Microsoft XDR Incident - Account Compromised
1. Revoke sessions: Go to Entra ID (Azure AD) and search for the impacted user. Click Revoke Sessions on the top ribbon.

2. Reset User password from either Entra ID, or have user reset password from Windows and perform an AD to Azure sync.