Compromised User Account Automation

Editors Insight

Overview

When a user account is suspected to be compromised, acting quickly and thoroughly is critical—but manually locking down access across systems can be complex and error-prone. Missing a single step could leave sensitive client data exposed and allow attackers to maintain access.

To solve this problem, Pia has developed the Compromised Account Lockdown automation. It enables engineers to swiftly and comprehensively restrict access by automatically locking down the user’s account(s) across key systems—ensuring no steps are missed and client data remains secure.

Flow

Compromised User Account Security Lockout Chatbot flow:

1. Pia will ask you to choose the compromised account from the drop-down list.
2. Pia will determine where the affected user account resides (On-Prem AD, Entra (Azure), or both).
3. Pia will disable the user account in On-Prem AD (if it exists).
4. Pia will disable the user account in Entra (Azure) (if it exists).
5. Pia will generate a temporary password (not provided to the engineer).
6. Pia will set the password in On-Prem AD and Azure as applicable (Cloud Hybrid users only in On-Prem AD).
7. Pia will revoke sign-in sessions in Entra (Azure) (if applicable).
8. Pia will perform a sync between On-Prem and Azure for Cloud Hybrid users.
9. Pia will check the user’s mailbox in Exchange Online for forwarding or inbox rules (Azure users).
10. If rules are found, they will be output in a chat message to the engineer.
11. Pia will create a transport rule to block all outgoing emails from the user’s mailbox (Azure users).
12. Pia will output the last ten sign-ins for the account in the chat message.
13. Pia will store user data including UPN and transport rule name for future package runs.

1. Run the Pia Account Locked Out automation
2. Select the user you wish to unlock
3. Pia will run the remove locked out user block extension and remove the block rule placed by the compromised user account automation to unlock the account
4. Pia will perform the usual actions of the account locked out automation, by unlocking the account