MailGuardian AI: Automated Email Security Workflow
Enterprise-grade low-code security automation powered by Azure Logic Apps & GPT-5.
💡 About This Lab
This is a lab project I've been playing with recently. The core concept is using auto-flow combined with AI intelligence to instantly detect, analyze, and classify email risks.
Build a fully automated Email Security Analysis workflow. When the test tenant inbox receives an email, the system intercepts it, passes it to AI for deep risk assessment, and sends a report to security personnel.
⚠️ Disclaimer: This lab is for learning and testing purposes only. Privacy and compliance reviews are required before production use.
⚖️ Architecture Options
Before development, I evaluated four Azure solutions based on "cost, scalability, and maintenance complexity" to find the optimal balance:
[Option 1]
Power Automate
+ Azure OpenAI
Lowest cost and easy to build, but lacks flexibility for enterprise-scale integration.
[Option 2]
Azure Functions
+ Azure OpenAI
Highly scalable, but requires more coding and ongoing code maintenance.
⭐ [Option 3]
Azure Logic Apps
+ Azure OpenAI
Provides an excellent balance between cost, low-code development, and enterprise integration. Perfect for cloud-native security automation workflows.
[Option 4]
Copilot Studio
+ RAG + Logic Apps
Supports advanced AI agents and enterprise knowledge integration. The ultimate goal for Security Copilot scenarios.
⚙️ Tech Stack & Architecture
This project combines Microsoft cloud services with modern serverless hosting:
🛡️ GPT-5 Threat Indicators
The system utilizes the GPT-5 model to detect the following potential security threats:
🚀 Key Features
⚡ Auto Trigger
Automatically initiates processing via Logic Apps upon receiving emails.
🛡️ AI Risk Review
Instantly filters, scans content, and identifies potential risks or anomalies.
🧩 High Maintainability
Modular design allowing easy expansion of protection rules.
🔄 System Flow
📌 Important Notes
- The API key is securely stored in the Azure OpenAI Connector connection.
- HTTP action can also be used to call Azure OpenAI REST API directly (Azure Key Vault can be integrated for secret management).
- Recommended to use test tenant mailboxes rather than personal Outlook.com to avoid risk controls and sending limits.
🔮 Future Improvements
- Teams notification integration.
- Excel or dashboard logging for AI analysis results.
- URL, domain, and IP reputation enrichment using threat intelligence APIs.