Integrations

One overlay. Every console.

Pick a vendor to watch what OA6 does there. Microsoft works today. The others are previews of what is being built, and each one says how far along it is.

By vendor

Choose a vendor

OA6 acts only as the signed-in administrator. Where a vendor has no sign-in that names the person, OA6 reads what it can and hands you the fix in that vendor's own console.

Microsoft

Works today

Entra ID · Intune · Defender XDR · Defender for Endpoint · Defender for Identity · Defender for Office 365 · Defender for Cloud · Purview · Azure RBAC

OA6 reads the Microsoft page you have open, puts identity, device and security readings on one card, explains them, and makes the change you approve, as you.

Status Microsoft works today. Incidents and alerts come from Defender XDR, so a detection raised by Defender for Identity, Defender for Office 365, Defender for Endpoint or Defender for Cloud is named by the product that raised it, and OA6 triages any of them as you. Azure resources are read-only: OA6 shows who has access, what protects them and what Defender for Cloud makes of them, and changes nothing there.

Microsoft, step by step

OA6you@northwind.example⋯

Microsoft Entra ID · UsersJordan Reyes

OA6 recognizes the page you have open and reads your tenant as you.

Jordan Reyesjordan.reyes@northwind.example

EnabledNo MFA

High

Identity riskEntra ID Protection · at risk

Alerts (2)Unfamiliar sign-in properties · Atypical travel

Revoke sign-in sessions

user jordan.reyes@northwind.example

Invalidates every refresh token and browser session, so the account must sign in again everywhere.

CancelApprove

View code

NW-LT-0417Windows 11 · primary user Jordan Reyes

IntuneCompliant

DefenderExposure high

Alerts (1)Suspicious PowerShell command line · High

rg-finance-prodResource group · subscription Northwind Production

Who has access2 Owners · 5 Contributors · 1 inherited from the subscription

LocksDelete lock, set on the subscription

Read-only in Azure.

stfinanceprod01Storage account · resource group rg-finance-prod

Defender for Cloud (2 failing)Restrict network access to the storage account · High severity

1 check did not runSwitched off by policy, so neither a pass nor a failure

1 Defender plan off in this subscriptionStorage accounts · with a plan off there is no threat protection to raise an alert, so quiet does not mean safe

OA6 reads this. It does not turn a plan on or change a recommendation.

ServiceNow

In preview

Users · CMDB assets · Incidents

OA6 pairs the ServiceNow user, asset and ticket with the Entra account and Intune device they describe, and proposes the fix on the Microsoft side when the two disagree. Each admin signs in with their own ServiceNow account, and OA6 only reads ServiceNow.

Status ServiceNow is in preview and is not available yet. It is read-only on ServiceNow, has not yet run against a real ServiceNow instance, and the changes it proposes are made in Microsoft, with your approval.

ServiceNow, step by step

OA6you@northwind.example⋯

Microsoft Intune · DevicesNW-LT-0288

ServiceNow is read from the Microsoft side, on a user or a device.

NW-LT-0288Windows 11 · primary user Sam Patel

IntuneChecked in today

ServiceNowAsset: stolen

Asset NW-A-3310Marked stolen on September 19

Paired by serial number.

A stolen device that still checks in. Each fix waits for your approval and runs as you.

ServiceNow incident INC0010231Caller Sam Patel · NW-LT-0288

Defender incident 4391Matched through the ticket's correlation ID

Okta

In preview

Users · Sessions · Factors · System Log

OA6 pairs each Okta user with their Entra account and shows where the two disagree, such as an account blocked in Entra that still has live Okta sessions. Each admin signs in with their own Okta account, and OA6 only reads Okta.

Status Okta is in preview and is not available yet. It will be read-only on Okta; acting in Okta from OA6 is planned.

Okta, step by step

OA6you@northwind.example⋯

Okta Admin Console · PeopleJordan Reyes

Read-only on Okta, signed in as you.

Jordan Reyesjordan.reyes@northwind.example

OktaActive · 2 sessions

EntraSign-in blocked

System LogSign-in from a new country, 40 minutes ago

Blocked in Entra, but still active in Okta with 2 live sessions.

FactorsOkta Verify · SMS

Paired with the Entra account by user name.

Google

In preview

Google Workspace · ChromeOS · Google Cloud

One Google sign-in covers Workspace users and Alert Center, ChromeOS devices, and Google Cloud access. OA6 puts them on one card beside the same person in Entra. It only reads Google.

Status Google Workspace, ChromeOS and Google Cloud are in preview and are not available yet. They will be read-only; acting in Google from OA6 is planned.

Google, step by step

OA6you@northwind.example⋯

Google Admin · Alert centerSuspicious login · alex.kim@northwind.example

Read-only on Google, signed in as you.

Alex Kimalex.kim@northwind.example · /Sales

2-step verification off

Alert centerSuspicious login · Leaked password

NW-CB-1142ChromeOS · most recent user Alex Kim

Last sync3 days ago

Org unit/Sales/Devices

Google Cloud · IAMEditor on project nw-billing-prod

Read with a read-only Google Cloud permission.

Jamf

In preview

Jamf Pro computers · Groups · Policies

OA6 puts each Mac in Jamf Pro beside its user in Entra, with its groups and the policies in scope. Each admin signs in with their own Jamf Pro account, and OA6 only reads Jamf.

Status Jamf is in preview and is not available yet. It will be read-only on Jamf; admins who sign in to Jamf only through single sign-on cannot use it.

Jamf, step by step

OA6you@northwind.example⋯

Jamf Pro · ComputersNW-MB-0731

Read-only on Jamf, signed in with your own Jamf Pro account.

NW-MB-0731macOS · user Priya Shah

JamfFileVault on

EntraUser disabled

Last check-inToday, 08:14

Static groupsFinance Macs

Policies in scopeFileVault escrow · Software updates

A disabled user's Mac is still checking in.

CrowdStrike

In preview

Falcon hosts · Alerts · Sensor status

On an Intune device, OA6 finds the same host in CrowdStrike Falcon and flags where the two disagree: an open High or Critical alert on a device Intune calls compliant, a host Falcon has contained, or a sensor that has gone silent. Each admin creates their own read-only API client, following setup steps shown on the connection card, and it is kept for the browser session only. CrowdStrike's own logs name that client, not the person. OA6 only reads CrowdStrike.

Status CrowdStrike is in preview and is not available yet. It is read-only on CrowdStrike, and has not yet been tested against a real Falcon tenant.

CrowdStrike, step by step

OA6you@northwind.example⋯

Microsoft Intune · DevicesNW-LT-0502

Read-only on CrowdStrike, with your own read-only API client for this session.

NW-LT-0502Windows 11 · primary user Alex Kim

IntuneCompliant

FalconOpen alert · High

Falcon alertSuspicious process tree · High · open

SensorLast seen 12 minutes ago

Intune calls this device compliant, and Falcon has an open High alert on it.

OA6 changes nothing in CrowdStrike.

Darktrace

In preview

Devices · Model breaches

On an Intune device, OA6 finds the same device in Darktrace by hostname and MAC address and shows its model breaches from the last 7 days. It flags a device Entra has disabled that Darktrace still saw this week, and a device Intune calls compliant that has a high-scoring breach. Each admin pastes their own Darktrace token pair, kept for the browser session only. Darktrace's own logs record the token, not the person. OA6 only reads Darktrace.

Status Darktrace is in preview and is not available yet. It is read-only on Darktrace, and has not yet been tested against a real Darktrace appliance.

Darktrace, step by step

OA6you@northwind.example⋯

Microsoft Intune · DevicesNW-LT-0391

Read-only on Darktrace, with your own token pair for this session.

NW-LT-0391Windows 11 · primary user Morgan Lee

IntuneCompliant

DarktraceBreach score 92

Matched by hostname and MAC address.

Model breaches, last 7 daysUnusual data upload to a rare external host · score 92

AlsoNew outbound connection on a rare port · score 41

Intune calls this device compliant, and Darktrace has a high-scoring breach on it.

OA6 changes nothing in Darktrace.

Proofpoint

In preview

Targeted Attack Protection · Messages · URL clicks

On a person in Entra or Defender, OA6 shows their Proofpoint threats: malicious messages delivered or blocked, and malicious URL clicks permitted or blocked. Live threats join the same Alerts list as Microsoft's, sorted by priority, and when Proofpoint and Defender flag the same URL, file hash or sending IP, the card says Flagged by 2 vendors. It flags a threat still delivered to the inbox, a permitted malicious click on an account Entra rates low risk, and a Very Attacked Person with no MFA. Each admin pastes their own TAP service principal and secret, kept for the browser session only. Proofpoint's own logs name that credential, not the person. The connection card turns it on or off, tests it and signs out. OA6 only reads Proofpoint, because TAP's API is read-only; email removal goes through Defender.

Status Proofpoint is in preview and is not available yet. It is read-only on Proofpoint, and has not yet been tried on a real Proofpoint account.

Proofpoint, step by step

OA6you@northwind.example⋯

Microsoft Entra ID · UsersRiley Chen

Read-only on Proofpoint, with your own TAP service credential for this session.

Riley ChenProofpoint threats since Monday 09:00

EntraLow risk

Proofpoint1 click permitted

2 malicious messages delivered, 5 blocked. 1 malicious URL click permitted, 2 blocked.

Malicious messageStill delivered to the inbox · Flagged by 2 vendors

URL clickPermitted, on an account Entra rates low risk

Very Attacked PersonNo MFA registered

Proofpoint and Defender flagged the same URL, so the alert is listed once, with both.

OA6 changes nothing in Proofpoint.

Mimecast

In preview

Targeted Threat Protection · URLs · Attachments · Impersonation

On a person in Entra or Defender, OA6 shows the last 7 days in Mimecast: malicious URL clicks, malicious attachments and impersonation attempts, with what Mimecast did about each. They join the same Alerts list as Microsoft's and Proofpoint's, and a threat more than one vendor saw is marked Flagged by N vendors. It flags a malicious click Mimecast allowed on an account Entra rates low risk, and a malicious attachment that was delivered. Each admin pastes the client ID and secret of an API application they created in the Mimecast console, which Mimecast runs with that admin's own roles. It needs Read on URL Protection, Attachment Protection and Impersonation Protection, and is kept for the browser session only. Mimecast's own logs name the application, not the person. The connection card turns it on or off, tests it and signs out. OA6 can also remove messages with a malicious attachment. You pick an attachment from this person's Mimecast detections, and Mimecast removes every message carrying that file from all protected mailboxes (last 7 days). It runs only after you approve it, it needs Edit on Threat Remediation in your own Mimecast role, and the reason Mimecast records names you, the time and the file hash. There is no undo.

Status Mimecast is in preview and is not available yet. It reads Mimecast, and removing messages with a malicious attachment is in preview too, behind the approval card. Neither has yet been tried on a real Mimecast account.

Mimecast, step by step

OA6you@northwind.example⋯

Microsoft Entra ID · UsersDana Ortiz

Your own Mimecast API application, for this session only.

Dana OrtizMimecast, last 7 days

EntraLow risk

Mimecast1 click allowed

2 malicious URL clicks, 1 malicious attachment, 1 impersonation attempt.

Malicious URL clickAllowed · Flagged by 2 vendors

Malicious attachmentDelivered · invoice-0923.html

Impersonation attemptHeld

Mimecast allowed a malicious click, and Entra rates this account low risk.

Removes every message carrying invoice-0923.html from all protected mailboxes, last 7 days. Runs only after you approve it. There is no undo.

Cloudflare

In preview

Zero Trust users · WARP devices · Audit log

OA6 pairs each person and laptop with Cloudflare Zero Trust and shows where the two disagree: an account Entra has blocked that still has WARP devices enrolled, a disabled device still connecting through WARP, or what a risky account changed in Cloudflare this week. Each admin signs in with their own Cloudflare account, so Cloudflare's own audit log names the person, not a shared key. Read-only on Cloudflare for now.

Status Cloudflare is in preview and is not available yet. It is read-only on Cloudflare, and has not yet run against a real Cloudflare account.

Cloudflare, step by step

OA6you@northwind.example⋯

Microsoft Entra ID · UsersJordan Reyes · sign-in blocked

Read-only on Cloudflare, signed in with your own Cloudflare account.

Jordan Reyesjordan.reyes@northwind.example

EntraSign-in blocked

Cloudflare2 WARP devices

Blocked in Entra, but 2 WARP devices are still enrolled and an Access seat is still active.

Cloudflare audit log1 change by this account in the last 7 days

AWS

In preview

IAM Identity Center users · Accounts · Permission sets

OA6 pairs each IAM Identity Center user with their Entra account and shows what they can still reach in AWS, such as a person who left but still holds an administrator permission set. It only reads AWS.

Status AWS is in preview and is not available yet. It will be read-only on AWS, through IAM Identity Center.

AWS, step by step

OA6you@northwind.example⋯

AWS IAM Identity Center · Userspriya.shah@northwind.example

Read-only on AWS, signed in as you.

Priya Shahpriya.shah@northwind.example

EntraUser disabled

AWS2 accounts

Permission setsAdministratorAccess on nw-prod · ReadOnly on nw-billing

Disabled in Entra, still assigned AdministratorAccess in AWS.

Oracle

In preview

Oracle Cloud identity domains

OA6 pairs each user in an Oracle Cloud identity domain with their Entra account, with their groups and sign-in factors. It only reads Oracle Cloud, and starts with identity domains.

Status Oracle Cloud is in preview and is not available yet. It will be read-only, and covers identity domains only; the rest of Oracle Cloud is planned.

Oracle, step by step

Build in progress: Patch My PC and Tanium. Being built, not available yet, so neither has a walkthrough.

Illustrations with sample data. Northwind, its people and its devices are fictional. Microsoft, Entra, Intune, Defender, Purview and Azure are trademarks of the Microsoft group of companies, and every other product name here belongs to its owner. OA6 is not affiliated with, sponsored by or endorsed by any vendor shown.

Core features

Read, explain, approve, record

The path every vendor follows, shown on Microsoft, where it works today: fix a user, then a device.

Remediate a user

OA6you@northwind.example⋯

jordan reyesSearch

Reads your tenant as you.

jordan reyesSearch

Jordan Reyesjordan.reyes@northwind.example · Accounts Payable

Jordan Reyes-Ortizjordan.ortiz@northwind.example · Sales

Jordan Reyesjordan.reyes@northwind.exampleAccounts Payable Specialist · Finance

EnabledNo MFA

High

Identity riskEntra ID Protection · at risk

Alerts (2)Unfamiliar sign-in properties · Atypical travel

Recent sign-ins3 from a new country in the last hour

Only actions your own roles allow are listed.

Revoke sign-in sessions

user jordan.reyes@northwind.example

Invalidates every refresh token and browser session, so the account must sign in again everywhere.

CancelApprove

View code

Revoke sign-in sessions

user jordan.reyes@northwind.example

Done. Revoke sign-in sessions was sent.

Recorded: what was proposed, who approved it, and what the tenant answered.

Remediate a device

OA6you@northwind.example⋯

Microsoft Defender · DevicesNW-LT-0417

OA6 recognizes the device on the page you have open, and reads your tenant as you.

NW-LT-0417Windows 11 · primary user Jordan Reyes

IntuneCompliant

DefenderExposure high

Alerts (1)Suspicious PowerShell command line · High

Both readings are your tenant's own. OA6 scores neither.

Only actions your own roles allow are listed.

Isolate from the network

Cuts the device off from everything except Defender itself.

WhySuspicious PowerShell, ticket INC-4417

IsolationFullSelective

CancelApprove

View code

Isolate from the network

device NW-LT-0417

Done. Isolate from the network was sent.

Release from isolationClose

Recorded: what was proposed, who approved it, and what the tenant answered.

Automations · Build in progress

From one incident to a rule, across platforms

Ask OA6 explains an incident that reaches past Microsoft. One approval contains it in Microsoft, the card lists what is still to do in each other console, and OA6 offers to keep the response as a draft rule. The second walkthrough tests a draft rule against past incidents and arms it. The trigger is automatic; whether the act is too is your choice at arming.

Ask OA6 across platforms

OA6you@northwind.example⋯

Incident 4468Suspicious sign-in followed by encoded PowerShell

HighActive

InvolvedTaylor Brooks · NW-LT-0615

What else does this account touch?Ask

Ask OA6 is off until you turn it on. Names and IDs are masked before the question leaves your browser.

Ask OA6Taylor Brooks signed in from a new country, then ran encoded PowerShell on NW-LT-0615. The same account still has 2 live Okta sessions and a WARP device connected through Cloudflare, and a ServiceNow ticket asked for a password reset an hour before the sign-in.

Actions for this incidentFor your roles

Contain the account and device

Block sign-in and revoke sessions for Taylor BrooksHigh
Isolate NW-LT-0615, selectiveHigh

Still to do elsewhere, each with a link and what to do there:

Okta: clear the sessions for Taylor Brooks
Cloudflare: revoke the WARP registration
ServiceNow: note INC0010388

CancelApprove both

Contained in Microsoft

Block sign-in and revoke sessions were sent.

Isolate from the network was sent.

Write-up added to incident 4468: what happened, each step taken, and what is still open in Okta, Cloudflare and ServiceNow.

Automate this responseAfter you close the incident

Automate this incident response?

Block sign-in and revoke sessionsKept together: blocking alone signs nobody out
Isolate the device, full
List the Okta and Cloudflare steps on the card

NoSave as a draft rule

Test the draft rule, then arm it

OA6you@northwind.example⋯

A draft does nothing until it has been tested and armed.

Contain a compromised account

WhenDefender reports Suspicious PowerShell command line after a phishing email, at High or above

ThenBlock sign-in and revoke sessions, isolate the device, stop and quarantine the file, scan, and hand the email to Defender for removal

LimitUp to 10 users and devices

Arm · test it firstTest it

Would have been considered 2 timesLast 30 days, replayed against your own incidents

Incident 4417Jordan Reyes · NW-LT-0417

Incident 4391Sam Patel · NW-LT-0288

Would not have firedIncident 4402, Medium, below the severity floor

The test replays the matching, not the actions. It shows whether the rule would have been considered, not whether each step would have worked.

Worth knowing before you arm it

Jordan Reyes is synced from on-premises AD, so the next sync can undo a block.

Sam Patel is already blocked, so a block there would be skipped.

NW-LT-0288 is already isolated by Defender.

I've reviewed this: arm

Would have been considered 2 times. This press is dead while that count is out of date.

Contain a compromised account

ArmedWaits for approval

The trigger watches on its own. This rule waits for your approval before it acts, and you can promote it to run unattended once it has fired unchanged a few times.

It stops at its expiry date, or if you leave the organization.

Rule matchedIncident 4452 · built the moment you opened it

Contain the account and device

Block sign-in and revoke sessions for Alex KimHigh
Isolate NW-LT-0502, selectiveHigh
Stop and quarantine the file, then scanHigh
Hand the email to Defender for removal

Evidence from the incident is on the card. Any admin with the rights to act can approve it.

CancelApprove all six

View code

DisarmStop all rules

Every firing is recorded with the rule and who armed it.

Status Build in progress. Automations is not available yet, and the connections outside Microsoft are in preview. These walkthroughs show the current design, which may change before it ships.