Identity Live in production

Compromised Account Response

Contain a suspected account compromise in one approval: revoke every active session, invalidate the password, and force MFA re-enrollment, fully audited.

Integrates with

OktaEntra ID

The problem

When an account is reported phished or flagged as compromised, the first minutes matter. Doing the containment steps by hand across the identity provider and email is slow at exactly the moment speed counts.

What AscendCore does

An admin invokes the response on the affected user from Slack or Teams. One approval card, with destructive-action styling because this one is disruptive, runs the full containment set: every active Okta session is revoked, the password is invalidated (the user receives a reset email), all MFA factors are reset so the user re-enrolls, and when the user has a Microsoft Entra ID counterpart its sessions are revoked too. Each containment step continues even when another fails, so one failed call never blocks the rest, and the result is honest: any failed step reports the containment as incomplete. The decision and per-step outcomes land in the audit chain under a dedicated incident-response namespace.

Status

Live in production. Runs against real Okta and Microsoft Entra ID tenants today from Slack and Teams; the full containment set (revoke sessions across both directories, invalidate the password, reset MFA) executes with per-step outcomes in the audit chain. Approver routing is configurable per customer.

Runbook source preview

Versioned, deterministic, auditable

Every runbook is defined as a versioned YAML manifest with explicit triggers, steps, and approval policies. The runbook itself is the audit-ready record of what AscendCore can and will do. Chat is just the interface that triggers it.

name: compromised-account-response
trigger:
  channels: [slack, teams]
  commands: [account-compromise]
steps:
  - resolve_target_user         # Okta
  - admin_approval              # destructive-action styling
  - verify_account              # re-checked at execute time
  - revoke_okta_sessions        # every device, every browser
  - invalidate_password         # user gets a reset email
  - reset_mfa_factors           # forces re-enrollment
  - revoke_entra_sessions       # when an Entra counterpart exists
approval:
  required: true
  approvers: [it-admins, sec-team]

Ready to deploy

Run compromised account response from Teams or Slack today

AscendCore deploys in days, not months for Slack + Okta or Teams + Entra stacks. See your first automated resolution the same day.

See plans & pricing Browse all runbooks

More identity runbooks

Live

Access Role Change

Multi-system orchestrated role transitions for promotions, transfers, and contractor-to-FTE conversions. Five seed roles ship out of the box (support tiers, sales SDR/AE, engineering contractor/FTE/intern, HR generalist/manager); each transition produces a single approval card showing the full access diff and executes sequentially across Okta + Entra + Jira + M365 with per-step audit outcomes.

Live

Account Unlock

Automate Microsoft Entra ID and Okta account unlocks from Slack and Teams. Identity verification, approval-gated unlock, failed-login counter reset.

Live

Dormant Account Review

Find Okta accounts inactive beyond a configurable threshold and propose suspending them in one approval-gated review, fully audited.