When you have to deal with a security breach with account(s) being compromised, the time response to stop thread spreading within your environment is very important.
Either you have or not a SOC team, usually the first responders to such activity is the support team.
Unfortunately, until now there was no easy way, because of the least privilege access, to delegate the required permissions to disable account (user management with limited permission to administrative accounts), revoke sign-in sessions or reset password (password administrator) as all these permissions are split across different roles.
Well, good news as now a new role – Entra SOC Identity Responder – now provides theses permissions within one single role.
Thanks to the new role, first responder to account compromise situation can easily contains the compromised account before starting investigating the potential blast radius.