Skip to content
Made in the UK

Managed Detection and Response

What are pre-approved response actions in MDR, and which should an MSP approve?

By , CEO, CybaVerse. Last reviewed

Pre-approved response actions are containment steps you authorise your MDR provider to take as soon as a threat is confirmed, without calling you first. Most MSPs approve isolating ordinary devices and locking compromised accounts for every client, and decide case by case on servers.

This page is part of our managed detection and response for MSPs guide.

Why do pre-approved actions matter?

Attacks often begin at night, at weekends or over bank holidays. If the SOC must reach a named contact before acting, containment waits on someone answering the phone. Pre-approval turns minutes of risk into an immediate, agreed response while keeping you in control of what can be touched.

Which actions do MSPs usually pre-approve?

Most MDR services group response actions into three areas: device containment, endpoint clean-up and identity actions. What a provider can do depends on the tools connected, such as the client's EDR and Microsoft Entra ID. The table shows common actions and the access each one usually needs.

GroupTypical actionsUsually needs
Device containmentIsolate a device from the networkAn EDR tool that supports isolation, such as Microsoft Defender for Endpoint
Endpoint clean-upStop a malicious process; remove malicious files; block known-bad indicatorsEDR with response actions
Identity actionsDisable an account; revoke sessions; reset passwords or MFAIdentity platform access, such as Microsoft Entra ID

Microsoft Learn documents the device response actions available in Defender for Endpoint and how to revoke user access in Entra ID, which are useful references when agreeing actions with a provider.

How should an MSP decide which actions to approve?

Use the steps below for every new client and review them annually or after any major change. The aim is the fastest safe response, so start from approving everything and remove only what has a genuine business reason to wait.

  1. Step 1: Identify critical assets

    List servers and systems where isolation would stop the business. Tell the SOC which assets are critical so the right approval applies.

  2. Step 2: Approve non-critical isolation by default

    Isolating a laptop rarely causes harm and stops lateral movement. Most clients should approve it.

  3. Step 3: Approve endpoint clean-up actions

    Killing malicious processes, removing persistence and artefacts and blocking known-bad indicators are targeted and low risk.

  4. Step 4: Approve identity actions where Entra ID is connected

    Revoking sessions and resetting passwords or MFA stop account takeover quickly. Agree a process for VIP users if needed.

  5. Step 5: Decide on critical asset isolation

    Some clients will approve it; others want a call first. Record the decision and the contact.

  6. Step 6: Set escalation contacts

    Make sure the SOC knows who to call for anything not pre-approved.

  7. Step 7: Review regularly

    Revisit approvals when clients add systems, change staff or after an incident.

What safeguards stop containment going wrong?

Safeguards make sure containment only happens in the way each client agreed. Ask any provider how approvals are recorded, how new detection rules are tested before they can act, and how a contained device or account is released. Write the answers into the client's runbook before you rely on them.

  • Approvals recorded per client, with who agreed them and when
  • New rules tested in a log-only mode before they can act
  • No action taken when the provider is unsure what a detection refers to
  • A clear, separate step to release a device or account

What happens after containment?

Pre-approved actions are immediate containment, not the whole response. After containment, the provider and the MSP work through the rest of the response, and the root cause should be fixed and tracked so the same weakness cannot be reused. Approvals speed up the first step; they do not replace the rest of the response.

How do pre-approved actions differ for critical servers?

Critical servers need a separate decision because isolating them can stop the business. Treat isolating a critical asset as its own approval, so you can allow laptop isolation everywhere while requiring a call before a server is cut off. Tell the SOC which assets are critical.

  • Agree a named contact and backup for server decisions
  • Document which servers are business-critical per client
  • Review the list when infrastructure changes
  • Consider approving endpoint clean-up actions on servers even if isolation is not approved

Where does CybaOps fit?

CybaOps is the CybaVerse MDR platform, delivered through MSPs, backed by our UK-based security operations centre. Which actions the SOC takes on each client's behalf is agreed with the MSP during onboarding, and every incident is worked as a case so decisions and actions are recorded.

  • Our UK-based security operations centre monitors customer environments 24 hours a day, 7 days a week.
  • CybaEdge adds unlimited incident response, threat hunting and premium identity threat detection and response, delivered by our UK SOC.
  • Incidents are worked as cases in CybaOps, so every alert, action and note sits in one record your team can see.
  • CybaOps connects to Microsoft Defender, Microsoft 365 and Entra ID logs.
  • CybaOps works with the security tools you already have, including Microsoft Defender, Sophos and the other EDR tools you already use, so you do not have to rip and replace.
  • Pre-approved response actions are agreed with the MSP for each client during onboarding.

Pre-approved actions

Which response actions an MSP should pre-approve

Pre-approved response actions are containment steps you authorise your MDR provider to take as soon as a threat is confirmed, without calling you first.

01 The alert

Multi-tenantPartner / MSP CustomerCustomerCustomer+
CybaOps by CybaVerse

Pre-approved actions

02 The 7-step path

  • Role-based access
  • UK-based analysts
  • ISO 27001

03 Outcomes

Explore

Hover or tap any part of the diagram to see what it does.

  • MDR in
  • CybaCore
  • CybaEdge
  • CybaOne

What else do MSPs ask about pre-approved actions?

These are the questions MSP owners and service desk leads ask most when setting response permissions for clients.

Can a device be isolated when it is offline?

That depends on the EDR tool. Ask your provider and EDR vendor how isolation behaves for devices that cannot reach the service.

Who can change pre-approved actions?

Someone the client has authorised in writing. Record each change and who approved it.

What if we approve nothing?

The SOC will contact you before containing, which slows response.

Does approving actions mean the SOC will remediate everything?

No. Approvals cover containment; remediation is worked through afterwards.

What should you do next?

See how the CybaVerse SOC works on the CybaOps Platform page. MSPs can read about setting this up across clients on the Partner page.

See how incidents are worked as cases in CybaOps.

Book a CybaOps demo