Office 365 Advanced Security Management is now Office 365 Cloud App Security.
Suppose that you receive an alert that one of your organization's user accounts for Office 365 has been compromised. Or, suppose that you've received an alert that indicates something is wrong with a user account. With Office 365 Cloud App Security, you can suspend a user account and later restore it after you have investigated the alerts you receive.
Tip: Office 365 Cloud App Security is available in Office 365 Enterprise E5 or as an add-on for another Office 365 Enterprise subscription. To view or add to your subscription, as a global admin, sign in to Office 365, and then choose Admin > Billing. For more information about plan options, see Compare All Office 365 for Business Plans.
To suspend a user account in Office 365 Cloud App Security
When you suspend a user account, you prevent the user from signing in again. It's the same as editing the user account directly in Office 365 to set the Sign-in status to Sign-in blocked.
Important: If you block a user from signing in to Office 365, either by suspending them or by editing their sign-in status, be aware that it can take an hour or so to take effect on all of the user's devices and clients (more about editing users in Office 365). If the user is signed in to Office 365, the block will take effect whenever Office 365 requires them to sign in again.
As a global administrator or security administrator, go to https://protection.office.com and sign in using your work or school account. (This takes you to the Security & Compliance Center.)
In the Security & Compliance Center, choose Alerts > Manage advanced alerts.
Choose Go to Office 365 Cloud App Security.
In the navigation bar across the top of the screen, choose Alerts.
In the Alert column, double-click an alert that pertains to a specific user account.
Under Accounts, in the Status column, choose Settings > Suspend user.