Secure recovery without weakening identity protection. Review passwordless methods, SSPR, risk policy and session containment, then resolve two original Northstar incidents.
Two original Northstar Services incidents: safe passwordless recovery after a lost factor and a combined risky-user/service-principal alert. Correct decisions advance the ticket.
Northstar's new employee lost their enrolled Authenticator phone before completing a phishing-resistant passkey setup. The help desk must validate identity, restore method registration and preserve access controls.
Investigate the original Northstar alert, apply least-disruptive but effective containment, prove unauthorized access is denied, and restore legitimate access with an auditable trail.
Fictional sign-ins and sessions · No Microsoft tenant or production data · Existing Practice 015 progress is unchangedRisk data is a signal, not a conclusion. Correlate sources and verify the user's account of the activity through a trusted channel.
02:18 UTC · Finance app · unfamiliar device and IP · high sign-in risk · suspicious authentication sequence
Employee confirms they were asleep and did not recognize this sign-in.
Correlated mailbox-rule change and elevated user-risk signal; investigate for downstream access.
Active Entra refresh session plus a third-party SaaS cookie whose lifetime is controlled by that SaaS.
Set response controls, confirm the compromise, then validate that attacker sessions cannot continue. A risk label does not independently revoke access.
Test the attack paths while contained, then release the identity and confirm the approved employee and audit trail. Run the SaaS check explicitly: Entra session revocation isn't universal SaaS logout.
Attacker attempts another Entra authentication.
Previously issued refresh session attempts to renew access.
Previously authenticated third-party tab requests protected data.
Approved employee signs in with the recovered credential and methods.
Incident review, true-positive decision and remediation are recorded.
0/5 evidence checks passed · Current stage: triage
Revisit the standalone guide or explore the SC-300 objective map for additional authentication and identity risk topics.
