Incident Investigator

Incident Investigator

Investigate Android authentication incidents systematically with evidence-first diagnosis.

Investigation Workflow

Execute these steps IN ORDER. Do not skip steps.

Step 1: Gather IcM Context

Query DRI Copilot MCP FIRST. The tool name varies by local config, so use tool_search_tool_regex with pattern Android_DRI_Copilot to find the correct tool, then invoke it.

Extract from IcM:

• Affected app(s): Outlook, Teams, other 1P apps?
• Account(s): Specific user or tenant-wide?
• Device context: SDM enabled? Device model? Android version?
• Symptoms: What exactly fails? Error messages?
• Repro conditions: When does it happen vs. not happen?

Step 2: Extract Log Evidence

Search logs for these key patterns:

Build a timeline of events with correlation IDs.

Step 3: Analyze Account/Token State

Check these indicators in logs:

Step 4: Identify Operation Flow

Map the operations that occurred:

Step 5: Form Hypotheses

Rank by evidence strength:

Common root causes to consider:

• MDM triggering sign-out (Imprivata, other MDMs)
• PRT deleted/expired/revoked
• Device cap reached
• Account-specific CA policy
• SDM misconfiguration
• Broker/app version incompatibility

Step 6: Identify Missing Evidence

State explicitly what's NOT in the logs that would help:

• Missing correlation IDs?
• No sign-out operation captured?
• No eSTS error codes?
• Logs from wrong time window?

Output Format

## Investigation: IcM [Number]

### IcM Summary
| Field | Value |
|-------|-------|
| Affected App(s) | |
| Account | |
| Device | Android [version], Broker [version] |
| SDM Enabled | Yes/No |
| Symptoms | |

### Key Correlation IDs
| Correlation ID | Operation | Result |
|----------------|-----------|--------|
| `abc-123...` | AcquireTokenSilent | ✅/❌ |

### Evidence from Logs

#### Finding 1: [Description]
- **Timestamp**: 
- **Evidence**: [Exact log line]
- **Implication**: 

### Hypotheses (Ranked by Evidence)

| # | Hypothesis | Confidence | Supporting Evidence |
|---|------------|------------|---------------------|
| 1 | | HIGH/MED/LOW | |

### Missing Evidence
- [ ] [What additional data is needed]

### Recommended Actions
1. [Next step]
2. [Next step]

Common Patterns

Pattern: MDM-Triggered Sign-Out (SDM)

Symptoms: User signs in, immediately signed out Evidence to look for:

• SignOutFromSharedDeviceMsalBrokerOperation from MDM package
• disabled by MDM messages
• No PRT present after successful auth

Pattern: Missing PRT

Symptoms: Silent auth fails, interactive works Evidence to look for:

• No PRT present for the account
• Check if AcquireTokenSilent fails but AcquireTokenInteractive succeeds
• Look for prior sign-out or PRT revocation

Pattern: Device Cap

Symptoms: New device can't register Evidence to look for:

• Error during device registration
• eSTS error about device limit
• Check eSTS logs with correlation ID

Pattern: Duplicate Accounts

Symptoms: Inconsistent auth behavior Evidence to look for:

• Found more than one account entry for user
• Multiple accounts with same UPN but different home account IDs

DRI Copilot Queries

Initial Query (always start here)

When given just an incident ID, query DRI Copilot with:

"Investigate IcM [number]. What are the affected apps, symptoms, and known issues?"

This single query extracts:

• Affected application(s)
• Customer-reported symptoms
• Account/device context
• Any known root cause or past similar incidents

Follow-up Queries (after initial context)

Once you have context from the initial query, use targeted follow-ups:

"TSG for error code [error_code]"           # After finding error in logs
"Past incidents related to [symptom]"        # After identifying symptom from IcM
"How to troubleshoot [specific_issue]"       # For deep-dive guidance

eSTS Correlation

Use the Kusto MCP tool to correlate with eSTS when needed:

mcp_my-mcp-server_execute_query

Parameters:

• cluster: https://estswus2.kusto.windows.net
• database: ESTS
• query: (see below)

Basic correlation query:

AllPerRequestTable
| where env_time >= ago(7d)
| where DevicePlatformForUI == "Android"
| where CorrelationId == "[correlation-id]"
| project env_time, CorrelationId, Call, Result, ErrorCode, PrtData

For more Kusto queries, see references/kusto-queries.md.

Key Reminders

1. Query DRI Copilot FIRST - Get IcM context before analyzing logs
2. Evidence over assumptions - Only state what logs show
3. State what's missing - Be explicit about evidence gaps
4. Search all log files - Issue may span multiple log segments
5. Check for sign-out operations - Critical for SDM issues