RSA Advisor for Admin Threats
The RSA Advisor for Admin Threats agent improves organizational security. Through comprehensive, enhanced monitoring, the agent alerts security teams to suspicious activity that could indicate a compromised administrator account or an insider threat.
RSA Advisor for Admin Threats automates log searches and correlates events using natural language prompts. Once configured, RSA Advisor for Admin Threats will integrate with Microsoft Sentinel’s Data Lake and enable advanced analytics, alerting, and AI-driven investigation capabilities.
This capability keeps organizations at the forefront of innovation and ahead of threats. In the 2026 RSA ID IQ Report, a survey of more than 2,100 global security leaders, agentic AI emerged as the top cybersecurity priority, and 91% said they plan to integrate AI into their tech stack.
- Analyzes admin activity within an RSA ID Plus tenant to detect anomalies
- Identifies potential admin account compromises or insider threats
- Surfaces suspicious events and recommendations actions to resolve issues
- Delivers findings to human auditors for review and follow-up
RSA Advisor for Admin Threats is available for free as part of RSA ID Plus for Microsoft, which provides an enhanced security layer for Microsoft Entra ID and extends support for SaaS, legacy, OT, and non Microsoft systems.
RSA ID Plus for Microsoft helps organizations:
- Prevent help desk fraud: Secure the credential lifecycle from attackers socially engineering the IT help desk to bypass multi-factor authentication (MFA)
- Build MFA resilience: Maintain secure access across cloud, hybrid, on-premises, and legacy environments during cloud outages
- Stop phishing: Deploy phishing-resistant authentication to offline and hybrid scenarios, and to extend passwordless beyond Microsoft environments
The RSA Advisor for Admin Threats agent is available on the Microsoft Security Storefront. To try RSA Advisor for Admin Threats, go to the Microsoft Security Storefront and click on the “Agents” tab. From there, search for ‘RSA Advisor for Admin Threats’ under “Browse all agents.”
