Avanade cuts incident resolution time by up to 80% with Microsoft Security Copilot

Professional services firms are moving quickly to help clients adopt AI, and that shift is raising the bar for their own security operations. Clients want advisors that can speak from experience along with strategy. For firms guiding enterprise transformation, secure and scalable AI operations are becoming part of the value proposition. Trust, governance, and operational resilience are core differentiators amidst accelerated AI adoption. 

This industry pressure lands directly on chief information security officers (CISOs), their security operations leaders, and identity teams responsible for organizational AI adoption, access and data protection, and data governance. These leaders must also detect, investigate, and respond to evolving threats while scaling security expertise across teams without slowing the business. In this environment, identity and defense are increasingly intertwined. Both serve as foundational elements of trusted AI adoption.

Secure AI operations start with identity

As a leading global professional services firm, Avanade faced these same pressures firsthand. The pace of AI adoption was increasing faster than traditional identity investigation workflows could support. Avanade needed to modernize its identity-driven security operations and scale security expertise to match the speed of its own enterprise AI adoption. 

Traditional workflows depended on manual analysis and a limited pool of security specialists. High-volume identity incidents were handled through fragmented, multi-step, manual workflows. Complex cases often required senior subject matter experts, creating bottlenecks and making consistent response harder to scale across the team. Manual investigation time ranged from 10 minutes to as much as 77 minutes, depending on the scenario. 

This dynamic created a familiar tension for security leaders. Identity incidents weren’t going away, and it wasn’t enough to have AI. Avanade needed repeatable ways to embed AI into investigations, workflows, and security operations to scale expertise without asking every engineer to become a senior specialist. This challenge provided an opportunity to demonstrate secure, scalable AI operations within the organization and more credibly guide clients through AI transformation. “Clients trust us to help them move forward with AI. That means we have to be just as disciplined about how we secure and operate it internally,” says Tony Leraris, Chief Information Officer, Accenture.

Bringing AI into daily identity investigations

Avanade addressed this challenge by embedding Microsoft Security Copilot into daily identity and access management operations with Microsoft Entra. Engineers used Security Copilot during live identity investigations to bring together identity signals, investigator guidance, and recommended next steps in a single workflow. Rather than gathering context manually across multiple tools and screens, analysts could focus on decisions and resolution. This brought AI into the workflow where identity investigations already happened. 

In a five-week pilot, engineers used Security Copilot to resolve identity incidents across multiple scenarios. The team documented repeated investigative patterns and converted them into prompt-based workflows, helping turn hard-won identity knowledge into a repeatable, consistent model for investigation. This helped standardize investigations across the team. “The real value was giving teams a clearer path through the work. When the process is easier to follow, people can make better decisions more consistently,” explains Rupa Ganesh, Security & Identity Lead, Global IT, Accenture.

Turning expertise into a repeatable workflow

That repeatability mattered. Common scenarios included guest account issues, passwordless sign-in, and passkey errors. During the pilot, engineers were able to resolve complex identity incidents without escalating every case, reducing dependency on senior specialists and helping make security expertise more consistent and easier to scale across the team. “Microsoft Security Copilot helped us bring the right identity signals together during active triage, so engineers could consistently move from investigation to resolution much faster. The speed is important, but the consistency matters just as much,” says Bob Bruns, Chief Information Security Officer, Avanade. Guest account investigations dropped from 10 minutes to 1 minute, while passwordless phone sign-in dropped from 27 minutes to 2 minutes. Avanade reduced mean time to resolution by approximately 70% to 80%, cutting average incident resolution from 10 to 12 minutes down to 2 to 3 minutes. For security leaders, the value was not only speed and consistency, but also more scalable expertise and operating model capacity, all without increasing headcount.

Expanding AI-assisted security operations

Security Copilot became part of the identity operations team’s daily workflow at scale as Avanade continued building the secure operational foundation needed to support AI adoption. The impact became especially visible during Avanade’s passkey rollout to approximately 17,000 users. Identity teams used Security Copilot to help focus on passkey-related issues, provide faster resolutions, and manage more than 180 passkey adoption–related support tickets per day. As those AI-assisted workflows became part of daily identity operations, Avanade applied a similar approach to security operations.

Custom agents transform security operations

To expand AI-assisted workflows across security operations, Avanade built custom agents on top of the Security Copilot platform to support its unique investigations and workflows. The agents consolidate security signals, recommendations, and playbook-based next steps for analysts. In doing so, they capture documented institutional knowledge and codify workflows, helping scale security expertise throughout the investigation process. 

The impact extended beyond workflow design. In a separate study of more than 4,100 security operations investigations, Avanade found a 70% improvement in speed and efficiency, a 7% improvement in investigation and documentation quality, and a 7% reduction in human error. The team also evaluated how the new investigation workflows affected the analysts, who reported a 38% reduction in exhaustion levels, 31% lower work intensity, and 24% less distraction frequency. The findings suggest that agent-assisted, codified workflows can improve both security outcomes and analyst experience. By reducing repetitive investigation tasks and standardizing how work gets done, Avanade enabled analysts to resolve issues faster, decrease manual effort, and deliver more consistent results across the team.

Expanding an agentic security foundation

Avanade implemented Security Copilot, AI-driven workflows, and custom agents on top of a longstanding Microsoft security foundation. “We’ve been on Microsoft Sentinel and Microsoft Defender XDR for as long as they’ve existed. To some extent, that’s the cornerstone of the security operations team,” says Greg Petersen, Associate Director, Security Engineering & Attack Surface Management, Accenture. Alongside longtime investments in Microsoft Entra, Security Copilot, Defender, Microsoft Sentinel, and Microsoft Purview Data Loss Prevention (DLP), Avanade is beginning to explore agentic solutions for its DLP incident response capability. For Petersen, Bruns, and their teams, the two ongoing conversations are about “AI for security” and “security for AI” as they evaluate how to apply emerging capabilities across increasingly complex environments.

Scaling repeatable success across enterprise

Avanade plans to expand Security Copilot usage across broader identity and access management and support teams, continue formalizing its prompt library, and further measure operational impact and ROI. The question is no longer whether codified workflows and agent-driven investigations can improve security operations, but how broadly those practices can be applied at an enterprise scale across Avanade’s parent company Accenture. What began as an effort to modernize identity and security operations supporting approximately 17,000 users now has the potential to inform security operations at an organization of nearly 800,000. By modernizing its identity and security operations, Avanade has strengthened a security posture that directly affects client trust, while demonstrating practices that support AI adoption at scale. “Microsoft Security Copilot has helped our identity operations team work smarter and move faster. By turning expert knowledge into repeatable, AI-assisted workflows, we reduced resolution times by up to 80% and enabled the team to take on more work with greater consistency and confidence,” says Sachin Desai, Associate Director, Global IT Security, Accenture.

Discover more about Avanade on Facebook, Instagram, LinkedIn, X, and YouTube.