[Feature Request]: Documentation - Security: Incident Response Scenario 'Pull the plug'

[NickVAg]

Please confirm:

• I have searched existing feature requests (open and closed) and found no duplicates.
• **Me or my organization is currently an active sponsor of the product at the $99,- level.

Problem Statement

Addition of security-info and suggestion on additional measures MSP's can take to 'pull the plug' on CIPP access to client tenants.

Scenario 1: Drop CIPP from GDAP groups
Scenario 2a: Revoke CIPP-SAM secrets in customer tenant
Scenario 2b: Remove/delete CIPP-SAM app registration in customer tenant

Can be achieved by creating own app registration and perhaps rolling out through CIPP even

(have not completed this myself yet. But thought to submit this and give back to the community)

Benefits for MSPs

Improves security and incident response if CIPP ever has an oopsie.

Value or Importance

Notable value, as it is an additional measure MSP's can implement to be able and quickly respond across their tenants at once. Only to be used as incident response (and hopefully never required to use). But great to have this in

PowerShell Commands (Optional)

No response

[Zacgoose]

Just to clarify this a bit, no need to touch client tenants, the quickest actions are
Remove the service account from GDAP groups, revoke secrets and certificates from the CIPP-SAM app in partner tenant and or delete the CIPP-SAM app from the partner tenant. Deleting the app requires re-onbaording all tenants into CIPP once recovery is needed, else re-issuing certificates and secrets and adding back to GDAP groups will restore access for CIPP. This does not factor in client tenant IOCs and persistent access in their environments.