Avanade Cuts Identity Incident Resolution Times by Up to 80% with Microsoft Security Copilot

Avanade, a professional services firm, has significantly reduced its identity incident resolution times by up to 80% through the use of Microsoft Security Copilot and Microsoft Entra. The company's engineers embedded AI in their identity investigations and built custom agents to scale security operations.

The need for faster response times arose as Avanade helped clients adopt artificial intelligence, outstripping its manual identity investigation workflows. High-volume incidents were handled through fragmented processes, making consistent responses hard to scale. Manual investigations took between 10 and 77 minutes, depending on the scenario.

Avanade began a five-week pilot where engineers used Security Copilot during live identity investigations to bring together identity signals, investigator guidance, and recommended next steps in a single workflow. The team documented repeated investigative patterns and converted them into prompt-based workflows, allowing analysts to focus on decisions rather than gathering context across multiple tools.

The results were significant, with guest account investigations falling from 10 minutes to one, and passwordless phone sign-in issues dropping from 27 minutes to two. Overall, Avanade cut its mean time to resolution by around 70-80%, bringing average incident resolution down from 10-12 minutes to two-three minutes.