Signing in
- Email and password. Use the credentials your administrator created for you.
- Single sign-on. Choose Sign in with Microsoft (Microsoft Entra ID) or Sign in with Google (Google Workspace), if your administrator enabled it. The first time you sign in with SSO, an account is created for you with the Viewer role, and an administrator can then change your role.
- Sessions last up to 8 hours. You are signed out automatically if an administrator removes your account or changes your password, email or role.
- Forgot your password? Ask your Axia administrator to set a new one under Users.
Roles
| Role | Can do |
|---|---|
| Viewer | View the command centre and cases (read-only). |
| Analyst | Everything a Viewer can, plus working cases: assign, change status, close and reopen, open tickets, approve analyses, review actions. |
| Admin | Everything an Analyst can, plus Connect, Users, Act, Enforce, Insights and Settings. Admins manage users in their own organization. |
Monitor
Command
The Risk Command Center is the landing page. It shows total DLP alarms, how many were alerted, false alerts, Axia cases, and a summary by severity. Use the time selector to change the period.
Cases
The Investigation Workbench lists all cases.
- Search: by keyword, or describe what you're looking for and let AI search find it.
- Filter: by severity, status, department, entity, escalation, assignee and type.
- Bulk actions: select several cases to assign or close them together.
Open a case to see:
- what happened and why Axia flagged it;
- the analysis and the source messages;
- the timeline and engagement thread;
- recommendations, and the available actions.
Cases have a severity (Critical, High, Medium, Low or Not sensitive) and a status (Open, In Progress or Closed).
Closing a case requires a reason:
- real risk, handled;
- real risk, accepted by the business;
- not a risk;
- duplicate;
- not enough information.
You can reopen a closed case by giving a reason.
Insights
For administrators: overall posture, risk control score, mean time to resolve, alerts vs. true cases, top case types, departments and severity trends.
Respond
Working a case
- Assign it to yourself or a colleague.
- Approve or decline Axia's analysis, or its proposal to close the case.
- Create a Jira or Azure DevOps ticket and refresh its status.
- Review and approve drafted actions and communications.
- Where your administrator allowed it, release a held email or revoke a share link.
- Download the original message or file for your investigation.
Intel
Ask the conversational AI advisor questions in plain language, on its own or in the context of a case. You can attach a document for it to review, and rename or delete conversations.
Act (administrators)
Choose which response actions Axia may take or propose:
- Content actions: hold a message, quarantine an attachment, remove a message, revoke a share link, release an email.
- Engagement actions: send an email, coach the person, tell the manager, escalate to Legal or HR.
Content actions start disabled until you enable them.
Enforce (administrators)
Write your data-handling policies in plain language, one sentence each. Axia takes them into account in its analysis.
Setup (administrators)
Connect
Open Connect and choose a tool from the Available tab. Follow the guided setup, then check it appears as Healthy on the Connected tab. Currently available:
- Microsoft 365: sign in once, then choose Outlook, Teams and/or Purview DLP.
- Google Workspace: Gmail.
- Jira and Azure DevOps: ticketing, with field mapping.
- Claude Code and Cursor: AI coding agents.
More connectors are listed as Coming soon.
Users
- Add a user: enter name, email and role. Set a password, or choose Single sign-on only.
- Manage users: edit details or role, change a password, or remove a user.
Remove leavers promptly.
Settings
- Guidance documents: organizational guidance Axia uses in its analysis.
- Employee directory: organization relations, such as managers and departments.
- Automation: engagement automation settings.