How St. Luke’s and ManpowerGroup Turn Security into an AI Enabler

What changed

Enterprises are racing to embed generative AI into everyday workflows, but most security programs were assembled for legacy workloads. The gap shows up as fragmented toolsets, blind spots in real‑time visibility, and manual processes that cannot keep pace with AI‑generated alerts. Microsoft’s recent customer spotlights – St. Luke’s University Health Network and ManpowerGroup – demonstrate how a unified, cloud‑native security platform can close that gap and make security a strategic growth lever rather than a bottleneck.

Provider comparison

Aspect	St. Luke’s approach	ManpowerGroup approach
Core stack	Microsoft Defender + Microsoft Sentinel, layered with Microsoft Security Copilot for AI‑driven analysis.	Microsoft 365 E5 (Defender suite) + Microsoft Sentinel for SIEM/SOAR, all managed through a single tenant.
Visibility	AI‑generated, cross‑domain view of endpoints, identity, email and cloud workloads.	Consolidated identity and endpoint telemetry across 180+ countries, presented in Sentinel workbooks.
Automation	Security Copilot agents (Security Triage Agent, Phishing Triage Agent) automate alert triage and remediation, saving ~200 analyst hours per month.	Sentinel playbooks automate policy enforcement, user risk remediation and compliance reporting, reducing integration cycles from weeks to hours.
Governance	Integrated with Microsoft Purview for data classification, DLP and policy enforcement at the point of AI content creation.	Unified labeling and DLP policies applied across Microsoft 365 apps, with continuous drift detection via Azure Policy.
Pricing model	Consumption‑based licensing for Defender, Sentinel pay‑as‑you‑go, and per‑user Security Copilot seats.	Per‑user Microsoft 365 E5 subscription bundles Defender, Purview and Sentinel capacity, simplifying budgeting.
Migration considerations	Requires mapping existing SIEM alerts to Sentinel data connectors; pilot Security Copilot on a subset of high‑volume alerts before full rollout.	Consolidate disparate on‑prem tools into Azure AD‑joined devices, then enable Microsoft 365 E5; use Azure Migrate for legacy workloads.

Why the differences matter

• Integration depth – St. Luke’s built a tight loop between Defender, Sentinel and Security Copilot, allowing AI to surface in the analyst’s console. ManpowerGroup opted for the broader Microsoft 365 E5 bundle, which delivers a pre‑integrated set of controls and reduces the need for custom connectors.
• Automation focus – The health‑care use case emphasizes triage agents that cut down on repetitive investigation steps, while the staffing firm leans on Sentinel playbooks to enforce global compliance policies at scale.
• Cost predictability – A bundled E5 license gives ManpowerGroup a clearer per‑user cost, whereas St. Luke’s pays for each Defender/Sentinel data volume plus Copilot seats, which can be tuned as AI usage grows.

Business impact

St. Luke’s University Health Network

• Unified visibility eliminated siloed dashboards, cutting mean time to detect (MTTD) from 45 minutes to under 10 minutes.
• Security Copilot agents automated routine triage, freeing roughly 200 analyst hours each month for strategic threat hunting.
• Advanced phishing triage reduced false‑positive alerts by 68 %, improving confidence in automated responses.
• The AI‑enhanced SOC now supports rapid rollout of new AI‑driven clinical tools, knowing the underlying security posture can adapt in real time.

ManpowerGroup

• Consolidating on Microsoft 365 E5 reduced the number of security tools from 12 to 3, slashing operational overhead.
• Integration timelines for new regional offices dropped from weeks to days, enabling faster market entry.
• Global compliance reporting (GDPR, CCPA, ISO 27001) became a single‑click export from Sentinel, cutting audit preparation effort by 55 %.
• The unified platform provides a consistent identity‑centric defense for a workforce of over 800 k employees, many of whom now use AI assistants in daily tasks.

A repeatable playbook for AI‑ready security

1. Lead with business risk – Define the data, workloads and user groups that must be protected before selecting technology.
2. Unify signals – Connect cloud, identity, data and endpoint telemetry into a single SIEM/SOAR pane (e.g., Sentinel).
3. Operationalize governance – Deploy classification, labeling and DLP policies that auto‑apply to AI‑generated content.
4. Continuously harden posture – Use Azure Policy and Microsoft Defender for Cloud to detect drift and remediate misconfigurations.
5. Automate at scale – Leverage Security Copilot agents or Sentinel playbooks to handle repetitive tasks, ensuring protection grows with AI adoption.

Organizations that follow these steps can treat security as a foundational platform rather than a bolt‑on. The result is faster AI deployment, lower risk exposure, and a competitive edge built on trust.

---

Explore the full customer videos and case studies on the Microsoft Security Blog to see these solutions in action.

---

Further reading

• Microsoft Security Copilot overview
• Microsoft Defender documentation
• Microsoft Sentinel playbooks
• Microsoft Purview data governance