Check directory synchronization before relying on a Cloud Apps user suspension

Source facts

Defender for Cloud Apps offers a Suspend user governance action for connected applications. Microsoft warns that when Microsoft Entra ID automatically synchronizes users from on-premises Active Directory, the on-premises settings override Entra settings and the suspension action is reverted. The Governance log records manual and automatic task status, including action success or failure. Microsoft Learn.

Applicability

Use this boundary for a synchronized identity involved in a connected-app response. Establish where the account state is authoritative before interpreting a successful cloud-side action as continuing containment. This brief concerns user activity governance, not the retiring file-policy workflow.

DSE recommendation

Include the authoritative directory owner in the containment decision and verify that the intended restriction survives synchronization. Record the chosen response across the relevant identity systems, who may approve it and how the account can safely return to service. Do not repeatedly reapply a reverted cloud action without resolving the authority conflict. Preserve the action history for the incident investigator.

Verification

With an approved test identity, record the initial account state, governance action result and subsequent synchronized state. Check the resulting access behavior through the intended application rather than relying only on the action’s success entry. Compare the outcome with the containment plan and keep a reversion open as a failed persistence requirement. Restore the test identity through the agreed owner-controlled process, documenting the final state in both systems.

Official references

Microsoft Learn: Governance actions for connected apps. Source reviewed September 9, 2026.