Before
Responders likely had to read the Teams incident, identify the requested action, switch to identity or investigation tools, and manually perform the remediation. They then had to return to the conversation, edit the incident message, and record who acted and when, while routing other requests to the appropriate specialist workflow.
How it works
- Receive and classify the Teams webhook as an incident dispatch, command, or remediation action.
- Evaluate the selected action, identify the target and relevant session details, then execute the matching identity remediation or route the request to a specialized subflow.
- Update the existing Teams incident message with the action, actor, timestamp, and remediation status.
Workflow details
- Event intake and triage: A Teams Bot webhook receives security events, user commands, and action selections. The workflow distinguishes between event dispatches, thread-based commands, and remediation actions before selecting the appropriate processing path.
- Command interpretation and routing: For supported commands, the workflow evaluates the message content and determines whether to invoke an identity remediation, hunting, Intune, or virtual-machine subflow. Unsupported inputs are left without a specialized subflow rather than being assigned arbitrarily.
- Identity remediation: When a user selects password reset or account lock, the workflow identifies the targeted user and performs the corresponding identity action. It also revokes the user's existing sign-in sessions as part of the remediation path.
- Hunting handoff: When a hunt action is selected, the workflow extracts the relevant Azure Active Directory session identifier and Teams message location, then sends those details to a specialized hunting subflow.
- Incident communication: After processing, the workflow removes the original action controls, adds a readable summary of who selected the action and when, and updates the existing Teams message with remediation status and timestamps. A close action records the closing actor and time without attempting an additional remediation.
What changed
The Teams conversation becomes the operational control point: incoming actions are classified automatically, supported identity actions and session revocation are executed from the selected command, hunting details are handed off automatically, and the original incident message is updated with the outcome and actor information.
Work removed
Manually reviewing each Teams action, retrieving the related message, identifying the target user, switching between identity and investigation tools, resetting passwords, disabling accounts, revoking sessions, extracting session identifiers, routing requests to specialist workflows, and editing the incident card with the action and timestamp.
Expected outcome
A reasonable planning estimate is 3–4 recurring manual actions avoided per supported request, with remediation status and ownership recorded directly in the Teams incident conversation.
