Microsoft Security Operations Analyst Associate SC-200 Practice Question

Microsoft's incident-response guidance for BEC stresses disabling the compromised Microsoft Entra ID account as the initial containment step. Disabling sign-in instantly prevents the attacker from accessing Microsoft 365-including the ability to send further emails-while the underlying Exchange Online mailbox and its data remain intact for investigators. Blocking outbound email alone limits only one attack path and still leaves the attacker signed in. Removing inbox rules does not terminate access, and revoking sessions may leave active tokens valid for up to an hour, permitting continued abuse. Therefore, disabling the user account is the most effective first action.