Remediation Actions

Remediation actions

When you're handling an incident, you don't just document what happened—you take steps to contain and fix it. Petra lets you record and, when remediation is enabled for the tenant, perform actions such as locking the account, resetting the password, ending sessions, or removing malicious emails from mailboxes. This article explains what remediation actions are available and how they work from a user's perspective.

Why remediation actions matter

Remediation actions are the concrete steps you take to stop an attacker and restore security. Locking the account prevents further sign-ins; resetting the password invalidates the attacker's access; ending sessions logs them out of active sessions. Deleting a phish from all inboxes stops others from clicking it. Disabling an inbox rule or a malicious app removes the attacker's persistence. Recording these actions in Petra keeps an audit trail and updates the incident's status so your team knows what's been done.

Common actions you can take

Petra typically supports actions such as: Lock account—disable the user's account in Microsoft 365 so they (and the attacker) can't sign in until you re-enable it. Reset password—force a password change so the current password no longer works. End sessions—revoke existing sign-in sessions so the attacker is logged out immediately. Delete phish from mailboxes—remove the malicious email from the affected user's mailbox (and optionally from other users who received the same phish) so it can't be clicked again. Disable inbox rule—turn off a rule the attacker created to forward or hide emails. Disable app registration—revoke an application the attacker used for access or persistence. The exact list may vary by tenant and by what's enabled for your organization.

Enabling remediation and taking action

For some tenants, remediation actions are available directly from the incident view: you'll see buttons or links to lock the account, reset password, and so on. For others, you may need to enable remediation first (often by re-authorizing with Microsoft so Petra has the right permissions). If you don't see the option to take an action, check whether remediation is enabled for that tenant and whether your role has permission. When you perform an action, Petra records it on the incident and may update the remediation status, so the incident history reflects what you did and when. That way, remediation in Petra is both actionable and auditable.