IMC — Customer Success Report

1. Identity Threat Response

Category: SOC — Identity threat response

Description: Automated detection-to-response pipeline for identity-based threats surfaced by Microsoft Entra ID Identity Protection. Covers the full remediation arc: resolving elevated risk scores, revoking live sessions on compromised accounts, and formally confirming user compromise for downstream case handling.

Business problem solved: Identity threats are time-critical — every minute a risky or compromised session remains active extends attacker dwell time. These playbooks remove the manual lookup-and-act cycle from SOC workflows, enabling sub-minute remediation at scale.

Integrations: Microsoft Entra ID (Identity Protection, Graph API)

2. Credential & MFA Lifecycle

Category: IAM — Password & credential lifecycle

Description: On-demand credential operations for Entra ID users — password resets and MFA device resets. These playbooks validate user identity before acting, then execute the credential change and return a structured status output.

Business problem solved: Credential resets are high-frequency, low-complexity operations that consume helpdesk and SOC analyst time disproportionately. Automating them frees up staff for higher-value work while ensuring resets are executed consistently and auditably.

Integrations: Microsoft Entra ID (Graph API), BTSG Entra ID tenant

Utility Subflows (supporting infrastructure)

These playbooks are not counted in KPIs — they are shared subflows invoked by the workflows above, not standalone business actions.

Strengths

• High-volume identity threat automation. With 1,668 user risk resolutions and 521 session revocations in 12 months, the identity threat response use case is clearly operational and running at production scale. This represents meaningful SOC time saved on Entra ID Identity Protection alerts.
• Well-structured subflow architecture. The "Get User" utility subflow is called consistently across all response playbooks, indicating a clean, reusable design pattern that keeps individual playbooks lean and avoids duplicated lookup logic.
• Multi-tenant coverage. The presence of BTSG-prefixed playbooks (BTSG Entra ID tenant) alongside IMC playbooks shows the automation layer spans multiple Entra ID tenants, likely reflecting IMC's managed service or multi-entity structure.

Gaps & Opportunities

• Enable/Disable User and BTSG playbooks show zero executions. The Enable/Disable User playbook exists but has never run — this could indicate it was built speculatively or is pending integration into a trigger flow. The BTSG credential playbooks are similarly dormant, suggesting the BTSG tenant may be underutilized or the integration is not yet fully activated.
• No trigger-driven (event-based) playbooks observed. All playbooks are automation_type: on_demand, meaning they are manually invoked or called from external orchestrators. There is no evidence of Blink-native alert triggers or scheduled automation. Attaching the identity threat response playbooks to an Entra ID Identity Protection alert trigger would reduce response time and remove the human initiation step entirely.
• Narrow integration footprint. The entire automation estate is built on a single integration: Microsoft Entra ID. There are no EDR, SIEM, ticketing, or communication integrations present. Expanding into adjacent tools (e.g., auto-creating a ticket on compromise confirmation, or notifying a Slack channel on session revocation) would increase the business value and audit trail of existing workflows.
• Confirm User Compromise is almost unused (3 runs). This playbook sits at the end of the investigation chain but sees very low usage relative to the upstream risk-resolution workflows. This may indicate analysts are skipping the confirmation step, or that the workflow is not surfaced prominently enough in the response process.

Integration Ecosystem