Home · Solutions · Other solutions
Solution · Other solutionsRisky sign-ins enriched, contained, ticketed and explained to the owner within minutes
Suspicious logins contained in minutes, not at the audit
Every flagged sign-in is enriched, matched to a playbook, contained where the rules allow, ticketed and explained to its owner in Teams; analysts decide only protected accounts and disputes.
Executive summary
Detected in seconds, contained in shifts: every step between the alert and the action is a person.
The native signal stays where it is.
Time to contain drops from shifts to minutes for playbook cases, because nobody waits for an administrator's inbox.
Microsoft Entra ID through Microsoft Graph; Microsoft Sentinel; ServiceNow
Business problem
Security
Detection is a solved problem in this company; response is not. Entra ID Protection labels the risk and Microsoft Sentinel turns it into an incident, but a label is not a decision. Deciding needs context that lives in four other places: whether the person is still employed, on leave or travelling (Workday); whether the device is compliant (Intune); whether the account is privileged, shared or a service account (a spreadsheet in the security team); and whether a ticket exists (ServiceNow).
A two-person team gathers that by hand, then needs an administrator to revoke sessions or disable the account, needs the service desk to reach the user, and writes the ticket last. Nights and weekends belong to an external provider who can triage but holds no rights in the tenant, so a Saturday detection becomes an e‑mail somebody reads on Monday.
The process persists because every tool covers one step well and the hand-offs between them are people. Security owns the decision, the identity team owns the rights, the service desk owns the phone, and the user owns a story nobody asked for until day four.
How it works today
- SystemEntra ID Protection raises a risk detection and Microsoft Sentinel opens an incident in the queue
- WaitingThe incident waits for the next office shift; anything detected after Friday afternoon waits until Monday
- PersonThe analyst looks up the user in Workday, the device in Intune, thirty days of sign-in history, the account list and ServiceNow, in five browser tabs
- PersonThey decide "probably fine" or "probably not" and e‑mail an administrator to revoke sessions or disable the account
- WaitingThe service desk phones the user; the call goes unanswered; a second attempt follows the next day
- Risk of errorReal incidents queue behind false positives from shared depot devices, in the order they arrived
- Risk of errorThe ticket is written last, the manager is never told, and the incident closes as "benign" or "contained" days after the sign-in
Why the current process costs more than it appears
The cost grows where nobody is looking.
- Time to contain decides whether a compromised account becomes a breach, and here it is measured in shifts: the analyst's, the administrator's and the service desk's.
- Analyst hours go into look-ups rather than judgement, so expensive people do clerical work while the two cases a week that need them wait in the same queue.
- Callbacks land on a service desk that cannot resolve them: it cannot see the detection or revoke anything, and can only ask the user to ring back.
- Users learn that a call from security is about nothing and stop answering, which is the wrong lesson for the one call that matters.
- Nobody can report mean time to contain by detection type, so the security budget is argued with anecdotes while regulators and insurers ask for that number.
Cost of inaction
Detections grow faster than users. Phishing kits automate password spray and MFA fatigue, and the queue grows with them while time to contain stays a function of the shift pattern. The rows price only the hours.
NIS2 counts the early-warning clock from awareness, and awareness has a timestamp in Sentinel whether or not anyone acted within the 24 hours. Insurance questionnaires ask for mean time to contain, and "we do not measure it" carries a premium of its own.
A plausible organisation with realistic proportions. The figures are there to be recalculated on your data; they are not a client result.
A logistics company with 6,500 users, a third of them frontline staff on shared scanners and terminals; Microsoft Entra ID P2, Microsoft Sentinel and Microsoft Intune; ServiceNow for tickets, Workday for HR; a two-person security team in office hours and an external provider at night.
About 380 sign-in related detections and incidents a month: atypical travel, password spray, unfamiliar sign-in properties, sign-ins from accounts dormant for ninety days, leaked credentials. Two in three concern standard accounts on compliant devices.
Each incident is enriched by hand from HR, device, sign-in and ticket data, contained by an administrator reached by e‑mail, and explained to the user by phone; the ticket is written last.
Median time from detection to a containment action is just over five hours, longer at weekends; 22 minutes of analyst time per incident go into look-ups and paperwork before any judgement.
Every Sentinel incident that involves a sign-in starts a UiPath process: a robot enriches it, a rule table selects the playbook, routine containment runs for standard accounts, a ServiceNow ticket opens with the evidence, and the user answers a "was this you?" task in Microsoft Teams. Protected accounts always stop at an analyst.
In the modelled case, playbook cases are contained within minutes rather than hours, about two thirds of incidents close without an analyst, and phone callbacks give way to a Teams task. The figures are a model, not a measurement.
Proposed solution
The native signal stays where it is. Entra ID Protection risk policies in Conditional Access remain the first line; what we add is the response. A Sentinel automation rule runs on every new incident that involves a sign-in and hands it, through a small Azure Logic Apps playbook, to a UiPath Orchestrator API trigger with the incident identifier.
The enrichment robot assembles in seconds what the analyst assembled in twenty minutes: employment status and manager from Workday, device compliance from Intune, thirty days of sign-in pattern, the account class, and any open ServiceNow ticket. A rule table keyed by detection type and account class then names the playbook. A dormant leaver's account is disabled and its sessions revoked, with a P2 ticket; atypical travel on a compliant device with multifactor authentication satisfied gets a P4 ticket and a task in Microsoft Teams asking the user whether the sign-in was theirs; a password spray goes to the security team, and the targeted accounts are confirmed compromised so the user-risk policy forces a password change. Privileged, executive and service accounts never reach the containment robot; they stop at an analyst task in UiPath Action Center, completed inside Teams.
Every action is written to the ServiceNow ticket and to a UiPath Data Fabric record carrying the incident identifier, the rule version, each action and the user's reply. The Sentinel incident is closed with its classification, the manager receives a short card in Teams, and Power BI reports time to contain by detection type, shift and account class. There is no AI component: containment is decided by rules that can be explained and audited.
Microsoft Entra ID Protection risk detections and risk-based Conditional Access (Entra ID P2); Microsoft Sentinel automation rules with an Azure Logic Apps playbook; UiPath Orchestrator API triggers, queues, credential store and audit log; UiPath Action Center tasks as actionable notifications in Microsoft Teams; Workflows in Microsoft Teams for the manager's card; UiPath Data Fabric; Power BI
The enrichment and containment robots, the rule tables, the user and manager cards, the analyst task, the ServiceNow ticket template, the evidence record and the report
Microsoft Graph with application permissions for session revocation, account disable, risk confirmation, sign-in history and Intune compliance; Workday and ServiceNow through UiPath Integration Service connectors; Sentinel incident read-back and closure through the Microsoft Azure Sentinel connector or the Sentinel REST API
How the automated process works
- SystemEntra ID Protection flags a sign-in; Sentinel opens the incident and its automation rule hands it to a UiPath job within a minute
- AutomationThe robot enriches the incident: employment status and manager, device compliance, thirty days of sign-in pattern, account class, open tickets
- AutomationThe rule table matches detection type and account class to a playbook and records the rule version
- PersonPrivileged, executive and service accounts stop at an analyst task in Action Center, answered in Teams before anything runs
- AutomationFor standard accounts the containment runs: sessions revoked, account disabled, or risk confirmed so Conditional Access forces a password change
- AutomationA ServiceNow ticket opens with the evidence; the user receives a "was this you?" task in Teams and the manager a card
- PersonThe user confirms or disputes; disputes and incidents that fit no playbook go to the analyst with everything gathered
- AutomationThe incident closes in Sentinel and ServiceNow with rule version and outcome, and the evidence record feeds the report
Human-in-the-loop model
Automation handles
- Enrichment of every incident with employment status, device compliance, sign-in history, account class and open tickets
- Playbook selection and routine containment on standard accounts: sessions revoked, account disabled, risk confirmed
- The ServiceNow ticket, the Sentinel closure, the evidence record and the report
- The user's confirmation task and the manager's card in Teams, with the reply recorded
People decide
- Analysts approve or reject containment on privileged, executive and service accounts
- Analysts investigate disputes and the incidents that fit no playbook
- Security owns the rule tables and reviews them monthly against the previous month's incidents
- The service desk handles the users Teams could not reach
Before and after
Systems and integrations
We do not add technology to make an architecture look serious. Every element below has a specific job in this process.
Inputs
- Entra ID sign-in logs and risk detections
- Microsoft Sentinel incidents
- Workday employment status and manager
- Intune device compliance
- ServiceNow open tickets
- the protected-account list
Automation layer
- UiPath Orchestrator
- UiPath Robots
- UiPath Integration Service
- UiPath Action Center
- UiPath Data Fabric
- Azure Logic Apps (Sentinel playbook)
Target systems
- Microsoft Entra ID through Microsoft Graph
- Microsoft Sentinel
- ServiceNow
- Power BI
Human touchpoints: Action Center tasks in Microsoft Teams for analysts and users; the manager's card in Teams; the security channel summary; the service desk for users not reached in Teams
Technologies used
risk detections and risk-based Conditional Access as the first line; confirming a compromised user drives the password change
Aturns risk detections into incidents; an automation rule and an Azure Logic Apps playbook hand each one to the robot
AAPI trigger receives the incident; robots enrich, apply the rules and contain; queues, retries and audit
Areads and closes incidents, opens tickets, checks employment status, posts the channel summary
Asession revocation, account disable, risk confirmation, sign-in history, device compliance
Athe analyst's decision on protected accounts and the user's confirmation
Athe manager's Adaptive Card, posted from a webhook the robot calls
Athe evidence record per incident; time to contain by detection type, shift and account class
AIllustrative economic model
What it is worth, with the arithmetic shown.
Analyst handling and service-desk callbacks are the two streams priced below, and neither was measured at a client. Analyst handling is 22 minutes per incident, of which the playbook share is released: 65% in this frontline-heavy estate. Callbacks cost the desk 8 minutes per incident and are replaced by the Teams task. €63 an hour is a fully loaded analyst cost including the external provider's blended rate; €39 an hour a fully loaded service-desk cost in Central Europe. Two streams at two rates do not fit one calculator line. SOC fees, licensing and breach costs are outside the model.
Business benefits
- Time to contain drops from shifts to minutes for playbook cases, because nobody waits for an administrator's inbox
- Analyst time moves from look-ups to judgement, the one thing a two-person team cannot delegate
- Users answer a Teams task in seconds instead of ignoring a phone call, and the reply becomes part of the record
- Every incident carries the same evidence in the same fields, so the auditor and the insurer receive a report instead of a story
- False positives cost robot minutes rather than analyst hours, so real incidents surface sooner in a shorter queue
The management view
- Mean time to contain by detection type, shift and account class becomes a number the CISO can show daily
- The queue holds only cases that need judgement, so a two-person team's workload is predictable and the night provider's scope is a rule
- Rule tables are versioned and released, so any containment can be traced to the rule that ordered it
- Security callbacks leave the service desk's statistics, and managers learn the same day that an account in their team was touched and why
Board-level KPIs
Security and governance
Trust in automation is built on the audit trail, not on a promise.
- The containment robot runs under an Entra service principal holding only the Graph permissions its playbooks need, scoped through administrative units to standard accounts; the protected list is enforced by the directory itself
- Secrets never sit in a workflow: the robot draws them at run time from Azure Key Vault through the Orchestrator credential store, and Orchestrator's audit log records every job and retry
- Each action is written with incident identifier, rule version and outcome to the Data Fabric record and the ServiceNow ticket, so any containment can be reconstructed
- Rule tables change only through a reviewed release with a named approver in the security team
- Employment data is limited to status and manager; processing stays in your Microsoft 365 tenant inside the EU Data Boundary and in the EU region of UiPath Automation Cloud; no language model is involved
Why now
NIS2 starts the early-warning clock at awareness, and awareness has a timestamp in Sentinel. A response that waits for Monday is a reportable delay, and insurers ask for mean time to contain on the renewal form
Detection is finished in most Microsoft 365 E5 estates: Entra ID Protection and Sentinel are licensed and running. Response is where the hours are, a modelled €7,700 a month in the table above
Sentinel automation rules, Orchestrator API triggers, scoped Graph permissions and Action Center tasks inside Teams are documented capabilities; the assembly is engineering, not research
Relevant executive roles
Mean time to contain becomes minutes for routine cases and a reported number for all of them, by detection type and shift
The security team scales with detections without adding shifts, and the service desk stops making security phone calls it cannot resolve
Callbacks leave the desk's statistics; it sees only the users Teams could not reach, with the evidence attached
Common questions and objections
They triage. Containment still needs someone with rights in your tenant and knowledge of your HR data. The robot gives your provider a task and a ticket instead of an e‑mail to your administrator.
Protected accounts never reach the containment robot; the directory itself prevents it, and they always go to an analyst. Frontline accounts on shared devices get a confirmation task, not a lockout.
It blocks or challenges the sign-in, and it should. It does not open a ticket, check whether the person left last month, revoke existing sessions or tell the manager; that is the manual work.
When this is not the right solution
- No Entra ID P2 or no Sentinel: the signal is missing and licensing comes first
- A SOAR platform already runs these playbooks; then robots cover only the systems it cannot reach, such as HR and the ticket queue
- Fewer than about a thousand users, where the incident volume rarely justifies playbooks and an on-call rota with the right rights does most of this
A question for the next management meeting
If an attacker signed into one of our accounts on Saturday morning, when would somebody with the rights to lock it out have found out, and which record would prove it?
Implementation approach
What we deliver, and what we need from you to start.
We deliver
- Your last quarter of incidents classified by detection type and account class, with one draft playbook per type agreed with security, HR and the service desk
- The rule tables, with the protected-account list enforced in the directory rather than in the rules
- The enrichment and containment robots, the Logic Apps playbook and the Orchestrator API trigger that connect Sentinel to them
- The user and manager cards, the analyst task, the ServiceNow ticket template, the evidence record and the Power BI report
- Recommend-only operation for several weeks, so analysts see what the robot would have done before it does it
We need from you
- Entra ID P2 and Sentinel in place, and last quarter's incident export with names removed
- A feed of employment status and manager from Workday, limited to those two fields
- The list of protected accounts and an owner for the rule tables in the security team
- A service principal for the containment robot, scoped by administrative unit to standard accounts
Stages
Discovery
Last quarter's incidents classified; detection types, account classes and the protected list agreed
Design
Rule tables, playbooks, ticket templates, cards, security model and Graph permissions
Build
Enrichment and containment robots, Sentinel hand-off, Teams tasks and cards, evidence record, report
Recommend-only run
Every playbook proposes but does not act; analysts correct the rules for several weeks
Unattended go-live
Routine containment on standard accounts runs unattended; protected accounts stay behind an analyst
Scale
The night provider works from the same cards; new detection types become playbooks
Departmental. Effort follows the number of detection types you keep, the quality of the HR feed and the account inventory, and the systems beyond ServiceNow that must carry the ticket.
Detection took eleven seconds. Containment waited for Monday.
Send us four weeks of Entra ID risk detections with the names removed. We return a playbook matrix: each detection type mapped to an automated first response and the point where a person decides.
Map four weeks of your detectionsThe neighbouring process usually has the same problem
The auditor finds your role conflicts once a year. By then the oldest of them is twelve months old.
View solution Other solutionsPassword reset in two minutes, without a ticketThe most frequent ticket on the desk still needs a phone call, three consoles and an identity check nobody records.
View solution Other solutionsAdmin rights that exist only for the task and the hourRights granted for a four-hour task stay for a career, in systems that cannot expire them.
View solutionIndustries we deliver this in most oftenManufacturing & industryTransport & logisticsServices & ITShared services