You can build a working AI-assisted SOC triage pipeline using only Microsoft 365 licenses you already pay for: Graph API pulls security signals, Power Automate orchestrates triage, and Copilot Studio turns it into an agent analysts query in plain language. Our two-week POC cost zero dollars in new tooling and cut triage time from ~15 minutes per alert to under 2. This is the honest walkthrough, including what broke.
Why we didn't buy a SOC platform
The pressure to "get a SOC" usually assumes you need to buy one. For a team our size the math never worked: commercial SIEM-plus-SOAR platforms would consume our entire security budget, and integration alone would take six months.
Meanwhile, we were already paying for Microsoft's ecosystem: Entra ID sign-in logs, Defender endpoint events, Purview mail flow , all accessible through Graph API with licenses already on our invoices. The problem wasn't data; it was that nobody had time to look at it.
So the POC question became: can an AI agent do first-pass triage on infrastructure we already own? Yes , with caveats.
The architecture in plain terms
Three layers, each doing one job:
Data layer , Microsoft Graph API. Graph exposes Entra sign-in logs, risk detections, Defender alerts, and mail security events through a single authenticated API. This is where all signal comes from. No data lake, no log shipping pipeline , we query it on demand.
Orchestration layer , Power Automate. Every flow has the same shape: trigger (new risk detection, new alert, scheduled sweep), enrich (pull related events from Graph), decide (rules first, AI second), act (Teams notification, ticket, or auto-response).
Interaction layer , Copilot Studio. The agent front door: analysts ask in plain language, and Copilot Studio calls the same Graph-backed flows as the automated triggers. One pipeline for humans and automation.
The key design decision: rules before AI. Everything deterministic , known-bad IPs, impossible travel, disabled account sign-ins , gets handled by plain Power Automate conditions. The AI layer only sees alerts that survive the rules and need judgment. This kept our first version fast and cheap.
Step 1: Pull the signals from Graph API
Start with risky sign-ins from Entra ID Protection, wrapped in Power Automate's HTTP action:
GET https://graph.microsoft.com/v1.0/identityProtection/riskySignIns?$filter=riskLevel eq 'high'&$top=50
Authorization: Bearer {token}
The service principal needs IdentityRiskyUser.Read.All and SecurityEvents.Read.All , least privilege, nothing more. I once requested ReadWrite out of laziness and spent an afternoon explaining why the flow could remediate users it had no business touching. Least privilege here is the difference between an alerting pipeline and an attack path.
Enrich each sign-in with the user's context , department, recent locations, group memberships. An "unusual location" alert means nothing until you know the user is a traveling salesperson.
Step 2: Triage logic in Power Automate
Our triage flow, in order:
- Dismiss obvious noise. Sign-ins from known corporate VPN exit IPs, your own scanner IPs, and tenants you've allowlisted. This killed about 40% of volume on day one.
- Auto-escalate the deterministic. Sign-ins from geos you've never seen plus MFA failure plus account with admin role → page someone. No AI needed, no AI delay.
- Send the gray zone to the AI. Everything in between gets summarized and risk-scored before it reaches a human.
For the gray zone, the prompt receives enriched sign-in JSON and must return structured output: risk score 1,10, category, two-sentence rationale, recommended action. Forcing structured output was our single most important prompt change , the first version returned chatty paragraphs no automation could consume.
Step 3: The Copilot Studio agent
Copilot Studio connects to your flows through Power Automate topics. We exposed three , query-signins, query-alerts, investigate-user , each calling a Graph-backed flow and formatting results.
The failure I didn't anticipate: analysts asked the agent questions it couldn't answer from Graph, and it confidently answered anyway. I added guardrails , the agent must state which data source it queried and refuse to speculate beyond returned records. An agent that hallucinates in a SOC isn't a novelty, it's a liability. Grounding instructions took three iterations.
What broke during the POC
Honesty section, because this is the part vendor case studies skip:
- Rate limits. Graph throttles aggressively; per-alert queries fall over past a few thousand alerts. We moved to scheduled sweeps with delta queries. Design for next year's volume.
- Token costs crept. Full sign-in JSON per alert tripled processing time; the fix was trimming payloads to the 15 fields the prompt actually uses.
- Trust arrives slowly. Analysts ignored the summaries at first; it earned trust only after flagging one compromise pattern the rules had missed, and after we made it show its sources.
Results after two weeks
- Alert triage time: ~15 minutes to under 2 minutes per gray-zone alert.
- Volume reaching humans: down roughly 70% after noise rules.
- One real finding: an impossible-travel sequence on a service account that Entra risk had rated low because it had no interactive sign-in history. The agent surfaced it because we asked a question rules couldn't.
That is the actual argument for AI in the SOC: not that the model is smarter than your rules, but that you can ask questions your rules were never shaped to answer.
Checklist: your first week
- [ ] Inventory what your existing licenses already log (Entra, Defender, Purview)
- [ ] Create one service principal with read-only Graph permissions
- [ ] Build one Power Automate flow: risky sign-ins → Teams notification
- [ ] Add noise rules before adding any AI
- [ ] Add AI summarization only for the gray zone, with structured output
- [ ] Wire one Copilot Studio topic to one flow, grounded with source-attribution instructions
- [ ] Measure triage time before and after , if it doesn't improve, simplify
FAQ
Do you need E5 licenses for this?
Not strictly. E3 gives core logs and Graph access; E5 adds risk detections and richer Defender signals that make the AI layer much more useful. Start on E3 and build up.
Is this a replacement for a SIEM?
No , it's a triage and investigation layer. You still need log retention, compliance reporting, and forensics. Think analyst's assistant, not platform.
Can Copilot Studio take response actions, like disabling a user?
Technically yes, and I'd advise against it for v1. Keep the agent read-only until you've measured accuracy for a month; the first automated action should be safe (revoke sessions), not destructive.
How do you handle false positives from the AI layer?
Structured output includes a confidence field, and we track false-positive rate per category weekly. High-FP categories get demoted back to rule-only handling , the agent keeps earning each category.
Written by Yehezkiel Tampubolon. I write about AI/MCP security, SOC automation, and building in public.
Top comments (0)