Azure Logic App ARM templates that embed AI-assisted capabilities directly into Microsoft Sentinel workflows using a private Azure AI Foundry LLM endpoint.
This repository is an early proof of concept for Foundry-driven AI and LLM enhancement in SOC workflows. The goal is simple: show that one deployed model can support many operational tasks because the workflow logic and prompt design live in the API call, not in the model itself. Each playbook sends a different structured request - summarize an incident, generate KQL, research an entity, assess severity, or evaluate PIM activity - while the model remains the same.
That same pattern is not limited to Sentinel playbooks. The same endpoint and prompting approach can be reused from Azure Functions, Sentinel workbooks, VS Code tooling, notebooks, and third-party SOAR platforms. This repo is just the starting point.
This pattern works for teams without Microsoft Security Copilot access and as an added capability for teams that have it. It is practical for budget-constrained environments, government clouds, and any team that wants to integrate AI into existing SOC workflows without building a chatbot or adopting a new platform.
The templates were originally built and tested in Azure Government to validate the pattern for federal teams. With endpoint and connection adjustments at deploy time, they work equally well in Azure commercial.
This repository is part of a series. The first article, Building a SOC AI API with Azure AI Foundry, covers setting up the Foundry hub, project, and model deployment that these workflows depend on. A follow-up article covering the Logic App workflows in this repo will be published soon.
The individual playbooks live under playbooks/README.md. That folder also contains the bulk deployment scripts for commercial and government clouds.
| Playbook | Purpose | Screenshot | Deploy |
|---|---|---|---|
| close_low_risk_fp_using_foundry_ai | Compare incident against historical closure patterns and close if it matches a likely false positive | image | deploy |
| entity_research_using_foundry_ai | Retrieve and enrich incident entities; more powerful when combined with external grounding | image | deploy |
| get_incident_tasks_from_foundry_ai | Generate up to ten investigation or response tasks and create them on the incident | image | deploy |
| get_kql_from_foundry_ai | Accept a natural language question via webhook and return a generated KQL query | image | deploy |
| get_recovery_steps_from_foundry_ai | Accept a question via webhook and return structured recovery or response steps | image | deploy |
| prioritize_incident_using_foundry_ai | Evaluate severity against historical trends, recommend a change, and update the incident | image | deploy |
| send_foundry_ai_generated_email_summary | Produce an HTML incident summary for email or Teams; requires a messaging connector in production | image | deploy |
| send_incident_to_foundry_ai | Send incident title, severity, and alerts to the model and add the summary to incident comments | image | deploy |
| use_foundry_ai_to_evaluate_pim | Query Entra ID PIM history daily and generate an HTML summary of unusual patterns | image | deploy |
Two Sentinel workbooks are included in workbooks/README.md. The root README references them here, and the full workbook descriptions, setup steps, JSON edit instructions, and playbook mappings are all kept in that single workbook README.
- Azure subscription (commercial or government) with permission to deploy
Microsoft.Logic/workflows - An Azure AI Foundry project and deployed model (see setup steps below)
- Managed identity permissions for the deployed Logic App (see permission table below)
These workflows call a private Foundry API endpoint using Managed Identity. The Building a SOC AI API with Azure AI Foundry article covers the original federal-focused setup in full detail. The steps below are a quick reference for both Azure Government and Azure commercial.
If you do not already have a Foundry hub and project, follow these steps.
Create a dedicated resource group for the Foundry environment. This keeps everything isolated and simplifies cleanup.
Search for Azure AI Foundry in the Azure portal and create a new hub.
- Select identity-based storage access and disable shared key access
- Leave inbound access as public initially
- The hub automatically provisions a storage account and Key Vault
In Azure Government and Azure commercial, the high-level setup is similar, but the deployed inference endpoint format will differ.
Launch Foundry and create a new project within the hub. The project is your API boundary - the endpoint your Logic Apps will call.
One project typically covers all use cases because behavior is defined by the system prompt in each API request. Create additional projects only when you need separation for security, data, or deployment lifecycle reasons.
Select a model such as GPT-4o using Microsoft-hosted deployment with the Data zone (Standard) option to keep data within a geographic boundary. You can swap models later without rebuilding the project.
After model deployment, copy the actual inferencing endpoint for the deployed model. Do not use the Foundry portal URL, project overview URL, or a generic studio link. The Logic Apps need the model's HTTPS inference endpoint for the deployed chat model.
Get this URI from the deployed model page, endpoint page, or code sample page for the deployment you intend to call. In practice, look for the endpoint shown for chat completions and copy the full HTTPS URL including the deployment name and api-version.
Correct Azure Government example:
https://example-foundry.openai.azure.us/openai/deployments/gpt-4o/chat/completions?api-version=2025-01-01-preview
Correct Azure commercial example:
https://example-foundry.cognitiveservices.azure.com/openai/deployments/gpt-4.1/chat/completions?api-version=2025-01-01-preview
Notes:
- Azure Government commonly uses the
openai.azure.usdomain pattern. - Azure commercial commonly uses the
cognitiveservices.azure.comdomain pattern. - The important part is that the URI ends with
/openai/deployments/<deployment-name>/chat/completions?api-version=.... - Use the exact deployment name for the model you want these playbooks to call.
- Do not paste the studio home page, project page, or a bare resource URI.
The Logic App Managed Identity requires the following role assignments before workflows will run successfully:
| Role | Scope |
|---|---|
| Microsoft Sentinel Responder | Sentinel workspace |
| Cognitive Services User | Foundry resource |
| Microsoft Sentinel Playbook Operator | Sentinel workspace (optional, for manual testing) |
Each playbook folder has Deploy to Azure and Deploy to Azure Government buttons in its own README. If you want to deploy one workflow at a time, use those individual playbook README deployment options. Click the link in the Deploy column of the table above to go to the playbook README and use the correct button for your cloud.
Download the repo and run one of the deploy-all scripts from the playbooks/README.md folder. Both scripts prompt for required values if parameters are not supplied on the command line.
Prerequisites:
- Azure CLI installed
- PowerShell 7+
- Sign in:
az login(oraz cloud set --name AzureUSGovernment && az loginfor government) - Contributor rights on the target resource group
Azure commercial:
.\playbooks\Deploy-All.ps1 `
-ResourceGroup <resource-group-name> `
-WorkspaceName <log-analytics-workspace-name> `
-FoundryUri <foundry-endpoint-uri>Azure Government:
az cloud set --name AzureUSGovernment
az login
.\playbooks\Deploy-All-Gov.ps1 `
-ResourceGroup <resource-group-name> `
-WorkspaceName <log-analytics-workspace-name> `
-FoundryUri <foundry-endpoint-uri>Each script deploys all nine playbooks sequentially and prints a summary table on completion. Failed deployments are flagged and the script exits with a non-zero code.
After deployment, finish the setup in this order.
Make sure the foundryUri parameter points to the correct deployed model endpoint. This must be the model inference URL for the deployed chat model, not the Foundry studio URL.
Azure Government example:
https://example-foundry.openai.azure.us/openai/deployments/gpt-4o/chat/completions?api-version=2025-01-01-preview
Azure commercial example:
https://example-foundry.cognitiveservices.azure.com/openai/deployments/gpt-4.1/chat/completions?api-version=2025-01-01-preview
In each Logic App, the action named HTTP - Call Foundry should post to that endpoint.
Assign the following roles to each Logic App system-assigned managed identity before testing:
| Role | Scope |
|---|---|
| Microsoft Sentinel Responder | Sentinel workspace |
| Cognitive Services User | Foundry resource |
| Microsoft Sentinel Playbook Operator | Sentinel workspace for analysts who will run Sentinel playbooks manually |
Sentinel-based playbooks deploy placeholder connector resources named placeholder-delete-*. Replace them with real Managed Identity connections before expecting the playbooks to run successfully.
- Open the Logic App in the Azure portal.
- Go to Logic app designer.
- For Microsoft Sentinel actions, create or rebind a Managed Identity connection for the Sentinel workspace.
- For Azure Monitor Logs actions, create or rebind a Managed Identity connection for the Log Analytics workspace.
- For the
HTTP - Call Foundryaction, verify the URI is the correct model endpoint and keep authentication set to Managed Identity. - Save the Logic App.
- Delete the
placeholder-delete-*connector resources after the workflow is fully wired to the new connections.
For Sentinel-triggered playbooks, test manually from real incidents or manually created demo incidents. In most cases, even closed incidents still work for functional testing.
To test manually, the analyst triggering the playbook needs Microsoft Sentinel Playbook Operator on the workspace. You can also attach the playbooks to automation rules for normal incident-driven execution.
- Templates deploy placeholder connection stubs following the Sentinel community playbook pattern. Connectors must be authorized post-deploy.
- Some workflows still need runtime hardening before production use.
- playbooks/README.md - playbook catalog and bulk deployment scripts
- workbooks/README.md - full workbook setup and deployment instructions
- functions/README.md - placeholder for future Function-based examples using the same Foundry endpoint pattern