AI Assistance

Azure AI Foundry advisory layer. AI proposes correlation, explanations, and summaries; it never disables accounts or takes action on its own. The model endpoint is provisioned by infrastructure; the switches below are operator-owned and merge on top of that baseline. With AI off, the platform uses deterministic logic only.

Provisioned
-
Model
-
Endpoint
-
Status
-
AI assistance (master switch) Global kill switch. When off, no AI call is ever made.
Workflows
Identity correlation thresholds

Confidence (0-1) at which a match is auto-disabled, is staged as probable, or is routed to review. The Auto-disable threshold applies only to direct matches on a unique identifier (UPN, email, employee or contractor ID, SAM) - those are disabled automatically when auto-disable is enabled below. Fuzzy/AI name matches, and sensitive and EDR/OS-login matches, always route to review regardless of score.

Enable auto-disableWhen on, a direct-match (UPN / email / employee or contractor ID / SAM) finding at or above the Auto-disable threshold is disabled automatically - no operator Remove click. Off by default. EDR/OS-login, privileged/shared/service and the Database connector are never auto-disabled on a score - they always route to review.
AD-group affinity (learned per domain)

Lifts a name-matched account when the person's AD groups are associated (in this domain) with that connector - e.g. an Engineering leaver's GitHub match. Learned from confirmed matches per tenant; bounded so it can never auto-link (it only sharpens review priority). The optional seed bootstraps a domain before enough confirmed samples accrue.

Enable AD-group affinityDeterministic corroboration; advisory only, never auto-disables.
Cross-account evidence fusion (AI-led)

When a leaver is already confirmed in several systems (by a strong ID such as email or employee number), the AI weighs that confirmed footprint to raise a weak, name-only match in another system - e.g. a look-alike AWS login becomes more believable once the person's Okta, AD and GitHub are confirmed. Advisory only and bounded: a non-strong-ID match it touches is held below the auto-link threshold, so it sharpens review priority but never auto-disables (a different person of the same name is never shut off automatically).

Enable cross-account fusionAI-led corroboration from the person's confirmed accounts; advisory, never auto-disables.
Username naming conventions (AI training data)

Declare how your org mints usernames/logins from a person's name. Each line is one template; the platform expands it for every departing person and treats a connector login that matches a generated form as a strong name signal - so jsmith correlates to Jane Smith even when raw string similarity is low. These forms are also handed to the AI model as grounded candidate usernames. Tokens: {first} {last} {f} (first initial) {l} (last initial) {employee_id}. Literals between tokens are kept. Advisory only - convention hits stay below the auto-link threshold and never disable an account on their own.

Service-account exclusions (AI training data)

Login fragments that mark a connector account as a non-human service / bot / system account, so identity correlation never links it to a departing person. Each line is one substring, matched case-insensitively against the account login (e.g. svc_backup01 is excluded by svc_). A strong unique-identifier match (UPN / email / employee ID) is never excluded - that account is the person's regardless of naming. Deterministic and advisory - excluded accounts are dropped from correlation before scoring, so they are never reviewed, never sent to the AI model, and never auto-disabled. One fragment per line.

AD group risk presets

Assign a risk rating (0-100%) to specific AD security groups. When a contractor belongs to one of these groups, their score on the Contractors page is raised to at least that rating - e.g. Enterprise Admins = 100 forces a critical score. Deterministic and always-on: this applies even when the AI master switch above is off. One per line: group name = percent.