How a K-12 School Turned Its Existing Microsoft 365 Licenses Into an AI-Powered Security Operation in 10 Weeks

The K-12 school in North Texas already held Microsoft 365 A5 licensing, which includes endpoint and email protection, identity protection and data loss prevention. It engaged Def-Logix, a San Antonio-based, veteran-owned cybersecurity firm with more than 15 years of experience securing systems for agencies such as the Department of Defense and Department of Homeland Security, to get full value from those tools. The project was funded through the federal Cybersecurity E-Rate Program.

Results & Impact

• Automated weekly reporting: an AI-written security summary reaches administrators every Monday, readable in under two minutes
• Recurring incidents identified: a rolling 30-day view shows which users keep triggering incidents, the school’s top requested outcome
• Targeted training: each user with recurring incidents is matched to specific training with one-click links, replacing blanket assignments
• Student data protection: Microsoft Purview DLP monitors PII across email, OneDrive and SharePoint
• Unified security data: the school’s Microsoft security signals now feed a single SIEM
• Compliance documented: a NIST controls mapping was delivered to the school
• Expanded operations: authentication monitoring, help desk ticket automation and real-time alerting for critical incidents

The Challenge

The school’s security tools were capable, but their data arrived as raw tables that someone had to interpret by hand. Alert data didn’t show which threats mattered or which users kept causing incidents. Without that view, the only training option was assigning the same courses to all staff. The school’s IT resources couldn’t review alerts manually every week, and leadership didn’t want another platform for its IT partners to maintain.

The Solution

Def-Logix built the automation directly inside the school’s Microsoft environment. It runs in the Azure portal the IT team already uses and authenticates through the school’s existing identity controls. Microsoft Sentinel brings the school’s security signals into one place. Each week, an automated workflow pulls the priority incidents, analyzes them with Azure OpenAI, and emails a plain-English summary to administrators. The system flags users involved in multiple incidents over 30 days and matches each violation type to the school’s existing training library, such as phishing awareness for risky clicks.

The solution had a one-time setup cost for the school of $29,325, and costs just $11,050 a year to maintain, saving tens of thousands of dollars every year compared to the cost of hiring a full-time security analyst.

“The school already owned powerful security tools. Our job was to put AI to work inside them, so the school's team gets clear, actionable intelligence every week without adding another platform to manage.” – Paul Rivera, CEO, Def-Logix