M365Clarity Blog · 14 July 2026 · AI Features Remediation Microsoft 365

Microsoft 365 AI Setup Guides and Conversational Remediation

Most security tools tell you what's wrong. None of them help you fix it.

You get a red tile, a score, a category. Maybe a link to Microsoft's documentation. Then you're on your own — navigating between the Entra admin centre, the Defender portal, Exchange Online, and a Microsoft Learn article that covers six different versions of a feature that has been renamed twice.

M365Clarity takes a different approach. When a feature is red or amber, the dashboard doesn't just flag it — it walks you through fixing it, step by step, specific to your tenant.

AI Explain: understanding why before you fix

Before taking action on any finding, the AI Explain feature gives you the context you need. Click "Why this?" on any feature in the dashboard and M365Clarity generates a plain-English explanation covering three things:

What the feature actually does
Not a textbook definition — a practical explanation of what this control does in your organisation's context, what it protects, and what it doesn't.
Why it is flagged amber or red
The specific reason this feature is showing as a gap — using your actual configuration data, not generic messaging. "Your tenant has 23 users registered for SMS authentication only" rather than "MFA may not be fully configured."
What the business risk is
The consequence of leaving this gap unaddressed — in business terms, not technical ones. Who is exposed, to what kind of attack, and what a breach involving this gap would typically look like.

The explanation is generated fresh for each feature on each scan, using the actual raw data from the Microsoft Graph API call that produced the finding. It's not a template — it's written from your tenant's data.

AI Setup Guides: step-by-step remediation from your data

Click "How to fix" on any red or amber finding and M365Clarity generates a setup guide. This is not a link to a Microsoft doc. It's a structured, sequenced set of steps built around your tenant.

Here's what a guide for enabling Conditional Access looks like:

1
Open the Conditional Access policies blade
Microsoft Entra admin centre → Protection → Conditional Access → Policies. You currently have 0 CA policies enabled — all steps will be creating new policies.
2
Create a Require MFA for all users policy
New policy → Name: "Require MFA — All Users". Users: All users. Cloud apps: All cloud apps. Grant: Require multifactor authentication. Set to Report-only first to verify no disruption before enabling.
3
Exclude your emergency access accounts
Before enabling, exclude your break-glass accounts from the policy. Under Users → Exclude → select your emergency access accounts. This prevents accidental lockout.

Each step includes the exact admin centre path. Where PowerShell is the most reliable approach, the guide provides the command. Where a verification step is needed to confirm the change took effect, it's included.

The guide is specific to your tenant's current configuration. If you already have some CA policies but are missing specific coverage, the guide builds from what you have — it doesn't assume you're starting from scratch.

Conversational Remediation: when you get stuck mid-fix

Setup guides cover the expected path. They can't cover every error, every variation, every environment-specific issue you might encounter on Step 3 of 6.

Conversational Remediation is built for that moment. Every step in every setup guide now has a "🤔 Stuck on this step?" button. Click it, type what's going wrong, and get a response scoped entirely to that specific step.

💬 "Error on Connecting with Connect-SPOService — it says the module isn't recognised"
The SharePoint Online Management Shell isn't installed on this machine. Run this first in an elevated PowerShell session:

Install-Module -Name Microsoft.Online.SharePoint.PowerShell

Then accept the prompt and retry Connect-SPOService with your tenant admin URL.
💬 "The policy saved but it's not showing as enforced in the Conditional Access blade"
This is expected if you saved it in Report-only mode. To enable enforcement, open the policy → State → switch from Report-only to On → Save. Allow 5–10 minutes for the change to propagate before testing sign-in.

The responses are deliberately narrow. The assistant can only answer questions about the specific step you're on. It cannot give general Microsoft 365 advice, discuss other features, or go off-topic. If you ask something outside the scope of that step, it redirects you back.

This is intentional. Broad AI assistants give broad answers. A remediation assistant that drifts off topic is more likely to give you advice that breaks something else. The constraint is a feature, not a limitation.

From finding to fixed — without leaving the dashboard

The three features work together as a remediation workflow:

1 → AI Explain
Understand what the feature does, why it's flagged, and what the business risk is. Make an informed decision about whether and when to fix it.
2 → Setup Guide
Generate a step-by-step guide built from your tenant's actual configuration. Follow the exact admin centre path with the specific settings relevant to your environment.
3 → Conversational Remediation
Hit a problem on Step 3? Ask the assistant. Get a response scoped to exactly that step — not a generic answer that might not apply to your situation.

An IT administrator who has never configured Conditional Access before can work through the entire process — context, steps, stuck moment resolved — without leaving M365Clarity, without searching Microsoft's documentation, and without opening a support ticket.

Available on Pro and Multi-Tenant plans. AI Explain is available on all plans including Free. Setup Guides and Conversational Remediation require a Pro or MSP subscription. Rate limited to 10 guide-chat calls per hour per user.

Try it on your first finding

Connect your tenant, run a scan, and click any amber or red finding to see the explain and guide features in action.

Try M365Clarity Free →