In this module

AD6.7 The After-Hours Decision

5-6 hours · Module 6 · Free

Operational Objective

Incidents don't respect business hours. A high-severity alert at 22:00 on Wednesday presents a decision: respond now (disrupting your evening, potentially making mistakes when tired), escalate to the managed SOC (if available), or wait until morning (giving the attacker hours of additional access). This subsection provides the after-hours decision framework: which incidents can wait, which can't, who to contact, and how to make the right call when you're the only person available.

Deliverable: An after-hours decision matrix with clear criteria for "respond now," "escalate to SOC," and "triage in the morning" — eliminating the 22:00 guesswork.

Estimated completion: 20 minutes

Figure AD6.7 — The after-hours decision matrix. "Respond now" for active threats where minutes matter. "Escalate to SOC" for confirmed compromises that need overnight monitoring. "Morning triage" for contained threats that can wait 8 hours. The decision is based on whether the attacker has active access — not on the alert severity alone.

The decision criterion: active attacker access

The after-hours decision comes down to one question: does the attacker currently have active access to your environment?

If yes (active session, credentials working, no containment in place), you need to act — either respond yourself or escalate to a SOC. Every hour of inaction is an hour of attacker access.

If no (Safe Links blocked the click, CA policy denied the sign-in, phishing email was quarantined), the threat is contained and the investigation can wait until morning. You lose nothing by sleeping — the containment is already in place.

If uncertain (suspicious sign-in from unfamiliar IP but no confirmed post-compromise activity), take the minimum containment action from your phone or laptop (revoke sessions — one PowerShell command or one portal click), then investigate fully in the morning. Revoking sessions is safe even if the sign-in turns out to be legitimate — the user re-authenticates the next time they access M365. The cost of an unnecessary session revocation at 22:00 is one re-authentication prompt. The cost of NOT revoking when it's a real compromise is overnight attacker access.

The "phone response" — minimum viable containment

If you receive a high-severity alert after hours and need to respond from your phone:

Option 1 — Entra portal on mobile browser: Navigate to entra.microsoft.com on your phone's browser → Users → search for the user → "Revoke sessions." This terminates the attacker's access in 30 seconds from your phone. Then investigate fully in the morning.

Option 2 — Azure mobile app: The Microsoft Azure mobile app includes Entra ID user management. You can revoke sessions and reset passwords from the app without opening a browser.

Option 3 — Phone the managed SOC: If you have a SOC partner, call their escalation number and tell them to revoke sessions for the affected user immediately. They have portal access and can execute in real-time while you provide context by phone.

The minimum viable containment (revoke sessions) takes 30 seconds from any device. Full investigation can wait for a proper workstation in the morning. Don't attempt to investigate sign-in logs, check inbox rules, or run PowerShell scripts from your phone at midnight — you'll miss things and make mistakes. Contain, then investigate properly when you're at your desk, rested, and have your full toolkit available.

Weekend and holiday incident patterns

Attackers prefer weekends and holidays — not because they're malicious geniuses who know your schedule, but because automated attack tools run continuously, and the credential compromises that happen on Friday evening have the longest window before detection on Monday morning. Your monitoring cadence creates a 60-hour gap between Friday 17:00 and Monday 09:00 — your longest detection window.

Mitigations for the weekend gap:

High-severity alert notifications (AD5.6) — configured for immediate email, these push critical events to you regardless of the day. You don't need to be at your desk to receive them.

Managed SOC coverage — the SOC monitors 24/7 including weekends. For high-severity events, they can contain immediately and notify you for follow-up.

Automatic attack disruption (AD6.8) — Microsoft's automated containment fires regardless of whether anyone is monitoring. A BEC attack at 02:00 on Saturday may be automatically disrupted before anyone sees the alert.

Monday review prioritisation — start every Monday review by checking the incident queue sorted by newest first. Weekend incidents appear at the top. Investigate these before the stable checks (Secure Score, compliance rate).

If your quarterly report shows a pattern of incidents occurring on weekends with Monday detection, that's evidence for the managed SOC business case: "4 of 6 incidents in Q2 occurred outside business hours. Detection delay averaged 36 hours. Managed SOC coverage would reduce this to under 1 hour."

Setting personal boundaries for after-hours response

As an IT administrator who also handles security, establish clear boundaries:

What you WILL do after hours: Check your phone for high-severity alert notifications. If one arrives, execute the minimum viable containment (revoke sessions — 30 seconds from your phone). Forward the alert to the managed SOC if available. Note the incident for morning follow-up.

What you will NOT do after hours: Full investigations from your phone. PowerShell scripting at midnight. Multi-hour incident responses without on-call compensation. These activities need a proper workstation, a clear head, and ideally the business context that comes from contacting users and managers during working hours.

Communicate these boundaries to your manager. "I receive high-severity security alerts on my phone and can take basic containment actions (revoking compromised sessions) in under a minute. For full investigation and response, I'll work from my desk during normal hours. If the organization needs guaranteed after-hours security response beyond basic containment, we should evaluate either formal on-call arrangements or managed SOC coverage."

This isn't being unhelpful — it's being honest about what sustainable security monitoring looks like for a solo IT administrator. Burning out on midnight incident responses helps nobody, and a tired responder makes more mistakes than a rested one who starts at 09:00. The procedures in this module are designed for exactly this model: minimum viable containment after hours (30 seconds), full response during business hours (15-20 minutes).

Worked after-hours scenarios

Scenario A — Saturday 14:00, phishing email detected. Alert: "Phishing email delivered to 3 users." Safe Links shows all 3 clicks were blocked. This is a "morning triage" — Safe Links contained the threat. No active attacker access. Note it, enjoy your Saturday, and handle it Monday: purge the email, block the sender, close the incident.

Scenario B — Wednesday 21:00, credential compromise for a.patel (standard user). Alert: "Suspicious sign-in from unfamiliar location." MFA satisfied by claim. Post-compromise activity: 2 inbox rules created. You have a managed SOC. Response: from your phone, revoke a.patel's sessions (1 minute). Email the SOC: "Incident ID 12345 — confirmed credential compromise, sessions revoked. BEC indicators present (inbox rules). Please monitor overnight and disable the rules if you have mailbox access. I'll complete full response at 09:00 tomorrow." Then go to sleep. You've contained the active access. The SOC monitors. You complete AD6.2 steps 3-5 in the morning.

Scenario C — Sunday 02:00, credential compromise for s.chen (CEO). Alert: "Suspicious sign-in followed by inbox manipulation — executive account." This is "respond NOW" regardless of the time. The CEO's mailbox contains board communications, financial decisions, and strategic plans. From your phone: revoke sessions immediately. Call the SOC's emergency number (don't email — this needs immediate confirmation). From your laptop (if accessible): reset s.chen's password. Send a text or call s.chen directly: "Your M365 account was temporarily secured due to a security event. I'll call you at 09:00 to explain and help you sign back in." Complete the full response first thing in the morning.

Scenario D — Friday 19:00, ransomware indicators on file server. Alert from SOC or Defender: "Suspicious file encryption activity." This is "respond NOW" — ransomware is time-critical. Every minute of encryption means more data lost. From your phone: confirm the SOC can isolate the server (if MDE-managed). If not MDE-managed, call someone who can physically access the server to disconnect the network cable. Don't try to investigate the ransomware yourself — containment (network isolation) is the only after-hours action. Everything else waits for proper investigation in the morning (or for the external IR team if ransomware is confirmed).

Communicating after-hours containment to users

If you revoke sessions or reset passwords after hours, the affected user may try to sign in and find themselves locked out. Prepare a brief message:

Template (SMS or Teams): "Hi [name], your M365 account was secured at [time] due to a security event. You may be unable to sign in until I can assist you. I'll contact you at [time] to help you sign back in. No action is needed from your side. If urgent, call me at [phone]."

This message: confirms the lockout is deliberate (not a system failure), sets expectations for when they'll regain access, prevents the user from attempting password recovery (which could interfere with your response), and provides a contact method for genuine urgency.

Don't send this message via the compromised user's M365 email — the attacker may still have access to read it (if session revocation hasn't fully propagated). Use SMS, a personal phone call, or a messaging app outside M365.

Compliance Myth: "A dedicated IT admin should be available 24/7 for security incidents"

24/7 availability is an on-call requirement that should be formally defined, compensated, and resourced — not informally assumed. Unless your employment contract includes on-call security duties (with appropriate compensation and time-off-in-lieu), you're not obligated to respond at 22:00. The managed SOC exists for after-hours coverage. If your organization doesn't have a managed SOC and expects after-hours security response, that's a resourcing gap that management needs to address — either by contracting a managed SOC or by formalising and compensating on-call duties. Document this gap in your quarterly report: "After-hours security coverage depends on informal IT administrator availability. Formal on-call arrangements or managed SOC coverage recommended."

Decision point

It's 23:30 on a Friday. You receive a high-severity notification: "Suspicious sign-in followed by inbox manipulation" for user s.chen (the finance director). The Defender incident shows sign-in from an unfamiliar IP and 2 inbox rules created. You have a managed SOC. What do you do?

Option A: It's Friday night — investigate Monday morning.

Option B: From your phone: revoke s.chen's sessions immediately (1 minute). Forward the alert to the managed SOC with: "Finance director account — confirmed compromise. Sessions revoked. Please investigate and monitor overnight. I'll complete the full procedure at 09:00 tomorrow." Then go back to sleep — the SOC has it covered, and you'll do the full AD6.2 + AD6.4 (BEC for finance director) procedure in the morning.

The correct answer is Option B. The finance director's account is high-value for BEC — the attacker is likely targeting financial workflows. Friday night to Monday morning is 60 hours of potential attacker access. Revoking sessions from your phone takes 1 minute and eliminates the active access. The SOC provides overnight monitoring. You complete the thorough response in the morning when you can properly investigate inbox rules, sent items, and potential BEC indicators.

Try it: Test mobile containment

From your phone (not your work computer), try these containment actions:

1. Mobile browser: Navigate to entra.microsoft.com on your phone. Sign in. Navigate to a test user. Find the "Revoke sessions" button. (Don't click it on a production user — just verify you can find it.)

2. Azure mobile app: Install the Microsoft Azure app. Sign in. Navigate to Entra ID → Users → search for a test user. Verify you can access user management functions.

3. Managed SOC escalation: Save the SOC's escalation phone number in your phone contacts. Save their escalation email as a draft template: "HIGH SEVERITY — [Incident ID] — [User] — Sessions revoked at [time]. Please investigate and monitor. Full investigation at 09:00."

Test these on a quiet afternoon — not at 23:30 during a real incident. When the real incident happens, you'll know exactly how to respond from your phone in under 2 minutes.

At 01:00 on Saturday, you receive an alert: "Phishing email detected — URL blocked by Safe Links" for user a.patel. Safe Links blocked the click. No sign-in anomalies for a.patel. What do you do?

Respond immediately — it's a phishing attack — Safe Links already blocked the click. The user didn't reach the phishing page. There's no active attacker access.

Escalate to the managed SOC — The threat is already contained by Safe Links. The SOC will agree it's a blocked event and close it.

Note it and investigate during your next Monday review — the click was blocked, the user is safe, and the investigation (scoping other recipients, blocking the sender, purging the email) can wait for business hours — Correct. No active attacker access. Safe Links contained the threat. The investigation adds value (scope, block, purge) but isn't urgent. This is a "morning triage" incident.

Reset a.patel's password as a precaution — The click was blocked. a.patel didn't enter credentials. A password reset at 01:00 disrupts the user without security benefit.

Operational Artifact — After-Hours Decision Matrix

**Respond NOW:** Active ransomware, active exfiltration, executive account compromise. Minimum action: revoke sessions from phone (30 seconds), then escalate. **Escalate to SOC:** Confirmed non-executive compromise, BEC with active rules, multiple users. Quick contain + handoff. **Morning triage:** Blocked phishing click, contained DLP match, low-severity sign-in anomaly. No active access = no urgency. **Decision criterion:** Does the attacker currently have active access? If yes: act or escalate. If no: morning. If uncertain: revoke sessions (safe even if false positive), then investigate in the morning.

You're reading the free modules of M365 Security: From Admin to Defender

The full course continues with advanced topics, production detection rules, worked investigation scenarios, and deployable artifacts.

View Pricing See Full Syllabus

← Previous Next →