Suspend or restore a user account in Office 365 Cloud App Security
Office 365 Advanced Security Management is now Office 365 Cloud App Security.
|Evaluation >||Planning >||Deployment >||Utilization|
||You are here!
Suppose that you receive an alert that one of your organization's user accounts for Office 365 has been compromised. Or, suppose that you've received an alert that indicates something is wrong with a user account. With Office 365 Cloud App Security, you can suspend a user account and later restore it after you have investigated the alerts you receive.
Office 365 Cloud App Security is available in Office 365 Enterprise E5. If your organization is using another Office 365 Enterprise subscription, Office 365 Cloud App Security can be purchased as an add-on. (As a global administrator, in the Office 365 admin center, choose Billing > Add subscriptions.) For more information, see Office 365 Platform Service Description: Office 365 Security & Compliance Center and Buy or edit an add-on for Office 365 for business.
To suspend a user account in Office 365 Cloud App Security
When you suspend a user account, you prevent the user from signing in again. It's the same as editing the user account directly in Office 365 to set the Sign-in status to Sign-in blocked.
If you block a user from signing in to Office 365, either by suspending them or by editing their sign-in status, be aware that it can take an hour or so to take effect on all of the user's devices and clients (Edit or change a user in Office 365). If the user is signed in to Office 365, the block will take effect whenever Office 365 requires them to sign in again.
In the Security & Compliance Center, choose Alerts > Manage advanced alerts.
Choose Go to Office 365 Cloud App Security.
In the navigation bar across the top of the screen, choose Alerts.
In the Alert column, double-click an alert that pertains to a specific user account.
Under Accounts, in the Status column, choose Settings > Suspend user.