SecOps Account Lockout & Enable Portal
A self-service tool for SecOps analysts to lock out or re-enable a compromised or flagged user account, using a single guided workflow instead of running PowerShell/Graph commands by hand across several steps.
Demo login. Username: admin / Password: TryMyDemo!
This tool replicates the functionality of a similar SecOps tool used at Cinch Home Services, rebuilt independently from scratch in a personal lab environment. The public demo linked above runs against a personal lab tenant so the workflow can be tried end to end — it is not Cinch's production system, does not touch Cinch data, and was not deployed to Cinch's environment.
Problem
Locking out a compromised account, or reversing a lockout, means several separate directory actions: disable the account, force a password reset, revoke active sessions, log why it happened. Each one is easy to skip or do out of order under time pressure, and there's no single record of what was actually done.
Approach
Built a guided two-action tool (Lockout and Enable) against a live Entra ID tenant via Microsoft Graph:
Find → confirm → execute → result. Search by name or UPN, confirm identity in a results table, explicit confirmation gate before anything destructive runs, then execute.
Lockout disables the account, resets the password, revokes all active sign-in sessions, and writes an audit note, in that order. It stops immediately if any step fails rather than continuing on a partial success.
Enable reverses it: re-enables the account, issues a new temporary password, and updates the audit note.
Each step streams its result to the UI in real time as it completes (Server-Sent Events), rather than a simulated progress bar. What you see on screen is the actual Graph API response landing live.
Outcome
A single guided workflow replacing several manual directory actions, with every action independently verifiable in Entra's own audit log, not just trusted on the tool's word.
What's next
Onboarding, full offboarding (with email/ticketing integration), and password-change workflows are planned on the same architecture. Lockout/Enable was built first since incident response has the tightest time pressure and the smallest safe blast radius to prototype against.