke: Remove User From Group; Microsoft Entra ID spoke: Remove User from Group; AWS IAM spoke: Remove User from Group. servicenow.com, read
- Swimlane, native: Okta Identity Management: remove user from group. docs.swimlane.com, read
- Tines, native: Okta: Remove a User from a group template; Google Workspace: Delete Member from Groups template. tines.com, read
- BlinkOps, native: Okta: Remove User From Group; Microsoft Entra ID: Remove Member From Group; Google Admin Console: Remove User From Group. docs.blinkops.com, read
- D3 Security, native: Microsoft Entra ID: Remove Group Members. docs.d3security.com, read
- Google Security Operations, native: Azure AD: Remove User from the Group; Okta: Unassign Role; AWS IAM: Remove a User from a Group. cloud.google.com, read
- Splunk SOAR (Cisco), native: Okta: remove group user, unassign role; Microsoft Entra ID (Azure AD app): remove user; AWS IAM: remove user (from group). github.com, read
- Exabeam, native: Microsoft Active Directory service: Remove User From Group. docs.exabeam.com, read
- Microsoft Sentinel, native: Microsoft Entra ID (Logic Apps connector): Remove Member From Group. learn.microsoft.com, read
Not documented on the pages read (7): Torq, Dropzone AI, CrowdStrike Falcon Fusion SOAR, Mate Security, Prophet Security, Revelstoke (Arctic Wolf), ThreatConnect.