Explore Expel’s auto remediations: Disable user account

This document explains Expel’s “disable user account” auto-remediation—why and when analysts should disable compromised identities, how the action is detected, validated, executed (via IdP APIs like Microsoft Graph), and how customers can configure pre-approval rules and exclusions; it focuses on containment scenarios such as impossible travel, MFA fatigue, confirmed phishing, credential stealers, and lateral movement and outlines post-action investigation and restore steps.