IDENTITY INVESTIGATION & AI AGENTS

Microsoft 365 & Entra ID Incident Investigation

Investigate session compromise, device-code phishing, application access and mailbox fraud. Use supervised AI agents to examine evidence, challenge findings and verify response decisions.

In development6 chapters18 lessonsEnglish

Explore the course topics ↓

INSIDE THE COURSE

Explore the course, chapter by chapter.

This is the current outline of a course in development. Explore the chapters, subchapters and lesson topics below. The programme may change as we develop and review it.

Explore the outline. Open a section to see the lessons and topics inside.

Chapter 01

Set up the investigation

Define the decision, understand the evidence and configure a bounded agent.

1.1

Decision and evidence

Open the case with a decision, a deadline and a boundary

Create an investigation brief that an analyst and an agent can both follow.

Includes practical AI use, verification and information risks.

Link to this lesson

Know which identity and which evidence you are looking at

Map an identity event to the right source without confusing authentication, permission and resource use.

Includes practical AI use, verification and information risks.

Link to this lesson

1.2

Agent setup and authority

Configure an investigator agent you can supervise

Set up a bounded evidence-reading workflow with enforceable permissions and a reproducible run record.

Includes practical AI use, verification and information risks.

Link to this lesson

Chapter 02

Case 1: Session compromise

Separate an authentication success from legitimate subsequent use.

2.1

Hypotheses and timeline

Investigate suspicious sessions without blaming the wrong user

Test a session-compromise hypothesis against sign-in context and a benign comparison.

Includes practical AI use, verification and information risks.

Link to this lesson

Build a timeline that survives a skeptical reviewer

Join identity and mailbox observations while preserving time and coverage limitations.

Includes practical AI use, verification and information risks.

Link to this lesson

2.2

Containment and verification

Recommend containment and verify what it changed

Separate approved response actions from evidence that the relevant access path stopped.

Includes practical AI use, verification and information risks.

Link to this lesson

Chapter 03

Case 2: Device-code phishing

Investigate intent, test queries and handle hostile content safely.

3.1

Authorization and query testing

Recognize device-code abuse on a genuine sign-in page

Investigate authorization intent without relying on a fake-domain explanation.

Includes practical AI use, verification and information risks.

Link to this lesson

Use an agent to draft queries, then test the query

Validate query scope, fields and positive/negative cases before trusting the result.

Topics you will explore

Inspect a read-only KQL proposal

Includes practical AI use, verification and information risks.

Link to this lesson

3.2

Prompt injection in evidence

Stop a malicious email becoming an agent instruction

Detect indirect prompt injection and verify the tool boundary with a controlled failure test.

Includes practical AI use, verification and information risks.

Link to this lesson

Chapter 04

Case 3: Application access

Distinguish principal identity, permission and actual resource activity.

4.1

Identity, grants and use

Identify the application before judging its permissions

Separate app identity, tenant-local service principal and permission mode.

Includes practical AI use, verification and information risks.

Link to this lesson

Trace consent to observed use

Correlate a permission grant with resource activity without inflating the impact claim.

Includes practical AI use, verification and information risks.

Link to this lesson

4.2

Path-specific response

Contain the right access path

Draft separate response proposals for delegated user access and application-only activity.

Includes practical AI use, verification and information risks.

Link to this lesson

Chapter 05

Case 4: Mailbox and payment fraud

Investigate persistence, assess impact and coordinate the response.

5.1

Mailbox access and exposure

Investigate mailbox rules and delegated access

Assess mailbox persistence and distinguish configured actions from successful effects.

Includes practical AI use, verification and information risks.

Link to this lesson

Describe data exposure without inventing certainty

Produce a supported impact statement from mailbox access records and incomplete coverage.

Includes practical AI use, verification and information risks.

Link to this lesson

5.2

Cross-team response

Coordinate identity, messaging and finance response

Turn technical findings into an authorized, verifiable response across teams.

Includes practical AI use, verification and information risks.

Link to this lesson

Chapter 06

Operate and challenge the workflow

Evaluate agent assistance and demonstrate transfer to a new case.

6.1

Roles, tests and review

Build a small agent team without multiplying errors

Assign useful agent roles while preserving evidence independence and human ownership.

Includes practical AI use, verification and information risks.

Link to this lesson

Test the workflow before making it routine

Evaluate agent usefulness through evidence accuracy, bounded behavior and reviewer effort.

Includes practical AI use, verification and information risks.

Link to this lesson

6.2

Harbor Works assessment

Transfer the method to an unfamiliar tenant

Produce an evidence-linked investigation and challenge an agent plan without relying on the worked Northstar answers.

Includes practical AI use, verification and information risks.

Link to this lesson

Practical AI use, with human judgement.

This course includes role-specific ways to use approved AI assistance, relevant AI threats and failure cases, and checks for evidence, data handling and human approval. Optional prompts use fictional information; an AI account is not required.

AI examples are practical learning activities. They do not add statutory training requirements or replace your organisation’s policies, qualified advice or accountable decisions.