Quest Unveils GenAI Driven Identity Security for Microsoft Entra at Ignite 2025

Background / Overview​

• Identity protection and response — Security Guardian with generative AI assessment summaries, a Security Copilot agent, cloud‑native audit, and workload identity detection.
• Identity migration and resilience — Identity Modernization Suites, On Demand Migration enhancements, and tighter disaster recovery for identity.
• Data governance and AI readiness — GenAI additions to the erwin Data Management Platform to accelerate trusted data product delivery.

What was announced: feature rundown​

Security Guardian: AI assessments and Copilot agent​

• Security Guardian Intelligence now produces AI‑generated security assessment summaries — single‑page, executive‑style reports that surface critical identity gaps, contextualise attacker behavior, and prioritise remediation steps.
• A Security Guardian Agent for Microsoft Security Copilot is now offered in the Microsoft Security Store, enabling Security Guardian to feed identity context directly into Copilot workflows used by analysts in Sentinel and Defender for Identity.
• Security Guardian Audit adds a cloud‑native auditing and compliance offering designed to replace legacy on‑prem auditing stacks with scalable retention and reporting.
• New detection and visibility for non‑human / workload identities in Microsoft Entra ID (service principals, managed identities, application objects) to find over‑privileged or exposed machine identities.

Migration and modernization​

• Identity Modernization Suites — a three‑tiered, end‑to‑end platform that combines migration tooling, security, audit, backup, and recovery to lower risk during large‑scale migrations from on‑prem AD to cloud Entra ID.
• On Demand Migration expands discovery and migration coverage for Microsoft Power Platform workloads: Power Apps discovery was previewed earlier and a Power Automate discovery preview was announced to inventory low‑code/no‑code assets during tenant consolidation.
• Quest positions On Demand Migration as Microsoft 365 Certified for tenant‑to‑tenant scenarios and cites its past volume: the company states it has moved more than 200 petabytes of data and over three billion chat messages in previous engagements.

Data & governance​

• The erwin Data Management Platform receives expanded GenAI features to accelerate the creation and delivery of trusted, governed data products, with the goal of tying identity modernization to a secure, AI‑ready data foundation.

Why this matters: the practical case for an AI‑enabled identity stack​

• Contextualisation at scale. AI summaries are aimed at distilling thousands of low‑level identity alerts into concise narratives that surface the highest‑impact problems. That can reduce cognitive load for overworked SOC analysts and provide executives with clearer remediation asks.
• Operational integration. Publishing an agent to the Microsoft Security Store and mapping into Security Copilot, Sentinel, and Defender for Identity keeps identity signals inside analyst workflows instead of separate consoles — a practical win for time‑to‑response.
• End‑to‑end lifecycle coverage. By combining detection, audit, migration, backup, and recovery into a coherent suite, Quest is attempting to address not only prevention and detection but also recovery and migration risk — a full lifecycle approach that many organisations lack today.

Critical analysis: strengths, limitations, and risks​

Strengths​

• Deep Microsoft alignment. Tight integration with Security Copilot, Sentinel, and Defender for Identity is a strong engineering bet: these Microsoft platforms are increasingly the operational hub in hybrid Microsoft environments. Embedding identity context directly into Copilot workflows reduces tool switching and makes identity signals actionable.
• Workload identity focus. Treating non‑human identities as a first‑class problem is overdue. Machine identities are proliferating with agentic AI and automation; visibility and remediation guidance here directly reduce a rising attack vector.
• Audit and retention modernization. Security Guardian Audit’s cloud‑native approach addresses long‑standing operational pain with on‑prem auditing stacks and retention limitations — useful for compliance and forensic needs.
• Consolidated migration tooling. Packaging migration with audit, backup, and recovery into Identity Modernization Suites addresses real operational gaps during tenant consolidations, mergers, or BYOD-era migrations. The Power Platform discovery additions recognise the real migration blindspots caused by low‑code/no‑code work.

Limitations and caveats​

• Vendor‑claimed metrics require caution. Claims such as “recovery up to 90% faster,” “200 petabytes migrated,” and “three billion chat messages” are vendor statements that illustrate scale, but they should be treated as marketing benchmarks until independently validated in third‑party case studies or audits. Organisations should demand empirical evidence or run pilot validations to confirm these numbers against their own baselines.
• AI hallucination and accuracy risk. Generative AI summaries are only as reliable as their inputs and guardrails. There is a real risk that plain‑language remediation guidance can omit critical context, misprioritise findings, or over‑simplify complex AD/Entra interactions. Human‑in‑the‑loop validation is essential, especially for high‑impact remediation steps that change access controls.
• Over‑automation without robust playbooks. Integrating machine‑speed prevention into Copilot and Sentinel workflows is tempting, but automated containment must be governed by tested playbooks. Mistakes in automated remediation can cause business disruption — for example, incorrectly disabling a service principal or locking out admin accounts.
• Data protection and privacy when using GenAI. AI summary generation and GenAI features in the erwin platform may process sensitive metadata and audit logs. Organisations with strict data residency, handling, or regulated data should verify where model inference occurs, whether PII is transmitted, and how model outputs are stored and audited.
• Supply‑chain and third‑party trust. Adding a new agent into Security Copilot and the broader Microsoft security graph introduces a supply‑chain decision point. Customers must validate vendor security posture, independent certifications, and contract terms related to liability and data handling.

Technical posture and verification of claims​

• Quest announced AI‑enabled updates to Security Guardian and On Demand Migration at Microsoft Ignite 2025 and via company press materials. The new Security Guardian features include AI‑generated assessment summaries and an agent integration point for Microsoft Security Copilot.
• Microsoft’s security platform strategy — including Security Copilot, the Microsoft Security Store, and Sentinel’s data lake/agent model — provides the ecosystem Quest targets for integrations and agent workflows.
• Quest asserts On Demand Migration is Microsoft 365 Certified and cites past migration scale figures. Microsoft‑level certification processes exist to validate third‑party migration tooling, but certification is just one input to procurement decisions and should be validated against organisational security requirements.
• Several numerical claims made by Quest (percentages of faster recovery, quantity of data migrated) are presented as vendor performance claims; independent third‑party benchmarks and customer case studies are limited in public reporting. Those claims should be validated in pilots and proofs of concept before using them as procurement justification.

Operational recommendations — how to evaluate and adopt safely​

• Run a controlled pilot
• Deploy Security Guardian in a segmented test tenant. Ingest a representative subset of AD + Entra signals and compare AI summaries to manual triage outcomes.
• Validate false positive and false negative rates for the AI remediation suggestions.
• Maintain human‑in‑the‑loop controls
• Use AI summaries to accelerate briefing and prioritisation, but require human sign‑off for any automated remediation that modifies accounts, group memberships, or privileged roles.
• Validate playbooks and rollback
• Before enabling automated containment, develop and test playbooks that include clear rollback steps and emergency escalation paths.
• Run tabletop exercises that simulate common identity attack scenarios to test coordination across Sentinel, Copilot agents, and Security Guardian prevention actions.
• Audit model data flows and retention
• Map what telemetry and logs are sent to generative services or cloud inference engines, and ensure data residency and PII controls meet compliance needs.
• Enforce logging and immutable audit trails for all remediation actions initiated by AI or agents.
• Treat workload identities as code
• Inventory service principals, managed identities, and app registrations. Apply least‑privilege policy modeling and automated periodic revalidation of entitlements.
• Where possible, replace static credentials with Managed Identity patterns and rotate secrets programmatically.
• Use migration suites with pre‑migration risk assessments
• For tenant consolidation and Entra migrations, require pre‑migration risk assessments and backups. Use the Identity Modernization Suite’s backup and recovery measures to create a recovery window and avoid accidental lockouts.
• Include Power Platform discovery in migration scope to uncover embedded connections, service accounts, and API keys.
• Require independent verification for vendor claims
• Ask vendors for measured customer outcomes, audit logs, and references. Run a brief benchmark migration or recovery test that reproduces the vendor’s performance claims in your environment, if feasible.

Security architecture implications​

• Data centralisation in Sentinel becomes more valuable: consolidated logs and a Sentinel data lake improve AI model context and reduce blind spots.
• Role of identity tooling shifts from detection-only to remediation orchestration. That demands a tighter coupling between IAM, PAM, endpoint controls, and SIEM/XDR systems.
• Policy automation and governance must keep pace. As AI automates triage and produces exec summaries, governance frameworks (change approval, least privilege certification, entitlement reviews) must integrate AI outputs into normal audit cycles.
• Disaster recovery becomes mission critical. Faster recovery claims are compelling, but teams must still verify recovery SLAs against regulatory and business continuity requirements.

Practical checklist for CIOs, CISO, and identity teams​

• Confirm vendor certifications (e.g., Microsoft 365 Certification) and request details on the certification scope.
• Demand reproducible benchmarks for recovery and migration claims; require a pilot or proof of value.
• Insist on end‑to‑end logging and immutable audit trails for any AI‑driven remediation steps.
• Prioritise workload identity inventory and remediation; treat machine identities as first‑class governance objects.
• Establish human approval gates for high‑impact automated actions and maintain rigorous rollback playbooks.
• Review data flows for GenAI features, including where models run and how telemetry is stored and protected.

The wider market context​

Conclusion​