Microsoft Security Operations Analyst Associate SC-200 Practice Question

Choosing Disable user in the Microsoft 365 Defender portal changes the user account state in Microsoft Entra ID to Disabled. A disabled account cannot obtain new access tokens, so all sign-in attempts are blocked, containing the compromise until remediation steps such as password reset can be completed.

• Revoke user sessions signs the user out of current sessions but does not block new sign-ins with the same credentials.
• Reset password is an important remediation step, yet the attacker could continue to authenticate until the password is actually changed; disabling the account gives you immediate containment.
• Confirm user compromised only updates the investigation status-it does not itself block authentication.