When ITDR disables an AD-synced identity, the Entra and AD disables run independently and nothing verifies the end result. If an Entra Connect sync runs in between, it sets accountEnabled back to true, and the incident still shows as contained. In our case the account stayed enabled for 28 minutes after "containment", the attacker signed back in, and no failure or escalation appeared in the portal.

Huntress should verify the final Entra account state (accountEnabled and sessions) after a hybrid disable. There should also be a re-check for a period afterward, since a later sync cycle can revert it too.

Support ticket 274321 has the full timeline. Support has acknowledged this as a workflow gap with no workaround.