User Recovery & Access Restoration

1. Prerequisites

• Containment confirmation (all sessions, tokens, and credentials addressed)
• Session revocation status
• MFA reset status
• Identity integrity assessment findings
• Access to identity provider
• Access to MFA platform
• Access to endpoint management platform
• Access to SIEM
• Access to service desk tooling

2. Step-by-Step Instructions

1. Validate Containment Completion

   • Confirm sessions revoked
   • Confirm tokens invalidated
   • Confirm OAuth abuse addressed
   • Confirm rogue devices removed
   • Confirm credentials reset

2. Reset Credentials Securely

   • Require strong password creation
   • Require MFA enforcement
   • Require identity verification
   • Require password reuse prevention

3. Re-Enroll MFA

   • Validate trusted MFA methods
   • Validate approved devices
   • Validate recovery methods
   • Validate conditional access enforcement

4. Restore User Access

   • Re-enable identity provider access
   • Re-enable SaaS access
   • Re-enable VPN access
   • Re-enable email access
   • Re-enable administrative access (if applicable)

3. Post-Action

• Record the credential/MFA reset method, the type of access restored, and a timestamped log of all actions within the incident ticket.

Contributor

Vishal Thakur GitHub: https://github.com/malienist

Jayden Vo GitHub: https://github.com/jayden-vo

Contributed to the Arcana Incident Response Documentation Framework.