Security & Identity Agent
A suspicious sign-in at 2 a.m. or a user reporting a phishing email shouldn't wait for the morning queue. The Security & Identity Agent checks the account in Microsoft 365 and Duo, contains the risk following your playbook and hands a clean summary to your security lead.
Tickets it resolves every day
What lands in the queue, and what the agent does about it.
Impossible-travel sign-in for j.roy
ResolvedRevoked sessions, reset the password, forced MFA re-registration and notified the client contact.
“I think I clicked a bad link”
ResolvedChecked recent sign-ins and inbox rules, removed a forwarding rule, reset credentials.
Locked out of Duo
ResolvedVerified the user, issued a bypass code per policy and re-enrolled the new device.
New inbox rule forwarding to Gmail
ResolvedDisabled the rule, flagged the account and escalated to your security lead.
What the Security & Identity agent handles
You choose which cases are enabled for each client, and how much it can do on its own.
Account compromise
- Revoke sessions and tokens
- Password and MFA reset
- Suspicious inbox rule cleanup
- Sign-in history review
MFA & Duo
- Duo lockout and bypass per policy
- New device enrollment
- MFA method reset
- Verification before any change
Phishing reports
- Checks who else received it
- Reviews the user's recent activity
- Contains the account if needed
- Writes a clear summary for the client
Diagnose, plan, approve, execute
Diagnoses against live state
Checks the real state of the tenant, account or device, and pulls the client's SOP for the issue.
Builds a plan with sources
Every step cites where it comes from: a client SOP, live state, or a clearly flagged best practice.
Approve, or delegate
Your tech approves each action in one click, or you let trusted cases run on their own.
Executes, verifies and logs
Runs the approved actions, confirms the fix worked and writes everything to the ticket and audit trail.
Security & Identity Agent questions
Does it replace our SOC or EDR?
No. It works the identity and account side of alerts that land in your PSA, and escalates anything outside its playbook to your security lead or SOC.
How does it avoid acting on a fake request?
Every change starts with end-user verification, and containment steps follow the playbook you approved for each client.
Pair it with the rest of the team
How MSPs Use Mizo AI: Customer Success Stories
See how high-growth MSPs use Mizo to deliver faster support with AI-powered service desk automation.
Commandare Technologies
Patrick Racine, Founder & President
With Mizo handling our triage, our technicians can focus on work that truly matters
Patrick Racine
Founder & President, Commandare Technologies
How MSPs Use Mizo AI: Customer Success Stories
See how high-growth MSPs use Mizo to deliver faster support with AI-powered service desk automation.
Nexxo Technologies
Laurence St-Yves, Chief Technology Officer
Our kill rate is better. Our SLA compliance is better.
Laurence St-Yves
Chief Technology Officer, Nexxo Technologies