Microsoft Security Operations Analyst Associate SC-200 Practice Question

Choosing the Disable user (also called Block sign-in) action changes the account's Azure AD sign-in state to blocked. This prevents all interactive and non-interactive authentication attempts until you manually re-enable the account, fully containing the threat during investigation.

• Confirm user compromised only labels the risk state and may trigger automated remediation policies, but it does not itself prevent sign-ins.
• Revoking refresh tokens signs the user out of current sessions but still allows new authentications as long as the account is enabled.
• Requiring a password reset forces the user to change credentials at the next logon, yet the account can still authenticate, so it does not guarantee immediate containment.

Therefore, disabling the user is the appropriate immediate containment step.