Microsoft Defender for Identity action accounts

Defender for Identity now allows you to create action accounts. These accounts are used to allow you to take actions on users directly from Defender for Identity.

We recommend you create the gMSA account Defender for Identity will use to run the available remediation actions.

Create and configure the action account

  1. On a domain controller in your domain, create a new gMSA account, following the instructions in Getting started with Group Managed Service Accounts.

  2. Assign the "Log on as a service" right to the gMSA account on each domain controller that runs the Defender for Identity sensor.

  3. Grant the required permissions to the gMSA account.

    1. Open Active Directory Users and Computers.

    2. Right-click the relevant domain or OU, and select Properties.

      Select properties of domain or OU.

    3. Go the Security tab and select Advanced.

      Advanced security settings.

    4. Select Add.

    5. Choose Select a principal. Choose select a principal.

    6. Make sure Service accounts is marked in Object types. Select service accounts as object types.

    7. Enter the name of the gMSA account in the Enter the object name to select box and select OK.

    8. Select Descendant User objects in the Applies to field, leave the existing settings, and add the following permissions and properties: Set permissions and properties.

      • To enable force password reset:
        • Permissions:
          • Reset password
        • Properties:
          • Read pwdLastSet
          • Write pwdLastSet
      • To disable user:
        • Properties:
          • Read userAccountControl
          • Write userAccountControl
    9. Select Descendant Group objects in the Applies to field and set the following properties:

      • Read members
      • Write members
    10. Select OK.

Note

It's recommended to not use the same gMSA account you configured for Defender for Identity managed actions on servers other than domain controllers. If the server is compromised, an attacker could retrieve the password for the account and gain the ability to change passwords and disable accounts.

Add the gMSA account in the Microsoft 365 Defender portal

  1. Go to the Microsoft 365 Defender portal.

  2. Go to Settings -> Identities.

  3. Under Microsoft Defender for Identity, select Manage action accounts.

  4. Select +Create new account to add your gMSA account.

  5. Provide the account name and domain, and select Save.

  6. Your action account will be listed on the Manage action accounts page.

    Create action account.

Remediation actions in Defender for Identity

Next steps