What one week actually looked like
Built beside my day job. Rough, but the entire loop already worked end to end — analyse, group, measure, plan the fix.
One button. Nothing existed until the agent had read the company’s set-up.
It sorted every account into suggested groups, and flagged the ones at risk.
Then one group against its own checklist, requirement by requirement.
And a phased rollout, drafted for you — pilot first, everyone last.
An AI could read a company’s set-up, sort its accounts into groups, and name the riskiest one. That was the whole bet — and it held.
Tiles, a donut and a wall of text, buried inside another product. It could tell you something was wrong. It couldn’t help you do anything about it.
“Zava” is a fictional demo company — every figure here is placeholder data. Look at the design, not the numbers.
The account you must never touch
Every company keeps one or two emergency admin accounts locked away, for the day everything else fails. If an automated agent ever tightens security on those, nobody can get back in. So the product has to find them, and then leave them completely alone.
The agent scans, ranks by evidence and pre-selects three — then a human has to confirm before any campaign can run.
“In an incident, ambiguity around break glass is unacceptable.” — Pim Jacobs, InSpark
04-20-2026-Inspark-Break-Glass-Sync.md“Some see having a break-glass as a risk… Sometimes to get a certification, they don’t want to have a break-glass.” — Adnan Hendricks. It could not be one rule for every country.
03-24-2026-MVP-Summit.mdNVIDIA uses a Privileged Role Administrator, not a Global Admin — and the first build silently refused it, with no error message at all.
private-preview-summary.md“Nice to see also the category ‘Break glass’ — which we asked on the MVP summit.” — Dinant Paardenkooper, IT-Impressive
04-15-2026-Private-Preview-Kickoff.mdThen it happened for real. At NACHA, break-glass was configured perfectly and still failed — because under pressure the admin did not know how to use it. That one incident produced ten repair items.
Teach it your company’s own rules
Generic best practice is easy to ignore, because it does not know anything about you. Customers wanted to hand the agent their own written policies so the advice comes back in their language, against their rules.
Upload a policy, then read back what the agent understood — the part customers insisted on.
“Could we point Entra AI agents at our 100+ infosec policies and highlight where documented policies don’t align with configuration?” — Kevin Watford, Accenture
03-18-2026-Accenture.mdIntesa Sanpaolo offered their whole policy bible — but wanted to verify what the model understood. Iterative correction, not blind one-way ingestion.
03-12-2026-Intesa.md“People don’t maintain documents.” — Marius Solbakken. So uploading a file could never be the only way in.
03-24-2026-MVP-Summit.mdAnd the uncomfortable one, from our own team: “no one’s using it… it’s quite a heavy lift.”
2026-04-10-AI-Driven-Good-State-Brainstorm.mdThat last note changed the brief. The same feature already existed elsewhere and had reached 13 tenants out of 2,947. So the problem was never the capability — it was earning enough trust that someone hands over their policies.
Not everyone in the company is the same
The first version shipped with one Microsoft-written definition of “admin”. Real companies looked at it and said their organisation does not divide up that way — and that they should be the ones drawing the lines.
Name your own segments, save them as drafts, and swap the whole setup in one move.
“Defining the persona in itself is often an impossible task… ‘employee’ — that’s a really poor persona.” — Marius Solbakken
03-24-2026-MVP-Summit.mdCanadian Tire already models its people across five different systems, and offered to hand over their own persona spreadsheet to seed it.
06-03-2026-Canadian-Tire.md“Hard-coded definitions are a non-starter for public preview. Must be dynamic and eventually customer-customizable.” — Aakarsh Nair, Microsoft VP
2026-04-08-Good-State-Demo-Session.mdIt became the #1 recurring request of the whole preview — raised across 20+ meetings, and still growing at the end.
cumulative-private-preview-report.mdBeing straight about this one: the screen on the left is designed and prototyped, not shipped. Only the Microsoft-defined admin segment made the first release. Everything else here is the roadmap that the evidence bought.
Being secure isn’t enough — you have to prove it
Security teams do not only need to be safe. Once a year they have to sit in front of an auditor, an insurer or a regulator and show it. So every recommendation had to be able to say which published standard it satisfies.
The standards the agent measures you against, stated on the record.
“They have to have, let’s say, 80 to 90% good score” — for the auditors. — Adnan Hendricks, on what actually drives the number.
03-24-2026-MVP-Summit.mdSanford Weinberg asked for NIST 800-171, CMMC 2.0 and insurance-regulation alignment — driven by findings that kept coming back in pen tests.
private-preview-summary.md“It adds to the conversation to leadership… we’re doing Microsoft best practice and what industry standard does that actually align to?” — Josh Kolka, Pivotal
06-01-2026-Pivotal.mdThe same customer set the design limit: rolling frameworks into the score “would completely mess with the weights… the score would be meaningless.”
06-01-2026-Pivotal.mdSo frameworks label the work — they never get blended into one number. That one sentence from a customer settled a decision the team had been arguing about internally. Worth flagging: of the 22 frameworks in the design, about six were named by real customers; the rest we inferred.
Rebuilt properly — and it fell flat
A page of its own, built to the house style: four numbers and a table.
Out of the agent and onto a surface of its own. Consistent with everything around it, legible, and technically correct.
It looked like every other settings page in the product. Nothing on it suggested an AI had actually reasoned about your company.
Where it came from, and where it landed
A tab inside another product. Tiles and a donut.
Its own page — but four numbers and a table.
A headline, a trend, and three ranked moves.
The dashboard became a sentence — “your privileged tier is the biggest opportunity to reduce risk”, i.e. start with the people who can open the most.
A score you can watch move — one trend line, so progress between runs is visible at a glance.
The table became a ranked list — three moves, best first, instead of a dense table to read.
The company’s own context on screen — its industry, its rules, its size, so the advice reads as specific.
From a flat list to one ranked move
One headline read, then three moves in priority order — not an undifferentiated list.
Prioritisation is the product. A ranking of the few moves that close the most exposure beats a longer, more complete backlog.
Collapsed the flat list into one ranked set of recommended actions, led by the single highest-impact move — with the share of risk it closes next to it.
The admin starts on the move that closes the most exposure, instead of deciding where to begin.
The AI got a bigger job. A person still presses go.
Version 1 used AI to check things. Version 2 hands it the judgement: who moves first, in what order, when to stop. That is exactly why a person now has to approve it.
It scanned and ticked four boxes. Then three phases and a Start button, with no reason for that order.
It plans the waves, argues for them in plain language, and monitors them. Every wave still waits for a click.
It picks the order. Wave 1 is “the admins with the lowest predicted disruption” — the agent’s call.
It predicts the fallout before anyone moves. A forecast, not a database lookup — the exact bar leadership set.
It drafts the comms and sets the date. It writes the message admins receive and proposes a deadline with a runway.
It stops itself. It watches whether people are still getting in, and pauses on its own if that dips.
Show them exactly who this hits
The preview an admin sees before anything runs.
Admins won’t approve a change to powerful accounts if they can’t see how far it reaches. So we showed them — before anything runs.
- Who’s affected — three people in this wave, none of them new to the process.
- The exact message each person will receive, in the words they’ll actually read.
- The safeguards, written out — emergency accounts excluded, each phase starts only on a click, pause and restore at any time.
Automation earns trust by showing what it’s about to do — and by knowing what not to do on its own.
The customer who broke our assumption
Every organisation keeps a couple of emergency accounts — the spare keys that get you back in when everything else locks you out. Our rollout had to leave them strictly alone. We assumed they always looked a certain way. A preview customer showed us they don’t.
Emergency accounts, found automatically and excluded by default — with a human confirming.
A preview customer’s emergency accounts didn’t match our rigid assumption. Our rollout would have either missed them — or locked the customer out of their own company.
The product now finds emergency accounts itself, including ones defined by group, shows them to the admin to confirm, and excludes them by default.
The most valuable feedback we got wasn’t about the interface. It was about an assumption underneath it.