Skip to main content
A customer’s cyber insurance now requires enforced MFA on every account by month-end. The MSP runs the rollout: pull the live user list, classify by department and exception, stage the Conditional Access policy, communicate before each phase, watch enrolment progress, and produce the compliance report the insurer wants. Build the agent’s assignment around completing the customer’s access-policy request: identify the affected accounts, collect approvals, coordinate staged changes and user communication, then verify the result or escalate exceptions. The technical steps below support that full support loop; only assign the agent actions its configured connections permit.

​
Systems involved

​
Technical playbook

1

Build the canonical user list

Copilot reads BambooHR for active employees, reads Entra ID for active accounts, and reconciles the two into one master list with department, manager, account status, and current MFA enrolment state.
2

Classify exceptions

Service accounts, shared mailboxes, on-leave users, and break-glass accounts get tagged. Copilot flags 14 exceptions that need explicit policy carve-outs and writes them into a Markdown table for the customer to sign off.
3

Stage the Conditional Access policy

Through the Graph connector, draft the policy: scope by group, require MFA for all cloud apps, exclude break-glass group, exclude service principals. Copilot shows the draft policy as a JSON artifact for review before push.
4

Communicate phase one

Pull the IT department first. Copilot sends a personalized email through Gmail: why, when, what to do, link to the enrolment guide, escalation contact. Each user gets the right manager copied.
5

Apply policy in report-only mode

The CA policy goes live in report-only mode for the IT phase. Copilot pulls the sign-in logs after 24 hours, finds the legacy OAuth client one user is on, and flags it for remediation before enforcement.
6

Open the helpdesk channel

Assign a team member to prepare the #it-support Teams channel, FAQ, and enrolment guide for the rollout week. Configure any ticket-system response separately using an available, authorized integration. Native Teams approval routing is off. A separately configured Microsoft Graph worker connection can send approved messages when the required scopes and endpoint grants are available.
7

Roll forward by department

Phase by phase — Sales, Engineering, Operations, Finance — Copilot repeats the email, the report-only window, the legacy-app fix, and the enforcement flip. After each phase the enrolment dashboard updates.
8

Chase the non-enrollees

Three days before the deadline, Copilot finds every account not enrolled, drafts a personalized reminder through their manager, and updates the PSA with each holdout’s status.
9

Close the loop

Generate the compliance report: total users, enforced, exceptions, evidence of enrolment, evidence of policy state. PDF goes to the customer CIO and into the cyber-insurance evidence pack.

​
Support outcome

  • The requested policy state is verified against current accounts and signed-off exceptions.
  • Users receive the appropriate guidance, and enrolment problems remain assigned to the helpdesk.
  • The customer receives an evidence-backed completion report and a clear list of unresolved exceptions.

Connectors and MCP

Configure and verify the supported desktop integrations for the systems in your rollout.

Procedures

Promote this rollout into a procedure for the next customer.