Microsoft XDR Incident - Account Compromised 1. Revoke sessions: Go to Entra ID (Azure AD) and search for the impacted user. Click Revoke Session