Projects and architectures

Sector, size, stack, result.

Projects from Microsoft 365 security work and from govnex’s own agent operations. No customer names, no logos, no tenant details. Click a project to jump to the details.

Security Copilot Phishing Agent
Financial sector · Security Copilot

Phishing triage as an agent

Eight phases, 30+ read-only KQL tools, evidence-based verdict.

Details →
My AI team
govnex · own operations

My AI team

One human, one chief of staff, 15 specialist agents.

Details →
How a new agent is born
govnex · method

How a new agent is born

Idea, readiness, build, rules, operations.

Details →
Copilot Readiness Check
govnex · PowerShell · Graph

Copilot & Agent Readiness

41 checks, one report, read-only, free.

Details →
govnex · Copilot agent

Customer radar

Microsoft changes assessed per customer.

Details →
Partner project · approx. 1,000 employees

Copilot rollout packages

Four modules, orderable individually.

Details →
Retail · several sites

From third-party antivirus to Defender

Onboarding in waves, ASR, handover.

Details →
Finance and real estate

Purview rollout as a package

Labels, auto-labeling, DLP, evidence.

Details →
Utilities

Information protection across all workloads

Four labels, DLP, cloud app monitoring.

Details →
Financial sector

Zero Trust access model

Conditional Access, session controls, ISO 27001.

Details →
Public sector · approx. 40,000 endpoints

Endpoint architecture at scale

Intune, Autopilot, Defender, Zero Trust.

Details →
Manufacturing

Endpoint and data protection in office and plant

Defender, ASR, DLP, XDR dashboards.

Details →
AI agents and Security Copilot

Agents that are in operation.

Security Copilot Phishing Agent: reported e-mail, SOC analyst, Security Copilot and threat intelligence feed the phishing investigation agent with eight phases; 30+ read-only KQL tools on Advanced Hunting; deterministic verdict from harmless to compromise; data plane Defender for Office 365, Defender for Endpoint, Entra ID
Financial sector · Security Copilot · Defender XDR · Phishing triage as a Security Copilot agent. The security team received reported e-mails every day that an analyst checked by hand. The agent reads mail metadata, sender history, user and device context through KQL tools on Advanced Hunting, applies fixed decision rules with priorities and delivers a verdict in a fixed output format: classification, reasoning, recommendation and the “Not checked” section. Regression cases with expected outputs protect every change; SCU cost per case is measured. Result: repeatable triage with traceable reasoning; the analyst only decides the cases the agent marks as unclear.
Org chart My AI team: Rashad Bakirov decides, reviews and approves; a chief of staff plans and distributes; agents for customer work, brand and business, night shift; how a task runs from customer meeting to approval; rules: mail read-only, nothing deleted, production only with approval, every action logged
govnex · My AI team. One human, one chief of staff, 15 specialist agents. Agents work, the human decides; every action is logged. The same pattern, a chief of staff with memory plus specialist agents with fixed rules, is what govnex recommends to mid-sized companies for their own agent operations. (Graphic in German.)
Flow: idea, readiness, build with Copilot Studio or Foundry, rules and approval, operations
govnex · How a new agent is born. Idea → readiness → build (Copilot Studio, Power Platform, Microsoft Foundry) → rules and approval → operations and review. Readiness comes before the build, the rules before go-live. The path every agent at govnex takes. (Graphic in German.)
govnex · PowerShell 7 · Microsoft Graph · read-only

Copilot & Agent Readiness: 41 checks, one report

A script an admin runs locally: 41 read-only checks in six areas (oversharing and access, protect data, agents, identity for AI, Defender and shadow AI, audit and evidence), delegated Graph sign-in without its own app registration, an HTML report with evidence per finding and a SHA-256 checksum. Every number in the report comes from the tenant.

Result: the tool behind the readiness service, free to run yourself. See the tool → Try it free · GitHub →
govnex · Copilot agent · Microsoft Message Center

Customer radar: Microsoft changes assessed per customer

Microsoft announces changes to Microsoft 365, Copilot, Purview and Defender every week. The agent reads the announcements from official sources, assesses them against a customer’s profile (licences, services in use, open projects) and writes a short weekly brief: what affects you, what to do, by when. Own tools and official Microsoft sources only.

Result: one weekly brief per customer instead of reading the Message Center; today part of Governance Operations.
Partner project · software company, approx. 1,000 employees · Microsoft 365 E5 + Copilot

Copilot rollout packages for a partner

A partner needed a proposal for its end customer that describes Copilot not as a licence but as a rollout. Result: four modules, orderable individually. Readiness & oversharing, data protection (labels, DLP for Copilot, DSPM for AI, rollout in waves), governance & operations (audit, retention, eDiscovery, agent rules) and agents in three sizes (SharePoint agent, Copilot Studio with Power Automate, Foundry with external systems). Plus adoption and a quarterly managed service.

Result: a package catalogue from which the partner assembles fixed-price proposals; the template for govnex’s services.
Microsoft 365 security

Projects the agent work stands on.

Retail · several sites · Defender for Endpoint · Intune

Migration from third-party antivirus to Defender

A retailer with several sites replaced its existing antivirus. Device onboarding in waves through Intune, replacement in passive mode, then switch-over, Attack Surface Reduction first in audit, then in block mode, compliance-based access to Microsoft 365, handover to operations with a runbook.

Result: one protection product instead of two, one portal for alerts, no more third-party licence costs.
Finance and real estate · Microsoft Purview · E5

Purview rollout as a repeatable package

Label taxonomy with four levels, auto-labeling for financial and personal data, DLP for Exchange, SharePoint, Teams and OneDrive with test and enforcement phases, foundations for Insider Risk, audit and evidence for internal audit. Documented as a package with fixed work steps so it can be transferred to further entities.

Result: classified existing data, DLP in operation, template for the next entity.
Utilities · Microsoft Purview · Defender for Cloud Apps

Information protection across all workloads

Label taxonomy (Public, Internal, Confidential, Highly confidential), auto-label policies, DLP in everyday workflows, Defender for Cloud Apps to monitor sharing and app activity, continuous compliance reporting.

Result: GDPR-aligned classification with evidence, without slowing down collaboration.
Financial sector · Entra Conditional Access · Defender for Cloud Apps

Zero Trust access model for Exchange, SharePoint and Teams

Risk-based Conditional Access policies, session controls through Defender for Cloud Apps, Identity Protection with MFA and sign-in risk, mapping of controls to ISO 27001 and regulatory expectations.

Result: a traceable access model and measurably better security posture.
Public sector · approx. 40,000 endpoints · Intune · Defender for Endpoint

Endpoint architecture and rollout at scale

Intune MDM with Autopilot for Windows devices, Entra join, staged enrolment, role-based compliance and configuration baselines, Defender for Endpoint policies, operations runbook, admin training, alignment with Zero Trust.

Result: a standard for tens of thousands of devices, run by the in-house team.
Manufacturing · Defender for Endpoint · Purview DLP

Endpoint and data protection in office and plant

Defender for Endpoint and Intune for office and production devices, replacement of the old antivirus, ASR rules, compliance-based access, Purview DLP for sensitive data, XDR dashboards for the operators.

Result: uniform endpoint protection across two very different device worlds.

Similar starting point?

The AI readiness check shows where you stand in three minutes. The intro call settles the rest.

Start the AI readiness check Contact