As per the email on the 30/10 it seems Huntress ITDR will auto give itself the Privileged Authentication Administrator role so it can reset anyones password. Firstly i don't know why we'd want Huntress to change a password, disabling an account and us then investigating it is best. But having that level of control means ITDR or someone with malicious access via Huntress' server could change all passwords including all our own admin passwords and lock us out of the entire tenancy!

But also I don't want users passwords to be changed as part of a remediation, we'll do that ourselves.