Security Live in production

Endpoint Containment

Lock a suspected-compromised user's Intune-managed devices and contain their account (sign-in disabled, sessions revoked) with one approval and a security-namespaced audit row.

Integrates with

IntuneEntra ID

The problem

When a user's device looks compromised, moving fast limits the blast radius: the attacker's sessions, the account, and the hardware in their hands all need attention. But containment is disruptive, so it needs a clear human decision and a record of who made the call.

What AscendCore does

An admin runs the containment from Slack or Teams. AscendCore resolves the user and their Intune-managed devices, and proposes the full set on one card: disable the account's sign-in (reversible), revoke every active session, and remote-lock the screen of each listed device. On explicit approval the account and the device set are re-verified before anything runs, so a stale card never acts on the wrong target, and a device that changed since the card was posted is refused rather than locked blind. Every decision lands in the security namespace of the tamper-evident audit chain.

One scope note, stated on the card itself: remote lock secures the screens and the account cuts off new sign-ins, but the devices are not disconnected from the network. Network-level isolation is a Microsoft Defender for Endpoint capability with its own API and licensing; that is the network-isolation path for tenants that license it.

Status

Template. Approver routing is configurable per customer. Connect it to your Microsoft Intune and Entra ID tenant to enable.

Runbook source preview

Versioned, deterministic, auditable

Every runbook is defined as a versioned YAML manifest with explicit triggers, steps, and approval policies. The runbook itself is the audit-ready record of what AscendCore can and will do. Chat is just the interface that triggers it.

name: endpoint-containment
trigger:
  channels: [slack, teams]
  command: device-contain
steps:
  - resolve_user_and_devices   # user + Intune-managed device set
  - admin_approval
  - disable_account            # reversible; re-verified at execute time
  - revoke_sessions
  - remote_lock_devices        # device set re-verified at execute time
approval:
  required: true
  approvers: [it-admins, sec-team]

Ready to deploy

Run endpoint containment from Teams or Slack today

AscendCore deploys in days, not months for Slack + Okta or Teams + Entra stacks. See your first automated resolution the same day.

See plans & pricing Browse all runbooks

More security runbooks

Live

Conditional Access Policy Review

Review current conditional-access posture, flag common gaps, and record the reviewed findings on the tamper-evident audit chain with approval; policy changes remain manual.

Live

Security Alert Triage

IT-admin-initiated security triage: invoke /alert-triage on a user account when you spot suspicious activity, AscendCore proposes account suspension pending investigation, suspension executes only on explicit approval. Distinct security-event audit namespace for SOC-2 evidence separation.

Live

Suspicious Sign-In Investigation

Pull a user's recent sign-in activity into one summary card and offer an approval-gated containment action, fully audited.