Incident response
Emergency actions for a security incident: lock all applications, sign every managed user out, and force a password change.
When you suspect a security incident, such as a phishing campaign, leaked passwords or a stolen laptop, speed matters. The Incident response tab of Organization gathers three organization-wide actions you can take in seconds. It is the first tab of the Manage Organization page.
| Action | Affects | Who can use it |
|---|---|---|
| Global application access lock | Everyone, managed and guests | Owner, Administrator |
| End all active sessions | Managed users | Owner, Administrator, Helpdesk |
| Force a password change on the next authentication | Managed users | Owner, Administrator, Helpdesk |
To act on a single person instead, for example one stolen laptop, use the user’s own account security tools.
Lock access to all applications
The Global application access lock immediately stops everyone in the organization from signing in to any of its applications, whether they start from My Applications or from the application itself. It is the fastest way to contain an incident while you investigate.
- On the Incident response tab, turn on the switch next to Global application access lock.
- Read the Confirm the global application access lock dialog and select Confirm.
The status changes to Enabled. While the lock is on:
- nobody, managed or guest, can sign in to your organization’s applications through BreezeAuth;
- people can still sign in to BreezeAuth itself, so administrators can keep working in the admin console;
- sessions already open inside an application are managed by that application, and may last until they expire there.
To lift the lock, turn the switch off and confirm in the Confirm unlocking global application access dialog.
Sign everyone out
End all active sessions signs out every managed user from every device, immediately. Everyone must sign in again, which also applies any security setting you have just changed, such as Mandatory MFA.
- Next to End all active sessions, select End sessions.
- Confirm in the Confirm ending all active sessions dialog.
Important: if you are a managed user yourself, you are signed out too. Guests are not affected, and neither are sessions already open inside applications.
Force a password change
Force a password change on the next authentication makes every managed user choose a new password right after their next sign-in. They sign in one last time with their current password, then must set a new one that follows your password policy.
- Next to Force a password change on the next authentication, select Force password change.
- Confirm in the dialog.
This action doesn’t end any session: people already signed in are asked for a new password the next time they sign in. Guests are not affected.
A response playbook
Every incident is different, but this order works for most of them:
- Contain. Turn on the Global application access lock so that no application can be reached through BreezeAuth.
- Tighten the rules, if needed: turn on Mandatory MFA, or restrict access by network or country.
- Reset credentials. Select Force password change, then End sessions, so that everyone signs in again and chooses a new password. Doing it in this order makes sure nobody stays signed in with an old password.
- Investigate. Check the Audit Logs for unusual sign-ins and changes, and deactivate any account involved.
- Restore. When the situation is under control, turn the application lock off.
Also end the sessions inside critical applications themselves, if they allow it: BreezeAuth’s actions don’t reach sessions that applications manage on their own.
Actions are audited
Locking and unlocking applications, ending all sessions and forcing password changes are recorded in the Audit Logs, with who did it and when.
Last updated: October 13, 2026