Live run
Contain a compromised Microsoft 365 account
Approvals
Guardrails
Every playbook, every tenant
-
No more than 5 account disables per tenant per hour without a second approver.This hour: 0 of 5 used at every tenant.
-
Break-glass accounts are never touched, by a playbook or by an analyst.27 accounts protected across 12 tenants. Last stopped one today at 08:15.
-
Servers and domain controllers are never isolated automatically. An analyst approves each one.Last time: KL-FS02 at Kestrel Logistics, approved by R. Adeyemi at 09:24.
-
A customer's own approval policy always wins over a playbook's mode.5 of 12 tenants have one. Brightwater: password resets for finance staff.
-
Every action is logged with who ran it, the call and the response. It can be undone where the API allows, and where it cannot, the step says so before you approve.
Playbooks
| Playbook | What starts it | Mode | Runs, 30 days | Finished clean | Median time |
|---|
Action log
Audit trail, newest first. Entries cannot be edited or deleted.
Older entries are kept for as long as the tenant's events are. Search the action log