Before
Security personnel likely had to review identity events individually, identify the responsible users, and switch between activity records and sign-in reports to compare IP addresses, authentication details, and recent history. They then had to manually prepare a summary, notify the team, and coordinate any account lock or password reset decision.
How it works
- Receive and filter Entra ID activity, while routing failed login events to a specialized subflow.
- Identify each actor and correlate their operations with current and recent sign-in records, including matching IP history and authentication context.
- Format the findings into a Teams Adaptive Card and present responder-controlled options to lock the account, reset the password, or close the alert.
Workflow details
- Event intake and filtering: The workflow receives Entra ID activity through a webhook, keeps only configured operations such as user changes, policy changes, role membership updates, password resets, service principal updates, and user sign-ins, and routes failed login events to a dedicated analysis subflow.
- Actor and operation analysis: It identifies the unique actors associated with the selected events, maps the operations performed by each actor, and distinguishes regular users from service principals for additional context.
- Sign-in enrichment: For user sign-in activity, it retrieves the latest sign-in details and searches the preceding seven-day period for sign-ins from the same user and IP address. It then checks whether matching history exists and extracts available authentication details, device, location, conditional access, and policy information.
- Structured security summary: The workflow uses an AI step to assemble the relevant operations, current sign-in information, historical sign-in details, and service principal context into a structured Adaptive Card format, omitting empty or irrelevant sections.
- Actionable notification: A Teams channel receives the formatted security summary with options to lock the account, reset the password, or close the alert, leaving the final remediation choice with the responder.
What changed
Identity activity is now filtered, correlated, enriched, and formatted automatically as events arrive. Responders receive a consistent Teams alert with the relevant evidence and can choose the next action from the notification instead of coordinating the initial investigation manually.
Work removed
Reviewing qualifying identity events one by one, extracting actors and operations, looking up latest and recent sign-ins, comparing IP addresses, retrieving authentication context, assembling alert content, copying findings into a team notification, and manually presenting standard response options.
Expected outcome
Each qualifying event follows one automated enrichment and notification path, producing a consistent security handoff with fewer manual lookups, formatting steps, and tool changes.
