How to Build an AI SOC With Tools You Already Own (Copilot Studio, Power Automate, Graph API)

Description and use

Building an AI‑assisted SOC using existing Microsoft 365 licenses: Graph API for data, Power Automate for orchestration, and Copilot Studio for analyst interaction. In two weeks, triage time dropped from ~15 minutes to under 2 minutes and human review volume fell by ~70 %.

Problem

Security teams lack time to triage the volume of alerts generated by Microsoft 365 security logs, and commercial SOC platforms are too costly and slow to integrate.

Outcome

In two weeks, the POC cut triage time from ~15 minutes to under 2 minutes per alert, reduced human‑review volume by ~70%, and surfaced a real compromise that rules missed.

Workflow

• 1. Pull risky sign‑in signals from Microsoft Graph API using a service principal with least‑privilege permissions.
• 2. Enrich each sign‑in with user context (department, recent locations, group memberships).
• 3. Orchestrate triage in Power Automate: dismiss noise, auto‑escalate deterministic cases, send gray‑zone alerts to AI.
• 4. Use Copilot Studio to expose Power Automate flows as conversational agents for analysts.
• 5. Implement guardrails so the agent only answers what Graph can provide and refuses to speculate.
• 6. Measure triage time and adjust rules or AI prompts as needed.

Evidence

Our two‑week POC cost zero dollars in new tooling and cut triage time from ~15 minutes per alert to under 2.

Source

We moved to scheduled sweeps with delta queries. Design for next year’s volume.

Source

One real finding: an impossible‑travel sequence on a service account that Entra risk had rated low because it had no interactive sign‑in history.

Source