Actions

Every change 1Security makes in your tenant ends up in one place: the Action Center. It doesn't matter whether an automation proposed the change, a security case staged it after a one-time scan, or you clicked it yourself on a file, a site or a user - it lands in the same ledger, with the same status and the same paper trail. This page is the catalog behind that ledger. For every action we can run, it tells you what it changes, whether you can take it back, and whether we actually check that Microsoft did what we asked.

Before you read the tables

Three of the columns describe promises rather than features, so they deserve a word of explanation.

Confirmation - do we check, or do we trust?

An action can reach Microsoft in two ways, and the honest answer is that not every action gets the careful one yet.

• Confirmed is the careful one. We send the write, wait, then read the resource back from Microsoft and compare. Only when the read agrees do we call it Applied; until then the row says Confirming. If Microsoft accepted the write but the resource never comes back the way we asked, we say Unconfirmed. That's us admitting we don't know, rather than guessing in your favour. Every action fired by an automation runs this way, and so does every revert.
• Immediate is the quick one. When you fire the action by hand it runs inside your request, and the row says Applied or Failed based on Microsoft's reply alone - no second look. It's fast, and for most settings it's fine, but "Microsoft said OK" and "it's really there" are not always the same sentence.

The column tells you which path a manual run takes. The same action fired by an automation is always confirmed. We're moving actions from Immediate to Confirmed one family at a time, so expect this column to keep changing in that direction.

Revert - can we take it back?

The Revert button on a row is only offered when we can honestly do something with it. The column says which of four situations you're in:

• Yes - we undo it ourselves, either by running the opposite action or by writing back the value we noted down before the change.
• Yes, for 30 days - Microsoft holds deleted users and groups for 30 days. While that window is open we can restore them, and the row shows how long you have left.
• Manually - we can't drive the undo, but you can, and the row tells you where: the recycle bin, Recoverable Items in Outlook, dragging a message back to its folder, or setting a value back by hand.
• No - there's no way back, or none we've verified. We'd rather tell you that up front than let you find out from a greyed-out button.

Availability - live, or on its way?

• Live actions run on real tenants today.
• Coming soon actions are already in the picker, with a badge, and the server refuses to run them. Nothing in that state is known to be broken. An action goes live the moment we've run it end to end on a real tenant, write and read-back both, and not a day earlier. That's the bar, and it's why some actions that look trivial are still waiting.

What the statuses mean

The catalog

Grouped by the kind of resource you run the action on. The bold name is what you'll see in the picker; the code next to it is the id you'll find in the evidence export and in conversations with our support.

Sites

Most site actions are settings, and a setting has no opposite - there's no "un-set sharing capability". We revert them by remembering the value the site had before and writing it back, which is why every one of them says Yes.

Delete Site is the one we're holding, and it's worth explaining why. A site connected to a Microsoft 365 group can't be fully deleted with the application identity 1Security uses. The only route that works deletes the group permanently first, and that throws away its 30-day restore along with its mailbox, Teams and Planner. Whether an action should do that on your behalf is a decision we haven't made yet, so until we have, the button stays badged.

Users

Nothing here is broken. The whole family is waiting for its end-to-end run on a real tenant. Under the hood, the license and membership actions are the same writes as the live license, group and site actions further down - just started from the user's side.

Files

Revoke user access is the big one. It chases a person's access to a file through every route that grants it and closes all of them at once. That's also why it can't be reverted: putting the access back would mean rebuilding whichever of those routes granted it, and we haven't verified we can do that faithfully. It lives on the Files list; the last three live in the Manage access dialog inside a file's drawer. None of the four is offered in the automation builder.

Remove links by scope is the only action in the product with a hard No. Once a sharing link is gone, Microsoft mints a new id and a new URL for any replacement, so the old link is dead for everyone who had it. Not "we can't bring it back" - nobody can.

Groups

Delete group can be reverted for Microsoft 365 groups, because Entra keeps those for 30 days. Distribution lists and SharePoint site groups get no such grace period, so for those the answer is no - and the row tells you which case you're in before you click.

Apps

The people cut off by Restrict to assigned users don't get a row of their own - nothing on their accounts changes, Entra just stops honouring a sign-in they never had an assignment for. Their number is in the warning you see before you confirm, and in the evidence afterwards.

Licenses

One thing Microsoft will refuse and we don't yet catch for you: assigning a license to a user with no usage location, or from a SKU with no free seats. If an assignment doesn't go through, that's the first thing to check. Set the usage location on the user, or free a seat, and run it again.

Devices

A device we only know from sign-in logs has no object in Entra to read back, so a confirmed run could never prove anything. That's part of why the pair is still waiting.

Agents

Copilot Studio quarantine and ownership live on the Power Platform, which only talks to a signed-in administrator, not to an application. Until we've built that route the pair stays held. On the demo tenant you can already see what it will look like.

Emails

Waiting for its end-to-end run, like the user family. One thing worth knowing about the two moves: Microsoft only lets us move a message into Junk or Deleted Items, never back to the folder it came from. So reverting one of those is a drag-and-drop for the mailbox owner, not a button for us.