By Alex Smith |
Professional services firm Avanade has reduced identity incident resolution times by up to 80 per cent by embedding Microsoft Security Copilot and Microsoft Entra into its daily security operations.
As Avanade helped clients adopt artificial intelligence, the pace of its own adoption began to outstrip what its manual identity investigation workflows could support. High-volume incidents were handled through fragmented, multi-step processes, and complex cases often needed senior specialists. This created bottlenecks and made consistent responses hard to scale. Manual investigations took between 10 and 77 minutes, depending on the scenario.
“Clients trust us to help them move forward with AI,” said Tony Leraris, chief information officer at Accenture. “That means we have to be just as disciplined about how we secure and operate it internally.”
Avanade began with a five-week pilot in which engineers used Security Copilot during live identity investigations to bring together identity signals, investigator guidance and recommended next steps in a single workflow. The team documented repeated investigative patterns and converted them into prompt-based workflows, so that analysts could focus on decisions rather than gathering context across multiple tools.
The results were significant. Guest account investigations fell from ten minutes to one, and passwordless phone sign-in issues dropped from 27 minutes to two. Overall, Avanade cut mean time to resolution by around 70 to 80 per cent, bringing average incident resolution down from 10 to 12 minutes to two to three minutes. Engineers were also able to resolve more complex cases without escalating each one, reducing reliance on senior specialists without increasing headcount.
“Microsoft Security Copilot helped us bring the right identity signals together during active triage, so engineers could consistently move from investigation to resolution much faster,” said Bob Bruns, chief information security officer at Avanade. “The speed is important, but the consistency matters just as much.”
The approach was tested during Avanade’s passkey rollout to approximately 17,000 users, when identity teams used Security Copilot to manage more than 180 passkey-related support tickets per day. The company then built custom agents on the Security Copilot platform to consolidate security signals, recommendations and playbook-based next steps for analysts across its wider security operations.
In a separate study of more than 4,100 security operations investigations, Avanade found a 70 per cent improvement in speed and efficiency, a seven per cent improvement in investigation and documentation quality, and a seven per cent reduction in human error. Analysts reported a 38 per cent reduction in exhaustion levels, 31 per cent lower work intensity and 24 per cent less distraction.
Avanade plans to extend Security Copilot to broader identity and access management and support teams, continue building its prompt library and further measure operational impact and return on investment. The approach could also inform security operations at parent company Accenture, which has nearly 800,000 employees.