From identity risk
to a response
you can explain.
Orbitra connects the investigation, the decision, and the action in Microsoft. Your team stays in control, with evidence of the specific change it made.
Built for the team that owns Microsoft security.
When the same people handle IT, security, and the next urgent incident, identity response needs a clear path from finding to action. Orbitra is designed for teams without a dedicated identity specialist.
Understand the access behind the finding.
Bring the affected identity, its access, and the available activity evidence into the same investigation. Review users alongside applications, service principals, groups, and roles.
- The question
- Is this expected access, unnecessary exposure, or suspicious activity that needs a response?
- What Orbitra adds
- Its own posture and event detections, supported Entra privilege paths, and prioritized changes based on the analyzed paths they affect.
- What stays explicit
- Privilege alone is not proof of compromise. Signal availability depends on Microsoft licensing and tenant configuration.
Know exactly what you are about to change.
A response proposal names the action and its target. Review the required permissions, the expected result, and the available recovery path before deciding.
- The question
- Should we remove this role, disable this user, revoke these user sessions, or address an application grant?
- What Orbitra adds
- A supported response catalog tied to the identity type. Policy, target validation, and permission checks govern execution.
- Your decision
- Remain in Recommend mode and act yourself, or use Approve mode for Orbitra to execute after a named person approves.
A person authorizes it. Orbitra carries it out.
With the action application consented and the checks satisfied, Orbitra invokes the supported response through Microsoft Graph or Azure. The decision and the provider outcome stay attached to the workflow.
- The question
- Who approved this action, against which identity, and what happened when it ran?
- What Orbitra adds
- Named approval and recorded execution for supported Microsoft actions.
- The boundary
- Every Orbitra-executed response requires a named approver today. Optional AI assistance cannot authorize an action.
Check the change. Keep the record.
For a supported action, Orbitra reads the relevant state back from Microsoft. Keep the provider accepting the request separate from a later read verifying the intended change.
- The question
- Did this response change the access we intended to change?
- What Orbitra adds
- The available before-state, named approval, action result, and verification outcome in the response evidence.
- What it proves
- The specific postcondition checked. Other roles, group paths, grants, sessions, and tokens may require separate review.
Start with a demonstration.
Connect when you choose.
Walk through an identity scenario with a founder using a demonstration tenant. If there is a fit, scope a read-only assessment of your environment before considering response permissions.