Incident containment
Incident containment is the part of incident response focused on stopping an incident from expanding and limiting further damage while responders investigate and address the compromise.
Limit the damage while the investigation continues
Isolating a compromised endpoint or restricting a compromised account can keep an incident from spreading. Those actions may interrupt legitimate work too, so responders need to understand which services depend on the access they are cutting off.
Containment is one part of incident response. NIST distinguishes it from eradication, which addresses problems such as persistence and exploited entry points, and recovery, which restores affected operations. A contained system can still need investigation and repair.
Closing an account does not close every session
In an identity incident, revoking Entra refresh tokens and ending an application’s session are different actions. Microsoft Entra ID cannot directly revoke a session token issued by an application. Its owner may need to terminate that session separately.
The identity containment review works through these separate sources of access. Confirm that the affected service refuses the compromised access; a successful administrative command only confirms that the command completed.
Keep a record of the restrictions, their operational impact, and who can lift them. That lets the team restore legitimate access deliberately without undoing containment before the cause has been addressed.