> For the complete documentation index, see [llms.txt](https://docs.cipp.app/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.cipp.app/user-documentation/cipp/settings/bec-remediation.md).

# BEC Remediation Defaults

Choose which containment actions run by default when a compromised user is contained.

This page sets which [Business Email Compromise](/user-documentation/identity/administration/bec.md) containment actions are switched on by default. The setting applies across the whole instance, for every tenant and every technician. It is reached from the **BEC Remediation Defaults** card on the General settings tab.

Each action is listed with its impact and a description of what it does. Switch on the actions you want as the default, then select **Save**. At least one action has to be on; **Save** stays greyed out until one is.

## Where the Defaults Apply

| Where                                                                                               | Effect                                                                                                                      |
| --------------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------- |
| [Containment drawer](/user-documentation/identity/administration/bec/case.md#containment) on a case | The actions switched on here start selected. The technician can still change the selection for each case before running it. |
| **Automatically contain users that newly appear at high risk** on the **NewRiskyUsers** alert       | Runs exactly the actions switched on here, with no one reviewing them first.                                                |
| The `ExecBECRemediate` API called without a list of actions                                         | Runs the actions switched on here.                                                                                          |

The audit-log alert action **Execute a BEC Remediate** is not affected. It runs the actions chosen on the alert rule, or, when the rule chooses none, reset password, block sign-in, revoke sessions and disable inbox rules.

{% hint style="warning" %}
Automation confirms **Critical** actions without asking, because there is no one to type the user's UPN. Anything switched on here also runs unattended wherever the NewRiskyUsers auto-containment is enabled, so switch on tenant-wide actions such as **Disable transport rules** or **Disable rogue applications tenant-wide** only if you want them to run without anyone reviewing the case.
{% endhint %}

## Built-in Defaults

Until the defaults are saved here for the first time, these six actions are on:

| Action                         | Impact   |
| ------------------------------ | -------- |
| Reset password                 | Critical |
| Block sign-in                  | Critical |
| Revoke sessions                | High     |
| Remove MFA methods             | High     |
| Disable inbox rules            | High     |
| Block legacy mailbox protocols | High     |

Every other action starts switched off. The full list of actions and what each one does is under [Containment](/user-documentation/identity/administration/bec/case.md#containment).

Changing the defaults requires the `CIPP.AppSettings.ReadWrite` permission. Every save is recorded in the logbook with the list of actions that were switched on.

***

## Feature Requests / Ideas

We value your feedback and ideas. Please raise any [feature requests](https://github.com/CyberDrain/CIPP/issues/new?template=feature.yml) on GitHub.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://docs.cipp.app/user-documentation/cipp/settings/bec-remediation.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.