In June, Microsoft announced it would extend the Security Operator role with additional capabilities. Microsoft has now introduced a new admin role: Entra SOC Identity Responder, which includes most of the previously mentioned permissions.
Microsoft is extending the Entra Security Operator role so SOC analysts can take identity response actions such as disable users, revoke sessions, mark users compromised, force password resets (including cloud-only accounts), and delete individual authentication methods , directly from the Microsoft Defender unified role-based access control (RBAC) experience, without broad Entra admin roles or identity and access management (IAM) escalation during active incidents. Permissions are scoped to non-admin users enabling faster containment, least-privilege boundaries, and auditability.
Note
A newly published role may take some time to become fully active.
Users with the Entra SOC Identity Responder role can disable and re-enable user accounts, force sign-out across all active sessions by invalidating refresh tokens, and reset passwords for cloud-only accounts. The role also supports scoping to administrative units.
The responsibilities are tightly scoped to incident containment: quickly locking down a compromised account, terminating any active attacker sessions, and resetting credentials so the legitimate user can regain safe access. This makes the role well suited to SOC analysts who need to act decisively during a live security incident but should not otherwise be able to reshape the broader identity environment.
Role Template ID: 58f930cc-fcf4-4152-852c-1d7dbf502139
Role permissions:
microsoft.directory/users/disable
microsoft.directory/users/enable
microsoft.directory/users/invalidateAllRefreshTokens
microsoft.directory/users/password/update
