Can the AI analyst make changes in our Microsoft environment?
Short answer: no. The AI analyst has no direct access to your Microsoft environment and cannot make changes on its own.
No direct credentials
The AI analyst runs in an isolated environment with no tokens, keys, or network path to your tenant. Its only connection is a short-lived token that lets it ask questions of our backend scoped to your tenant and your tenant alone. Not of Microsoft Graph, Defender, or Entra ID.
Concretely: even if someone compromised the AI analyst's container, they would gain no access to your environment. There are simply no credentials to steal.
Read-only, only via the backend
When the AI analyst wants to look something up (a user, a sign-in, a mailbox rule, a device), it requests this through our backend. Our backend:
- Holds your tenant's credentials in a separate credential store.
The AI analyst never sees the credentials themselves. It only receives the results of the query our backend performed on its behalf.
Remediations always require human approval
When the AI analyst proposes a remediation, for example signing out a compromised user, disabling a malicious mailbox rule, or isolating a suspicious device, it does not happen automatically.
The proposals are presented to your team. You can:
- Accept, after which the system performs the action via secure, audited paths.
- Decline, if you judge that the action isn't needed.
Only after your explicit approval does the system execute the action. Remediations can ben auto accepted.
The result
Even if the AI analyst were to make a mistake or behave unexpectedly, it cannot make changes in your environment. It can only ask questions through paths we control, and propose actions you review.
This is a deliberate architectural choice. The trust question shifts from "can we trust the AI to choose the right action?" to "can we trust the constraints we've built around the AI?". That question can be answered with code review and penetration testing, rather than with faith in model behaviour.