How to Build an Incident Triage Workflow Across Multiple Microsoft 365 Tenants When managing multiple Microsoft 365 tenants, security alerts can quickly pile up and overwhelm IT teams. A structured incident triage workflow helps you detect, prioritize, and respond to incidents faster while reducing alert fatigue. In this video, we’ll show you how to build a scalable triage framework across multiple tenants. Before we begin, be sure to subscribe to NinjaOne’s IT video hub and our YouTube channel for more tech content like this. Creating an Incident Triage Workflow An effective incident triage workflow helps strengthen security and contain breaches. To create one, we recommend taking the following steps: Start by standardizing incident handling across all tenants. Every alert should follow the same lifecycle. Here’s a sample triage guide you can follow: Define severity levels—such as low, medium, or high—and decide what actions each level requires. Then create a shared CSV or JSON template to log incident details, affected users or devices, response actions, and resolution status. This ensures consistent handling and reporting across tenants. Next, collect alerts centrally using Microsoft Graph. Open PowerShell as an administrator and connect to Microsoft Graph with security permissions using the script: Additionally, you can filter by severity and product using the script Run these queries on a schedule for each tenant and export the results to a CSV or JSON file. This gives you a centralized view of active incidents across your environment. When an incident affects a specific endpoint or user, tagging helps track its status locally. You can create Registry values on the affected device that record incident details, such as the alert type or investigation status. To do so, run a script similar to the one shown on screen. Keep in mind that the name and value of the registry keys will depend on the incident that you’re trying to record, so update them based on your use case. Once created, these tags allow your RMM to identify systems under investigation, quarantined devices, or resolved incidents at a glance. With the triage data in place, you can now automate your response. PowerShell and Microsoft Graph can disable compromised accounts, invalidate user sessions, force password resets, or mark devices as quarantined. For higher-risk incidents, you can also use conditional access policies or firewall rules to isolate affected systems until remediation is complete. For more information, check out our official blog post on How to Build an Incident Triage Workflow Across Multiple Microsoft 365 Tenants linked in the description below.