AIRM Knowledge Base

Overview

AIRM (Autonomous Identity and Risk Management) monitors AI agents and non-human identities in your Microsoft 365 environment. It detects risk, scores identities, fires alerts, and gives you the tools to respond — including Response Actions to disable, approve, and manage identities directly from the console.

First Steps

1. Connect Your Tenant

Navigate to Tenants in the sidebar and click Add Tenant. A Microsoft 365 Global Administrator must approve the consent screen — this grants AIRM read access to service principals, audit logs, and directory data. The initial connection is read-only. Write permissions for Response Actions can be enabled separately in Settings.

2. Enable Unified Audit Logging

AIRM requires Unified Audit Logging to be enabled in Microsoft Purview before it can detect behavioural anomalies and authentication signals. Go to purview.microsoft.com → Audit → turn on recording. Note: it can take up to 12 hours for Microsoft to begin sending data after enabling. If this is not enabled, a warning banner will appear on the AIRM dashboard.

3. Run the Baseline Scan

Once connected, AIRM triggers a baseline scan automatically. The first scan inventories everything it finds but fires no alerts. You will receive a baseline summary email when it completes. Anomaly signals require 7 days of baseline data before they become fully active.

4. Review the Dashboard

After the baseline scan, the dashboard shows your Tenant Health Score (Risk + Governance components), AI Agent posture, Non-Human Identity posture, and Blast Radius Exposure. The health score updates after every scan.

5. Configure Alerts

Navigate to Alerting and set your alert delivery email and PSA integration. Default settings send alerts for all P1 and P2 findings immediately. P3–P5 can be configured for digest delivery.

6. Connect Integrations

Navigate to Integrations and configure your PSA or notification channels. AIRM has native connectors for ConnectWise Manage, HaloPSA, and Autotask, plus generic webhooks for Slack, Teams, PagerDuty, and others.

Key Concepts

Scan Schedule

Scans run automatically every Monday at 2am. You can trigger a manual scan at any time from the Tenants page. The audit log poller runs every 30 minutes and detects new AI agents within 30 minutes of admin consent being granted.

MSP Onboarding Flow

As an MSP, you manage multiple client tenants from a single AIRM console. Your account holds the licence — each client tenant you connect is monitored under your MSP plan.

Step 1 — Create your AIRM account

Register at sabikisecurity.com. Your 14-day trial begins immediately with access to all features including PSA integrations and Response Actions. You can connect up to 5 client tenants during the trial.

Step 2 — Connect your own tenant first

Connect your MSP's own Microsoft 365 tenant first. This gives you a reference environment to learn the platform before onboarding clients. Your NFR licence (if applicable) covers your own tenant at no charge.

Step 3 — Connect client tenants

From the Tenants page, click Add Tenant. Each client tenant requires a Global Administrator to approve the AIRM consent screen. You can send the consent link to the client's GA or obtain approval during an onsite visit.

Step 4 — Review initial scan results

The first scan establishes the baseline. Review the AI Agent and NHI lists, check the Blast Radius exposure, and identify any Critical or High risk identities that need immediate attention. The trial results page provides a guided summary.

Step 5 — Configure alerts and PSA integration

Connect your PSA (ConnectWise, HaloPSA, or Autotask) from the Integrations page. Configure alert thresholds and ensure P1/P2 findings create tickets automatically in your PSA.

MSP Console Features

• Tenants overview — health score, AI agent risk, NHI risk, blast radius, and active alerts for every client at a glance
• Unified alerting — alerts from all tenants in one view, filterable by tenant, severity, and type
• Centralised reporting — generate compliance and risk reports for any client tenant from the Compliance & Reporting page
• White-label reports — PDF reports carry your client's logo and company name (MSP Enterprise)
• Invite users — add team members with appropriate roles to manage specific tenants

Direct Customer Setup

As a direct customer, you are monitoring your own Microsoft 365 environment. The onboarding flow guides you through connecting your tenant, running your first scan, and reviewing initial findings.

Prerequisites

• Microsoft 365 tenant with Global Administrator access
• Unified Audit Logging enabled in Microsoft Purview (required for anomaly detection)
• Microsoft 365 Business Premium, E3, or E5 licence (sign-in log access requires E3/E5 or Azure AD P1/P2)

Onboarding Steps

1. Register and select your account type (My Organisation)
2. Click Connect Microsoft 365 — approve the read-only consent screen as Global Administrator
3. AIRM triggers a baseline scan automatically — this takes 5–15 minutes depending on tenant size
4. Review your Trial Results page for the initial risk summary
5. Explore the AI Agents and Non-Human Identities lists to understand what AIRM has found

What AIRM monitors

AIRM monitors every service principal in your tenant — AI agents, integrations, legacy apps, automation accounts, and managed identities. It does not monitor user accounts, email content, files, or SharePoint data. AIRM is an identity risk tool, not a DLP or email security tool.

Connecting a Client Tenant

1. From the AIRM console, go to Tenants and click Add Tenant
2. Copy the consent URL and send it to the client's Global Administrator, or open it yourself if you have GA access
3. The GA approves the read-only consent screen — this grants AIRM access to service principals, audit logs, and directory data
4. AIRM redirects back to the dashboard and triggers a baseline scan automatically
5. The OnboardingBanner shows scan progress — typically 5–15 minutes
6. When complete, click View Results to see the initial risk summary

Enabling Response Actions (optional)

Response Actions require a second consent from the client's Global Administrator to grant write permissions. To enable:

1. Go to Settings → Tenant → Response Actions
2. Click Enable Response Actions
3. The client's GA approves the write-permission consent screen
4. Response Actions (disable/enable SPs, assign owners, approve, suppress) are now available for that tenant

Enabling Unified Audit Logging

If the audit log warning banner appears on the dashboard, the client's tenant does not have Unified Audit Logging enabled. Direct the client's GA to:

1. Go to purview.microsoft.com
2. Navigate to Audit in the left sidebar
3. Turn on recording
4. Wait up to 12 hours for Microsoft to start sending data
5. Trigger a manual scan from the Tenants page to pick up the new data

Tenant Cap During Trial

Trial accounts can connect up to 5 tenants. The cap can be raised by contacting Sabiki Security. On paid MSP plans, there is no tenant cap — you are billed per connected tenant above your plan minimum.

What AIRM Requests Access To

AIRM uses OAuth 2.0 application permissions (not delegated user permissions). The initial connection requests read-only access to:

Response Actions Permissions (optional)

If Response Actions are enabled, AIRM requests additional write permissions:

What AIRM Cannot Access

AIRM does not and cannot access: email content, calendar data, files or documents, Teams messages, SharePoint content, or user passwords. AIRM is an identity monitoring tool — it monitors the identity layer, not data.

Revoking Access

To revoke AIRM access, delete the AIRM enterprise application from your Microsoft Entra ID (Azure AD) tenant. All AIRM data for that tenant can be deleted from Settings → Tenant → Remove Tenant.

Overview

The Tenant Health Score is a composite score from 0–100 that reflects the overall security posture of an M365 tenant's non-human identity environment. It is calculated from two equally-weighted components: Risk Score and Governance Score.

Health Bands

Risk Score Component (50 points)

Deductions are made for:

• Critical risk identities (large deduction per identity)
• High risk identities (medium deduction per identity)
• Active anomaly flags across the tenant
• Identities without a baseline (newly discovered, unscored)

Governance Score Component (50 points)

Deductions are made for:

• Unreviewed high/critical risk identities (identities that have not been approved or rejected)
• Orphaned NHIs (no owner assigned)
• Expired credentials not yet rotated

Key Insight

A tenant can have low inherent risk but poor governance (all identities are low-risk but none have been reviewed). The two-component model captures both dimensions independently. Approving reviewed identities directly improves the Governance Score.

Overview

Response Actions allow you to take direct action on service principals from within AIRM without logging into Microsoft Entra ID. They require a second consent from a Global Administrator to grant write permissions.

Available Actions

Enabling Response Actions

1. Go to Settings → Tenant → Response Actions
2. Click Enable Response Actions
3. A Global Administrator must approve the write-permission consent screen
4. Response Actions become available immediately after consent

Audit Log

Every Response Action is logged in the identity's detail view under the Response Action Log. The log shows the action taken, who took it, when, and includes a before/after record of any changed values. Logs are retained indefinitely and capped at 100 entries per identity.

Licence Requirements

Response Actions are available on Direct Professional and MSP Enterprise plans. They are also available during the 14-day trial so MSPs can evaluate the full feature set.

Available Report Types

Report Branding

All reports can carry your client's logo and company name. Upload the logo in Settings → Branding. White-label branding is available on Direct Professional and MSP Enterprise plans.

Compliance Report — Scope Declaration

Each compliance report includes a scope declaration explaining which controls AIRM maps to directly (native frameworks like NIST AI RMF, ISO 42001) versus contextually (broader security frameworks like E8, ISO 27001). This ensures the report is honest about what it covers and cannot be misread as a full compliance certification.

Remediation Recommendations

Recommendations in all reports use a review-first approach: review permissions, minimise where practical, and if permissions are genuinely required, assign an owner and approve the identity in AIRM rather than removing access that may break business-critical functions.

What is Blast Radius?

Blast Radius measures the potential damage if a service principal's credentials were compromised. It scores what an attacker could do with the identity, not what it has done. A quiet app with write access to Mail, Files, and Directory is still a Critical blast radius identity even if it has never misbehaved.

Blast Radius Band

Attack Path Profile

Every identity has three attack path dimensions scored Low/Medium/High:

• Privilege Escalation — Can an attacker use this identity to gain higher privileges? (e.g. RoleManagement.ReadWrite.All enables role assignment)
• Lateral Movement — Can an attacker move across multiple services? (e.g. access to Mail + Files + Directory)
• Persistence — Can an attacker maintain access after remediation? (e.g. Application.ReadWrite.All enables creating new app registrations)

Blast Radius Map

The blast radius map on the SP detail page shows a network graph of the identity's resource access. Red edges indicate write access, blue dashed edges indicate read access. The larger the centre node and the more red edges, the higher the blast radius.

Approved Identities

Identities that have been reviewed and approved are excluded from blast radius calculations. This allows your team to formally accept the risk of a high-blast-radius identity that is business-critical, while removing it from the exposure metrics that drive the health score.

Alert Lifecycle

Alerts have three statuses: Active, Resolved, and Dismissed. There is no snooze or acknowledge state.

Resolving Alerts

When resolving an alert, you choose a disposition:

• Investigating — Alert is under investigation. Condition noted.
• Resolved — Issue has been addressed.
• Accepted Risk — Risk is acknowledged and accepted. Alert suppressed for 90 days.
• False Positive — Alert is not a genuine risk for this identity. Alert suppressed for 180 days.

Suppression

Suppression prevents the same alert type from re-firing on the same identity for the suppression period. Suppression is stored on the identity record. Critical alert rules (credential manipulation, group manipulation, rogue app) cannot be suppressed.

Auto-Resolution

AIRM automatically resolves alerts when the underlying condition clears. For example, an Orphaned Owner alert auto-resolves when an owner is assigned. A Risk Band Escalation alert auto-resolves if the risk band improves on a subsequent scan.

Webhooks

Alert webhooks fire on alert creation only — not on resolution. The payload is a standard JSON object including tenant ID, SP name, alert type, risk band, priority tier, and anomaly flags. Webhooks are configurable per tenant and can be sent to any HTTPS endpoint. The payload is HMAC-SHA256 signed.

Priority Tier Reference

Automatic Escalation Rules

Four conditions always escalate to Critical/P1 regardless of composite score:

• SP Credential Manipulation — identity has added credentials to another service principal
• Group Member Manipulation — identity has added members to a Microsoft 365 group
• Rogue App Detected — identity matches the Traitorware/Huntress rogue app catalogue
• Coordinated Anomaly — 3 or more anomaly conditions active on the same identity simultaneously

Triage Workflow

1. Review the alert — Check the priority tier, alert type, and affected identity. P1/P2 alerts require immediate attention.
2. Open the identity detail — Click through to the SP detail page. Review the Risk Summary tab for active anomaly signals, scope history, and the Risk Profile radar.
3. Check blast radius — Open the Blast Radius Analysis tab. Understand what an attacker could reach if this identity were compromised.
4. Determine legitimacy — Is this identity known? Is its behaviour expected? Check the publisher, first seen date, and authentication history.
5. Take action — If the identity is legitimate: approve it and assign an owner. If suspicious: use Response Actions to disable it and escalate for investigation. If a false positive: resolve with False Positive disposition to suppress for 180 days.

P1 Response Checklist

• Disable the SP immediately using Response Actions if you cannot verify its legitimacy within 15 minutes
• Check the authentication history for recent sign-in events
• Review scope history for recent permission changes
• Check if other identities from the same publisher are also flagged
• Document your findings in the alert resolution note
• Re-enable the SP only after confirming it is legitimate or after the owner has been contacted

Behavioural Anomaly Signals (AN-01 to AN-11)

These signals require a baseline to be established (minimum 1 prior scan). They detect deviations from each identity's own historical pattern.

Authentication Intelligence Signals (AN-S1 to AN-S6)

These signals analyse sign-in patterns from the audit log. They require 7 days of baseline data and sign-in log access (M365 E3/E5 or Azure AD P1/P2).

Overview

Authentication Intelligence monitors how service principals authenticate, not just what permissions they have. It builds a 7-day rolling baseline of sign-in patterns per identity and fires anomaly signals when patterns deviate.

Data Sources

AIRM polls the Microsoft Graph audit log for service principal sign-in events every 30 minutes. Specifically it reads /auditLogs/signIns filtered to application-only sign-ins.

Licence Requirements

Sign-in log access requires one of:

• Microsoft 365 E3 or E5
• Azure Active Directory Premium P1 or P2
• Microsoft Entra ID P1 or P2

If sign-in logs are not available, Authentication Intelligence signals (AN-S1 through AN-S6) will not fire. All other AIRM features remain fully functional.

Baseline Period

A 7-day baseline is required before most authentication signals activate. AN-S2 (New User Agent) is the exception — it fires immediately on first occurrence without requiring a baseline.

Authentication History View

The Authentication History tab on each SP detail page shows a timeline of recent sign-in events including method (App Only vs Delegated), source IP, user agent, and the resources accessed. Anomaly flags are shown inline with the relevant events.

AI Agent Classification

AIRM classifies service principals as AI agents based on permissions, publisher metadata, app name patterns, and known AI vendor catalogues. Three confidence levels are used:

High-confidence agents can be promoted to Definitive by clicking "Confirm as AI Agent" in the console. This counts them in all metrics and scoring going forward.

Traitorware Detection

AIRM maintains a catalogue of OAuth applications documented by Huntress (Traitorware) as used in real-world identity attacks. A Traitorware match immediately classifies the identity as Definitive AI agent and triggers a Critical/P1 alert regardless of other signals.

NHI Type Classification

Non-human identities are classified into 9 types:

NHI types can be manually reclassified by clicking the type badge on the NHI detail page.

Orphaned Identities

An identity is flagged as orphaned (isOrphaned: true) when its registered owner has left the organisation or the owner field is empty. Orphaned identities have no accountable person and are flagged across all list views and reports.

Credential Monitoring

AIRM tracks the age and expiry of credentials (client secrets and certificates) for every service principal. Credentials that are old, expired, or newly added outside of expected rotation windows are flagged.

Credential Age Thresholds

Credential Age Anomaly (AN-08)

If new credentials are added to an existing identity outside of a known rotation window, AN-08 fires. This can indicate an attacker adding a backdoor credential to maintain persistence after the legitimate credentials are rotated.

Credential Expiry Alerts

Credential expiry alerts fire after the 14-day baseline grace period. They are P3 priority by default. If credentials expire on an actively used identity, AIRM will also flag the authentication failure in the Authentication History tab.

Supported Frameworks

Direct vs Contextual Mapping

Direct mapping — the framework was designed for AI systems or non-human identity governance. AIRM findings map precisely to specific controls. These reports are most defensible in regulatory conversations.

Contextual mapping — the framework is a broader security or compliance standard with identity-relevant controls. AIRM surfaces the applicable controls but cannot assess the full framework. Each contextual report includes a scope declaration explaining this distinction.

Generating Compliance Reports

From Compliance & Reporting, select a framework and click Generate & Download. The report is generated live from current scan data — it reflects the state of your tenant at the time of generation. Reports include a cover page, executive summary, scope declaration, per-control findings, and a remediation priority list.

Native PSA Integrations

AIRM has native two-way integrations with the three leading MSP PSA platforms. P1 and P2 alerts automatically create tickets in your PSA.

Generic Webhook

Any system that accepts HTTPS webhooks can receive AIRM alerts. The webhook payload is a standard JSON object, HMAC-SHA256 signed. Configure from Settings → Integrations → Generic Webhook.

Webhooks fire on alert creation only. The payload includes: tenant ID, tenant name, SP name, SP app ID, alert type, priority tier, risk band, anomaly flags, blast radius band, and a link to the identity in AIRM.

PSA Setup (ConnectWise example)

1. Go to Settings → Integrations → ConnectWise
2. Enter your ConnectWise company ID, public key, private key, and client ID
3. Select the board and status for new AIRM tickets
4. Click Test Connection to verify credentials
5. Enable the integration — alerts will now create tickets automatically

Licence Requirements

PSA integrations are available on Direct Professional and MSP Enterprise plans. Generic webhooks are available on all paid plans and during the trial.

Account Management

Your AIRM account holds the licence that covers all connected tenants. The account owner has full access to all settings, users, and tenants.

Adding Tenants

From the Tenants page, click Add Tenant. New tenants are billed from the start of your next billing cycle. See the MSP Billing article for details on the client trial flow.

Removing Tenants

From the Tenants page, click the tenant and select Remove Tenant. Billing for that tenant stops at the end of the current billing cycle. All scan data and history is retained for 30 days then permanently deleted.

Report Branding

Go to Settings → Branding to upload your logo and set your company name. These appear on all PDF reports. On MSP Enterprise, you can also set per-tenant branding for white-labelled reports with the client's own logo and name.

User Management

From the Tenants page, click Invite User. Users can be assigned roles (see Roles & Permissions article). MSP accounts can invite multiple team members. Users can be restricted to specific tenants if needed.

Support Access

Sabiki Security support can be granted temporary access to your account for troubleshooting via Settings → Support Access. Access is time-limited and logged. You can revoke it at any time.

Account Settings

Access your account settings from the Settings page in the sidebar. Key settings include:

• Tenant connection — view connection status, reconnect, or remove your tenant
• Response Actions — enable write permissions for direct action on identities
• Alert configuration — set alert delivery email, thresholds, and suppression rules
• Integrations — connect PSA tools or configure webhooks
• Branding — upload your logo for PDF reports

Manual Scans

Trigger a manual scan at any time from the Tenants page. Manual scans run immediately and produce results within 5–15 minutes depending on tenant size. Useful after making changes to your Microsoft 365 environment or enabling Unified Audit Logging.

Data Retention

Scan history and identity data is retained indefinitely while your account is active. If your account expires or is cancelled, data is retained for 30 days then permanently deleted.

User Roles

Response Actions and Roles

The disable/enable SP action and other write operations require Admin or Owner role. Approve, assign owner, and suppress alert actions are available to Analyst role and above.

Tenant Scoping

MSP accounts can restrict users to specific client tenants. An Analyst with access to Tenant A cannot see data from Tenant B unless explicitly granted. Owners always have access to all tenants.

The Client Conversation

Most clients have never seen a list of the non-human identities operating in their Microsoft 365 tenant. The AIRM scan results, especially the first one, are often a genuine surprise. The conversation is not "here is a problem you have" but "here is something you have never had visibility into before."

Key Talking Points

• AI agents are proliferating — every Microsoft Copilot extension, Power Automate flow, and third-party integration creates a new identity with permissions. AIRM is the first tool purpose-built to monitor them.
• Non-human identities outnumber humans 100:1 — in most M365 tenants, there are far more service principals than users. None of them have MFA. All of them have persistent credentials.
• Blast radius is the risk that matters — a quiet app with write access to Mail, Files, and Directory is a Critical risk even if it has never misbehaved. Show the blast radius map.
• Compliance obligations are real — EU AI Act, DORA, NIST AI RMF all require AI governance. AIRM produces the evidence.

QBR Structure

1. Open with the Health Score — "Your tenant is at 63/100. Here is why."
2. Show the top 3 highest blast radius identities — "If any of these were compromised, here is what an attacker could reach."
3. Show the compliance gap report — "Here is how this relates to your regulatory obligations."
4. Show the remediation priority list — "Here are the specific actions we recommend."
5. Show the trend — health score over time demonstrates ongoing value.

MSP Revenue Model

MSPs on Enterprise tier ($149/tenant/month) typically bill clients at $199–249/tenant/month, generating 34–67% gross margin on the AIRM component. Every scan also generates remediation findings, which are billable professional services work at standard MSP hourly rates. QBR delivery typically adds $150–300 per client per quarter.

MSP Overview Dashboard

The Tenants page shows every client tenant in a unified view. Each tenant card shows the health score, AI agent risk score, NHI risk score, blast radius band, and active alert count. Tenants are sorted by health score (lowest first) so the clients most in need of attention are always at the top.

Unified Alerting

The Alerting page shows alerts from all connected tenants in one view. Filter by tenant, priority tier, alert type, or risk band. P1 alerts from any tenant are immediately visible without needing to switch tenant context.

Scan Management

Scans run automatically for all connected tenants every Monday at 2am. You can trigger a manual scan for any individual tenant from the Tenants page. Scan history and duration are visible in the admin panel.

Switching Tenant Context

The AI Agents, Non-Human Identities, Compliance, and Alerting views always show data for the currently selected tenant. Switch tenant context from the Tenants page or from the tenant selector in the header when available.

Billing Model

MSP plans are billed per tenant per month on annual commitment. Your monthly invoice is always the greater of your actual connected tenant count or your plan minimum.

Adding Tenants

When you add a new tenant mid-cycle, billing for that tenant begins at the start of your next billing cycle — not immediately. The tenant is fully monitored from the moment it is connected.

Offering Client Trials

Because new tenants are not billed until the next billing cycle, you can connect a prospective client's tenant mid-cycle and remove it before your billing date if they decide not to proceed — at no charge to you.

Recommended approach: Connect the client tenant in the middle of your billing cycle. They receive approximately 2 weeks of free monitoring. If they proceed, leave the tenant connected and it bills from your next cycle. If they do not proceed, remove the tenant before your billing date.

Removing Tenants

Billing stops at the end of the current billing cycle. Your tenant count never drops below the plan minimum for billing purposes. Annual commitment means no mid-year subscription cancellation — only tenant count changes are permitted.

Microsoft 365 Requirements

AIRM Licence Tiers

NFR Licence

The NFR (Not For Resale) licence is a free full-Enterprise licence granted to MSP partners for use on their own internal Microsoft 365 environment. Contact mark@sabikisecurity.com to request an NFR licence as part of MSP partner onboarding.

Common Issues

Anomaly signals not firing

Anomaly signals require a baseline. If AIRM was connected recently, allow at least 2 scans (approximately 8 days) before expecting anomaly signals. Authentication intelligence signals (AN-S1 to AN-S6) require 7 days of sign-in log data and an M365 E3/E5 or Azure AD P1/P2 licence.

Audit log warning showing on dashboard

Unified Audit Logging is not enabled in the client's Microsoft Purview tenant. Go to purview.microsoft.com → Audit → turn on recording. Allow up to 12 hours for Microsoft to start sending data, then trigger a manual scan.

Health score not updating

The health score updates after every completed scan. If it hasn't updated, trigger a manual scan from the Tenants page and wait for it to complete. If the scan fails, check the scan health panel in the admin panel for error details.

PSA integration not creating tickets

Verify your PSA credentials are correct using the Test Connection button in Settings → Integrations. Ensure the board and status you selected still exist in your PSA. Check that the integration toggle is enabled. Tickets are only created for P1 and P2 alerts by default — check your alert threshold settings.

No service principals appearing after scan

This usually means the consent was not approved by a Global Administrator. Only a GA can grant tenant-wide application permissions. Reconnect the tenant and ensure a GA approves the consent screen.

Response Actions button greyed out

Response Actions require a second consent from a Global Administrator for write permissions. Go to Settings → Tenant → Response Actions to initiate the consent flow. Also verify your AIRM licence includes Response Actions (Direct Pro or MSP Enterprise).

Blast radius showing as 0 for AI agents

Trigger a manual scan — blast radius is calculated during the scan and older AI agent records may not have been scored yet. After a fresh scan all identities should have blast radius scores.

Getting Support

Contact support at support@sabikisupport.com. Include your tenant ID (visible in Settings) and a description of the issue. For P1 issues, include "URGENT" in the subject line.

Ticket format: AIRM-{TENANTCODE}-{SEQUENCE}. Response times: Priority email support within 4 hours for Direct Pro and MSP Enterprise. Standard email support within 24 hours for all other plans.