← Back to home INTEGRATED IT SUPPORT Try ARIA live
Sample Client Scenarios

How ARIA handles real L1, L2, and L3 problems

Three illustrative scenarios drawn from common Microsoft 365 environments. Each shows ARIA's reasoning trail, the framework it applied, the KB article it pulled, and the resolution path. Try the same scenarios live on the trial page — same engine, same response.

Illustrative samples — not specific real clients
AW

Built by Ahmad Wasee — 15+ years on the desk, before he built the AI

Founder · 15+ years enterprise IT · Hands-on L1 → L3 · Capital markets · Healthcare · Legal · Municipal

ITIL Foundations Six Sigma Yellow Belt Anthropic Academy · 5 certs PMP & Agile · 2023 M365 / Azure AD / Intune Hybrid identity · SharePoint

ARIA is built by a senior IT engineer with 15+ years on the desk — across trader-floor capital markets (RBC), Big-4 IT (IBM), regulated healthcare (PHIPA), and legal practice. It runs on a 70+ article internal KB built from real Microsoft 365, Azure AD, Intune, SharePoint, and hybrid-identity incidents I worked through across those environments. The reasoning trails below show the exact frameworks (ITIL, Six Sigma DMAIC, First Principles, 5 W's) I drilled into the engine — so ARIA catches the edge cases other AI tools miss because the builder has actually been on call at 3 AM when something broke.

WHAT ARIA IS BUILT FROM · ALL VERIFIABLE LIVE

We replace "trust us" with show me.

70+
KB articles
9
Frameworks
51
State codes
1,345
Test scenarios

These are real numbers from ARIA's running build. Open /aria to verify the KB article count yourself.

THE 9 FRAMEWORKS ARIA REASONS WITH

Not a chatbot wrapper. ARIA picks a named framework for every problem, then walks the structured path. You see the thinking, not just the answer.

5 W's
Who · What · When · Where · Why
STAR
Situation · Task · Action · Result
First Principles
Break problems to fundamentals
OKR
Objectives & key results
Eisenhower
Urgency vs. importance
DMAIC
Define · Measure · Analyze · Improve · Control
Kaizen
Continuous improvement, every day
TOC
Theory of Constraints — remove the bottleneck
AAR
After Action Review — no blame, only better
Level 1 · Tier-1 ticket Resolved in 6 min · standard queue avg 23 min

Locked-out user — MFA stuck on lost-device after phone replacement

What the user reports

User · marketing coordinator "I got a new phone and now Outlook keeps asking me to approve sign-in from my old Authenticator. I don't have that device anymore — what do I do?"

ARIA's reasoning trail

FRAMEWORK5 W's — narrows scope to identity vs. mail-client issue.
WHOSingle user · standard licensed M365 mailbox · not a shared/service account.
WHATMFA challenge cannot be completed — registered Authenticator device is gone.
WHENStarted after phone replacement (last 24 h).
WHYOld MFA registration still bound to lost device · admin reset required.
KB MATCHArticle AAD-MFA-08 · "Admin-initiated MFA reset → user re-registration via aka.ms/mfasetup".

ARIA's response

ARIA
Here's the cleanest path. Two steps — one for IT, one for you.
  1. IT side (you can request via helpdesk@): Admin opens Entra ID → Users → your account → Authentication methods → click Require re-register MFA. Takes 30 seconds.
  2. Your side: Sign out of Outlook fully. Re-open. When prompted, browse to https://aka.ms/mfasetup, install Microsoft Authenticator on your new phone, scan the QR code, approve once. Done.

Want me to draft the IT request for you? Reply yes and I'll send the message in your tone with the right detail.

Resolved · 6 min · user productive again, zero escalation Typical Tier-1 queue: 23 min · common L1 misroute to L2

Want to test this on ARIA right now? Open the trial and paste the user quote above — same engine, same KB, same response in seconds.

Try this scenario live →
Level 2 · Tier-2 admin task Resolved in 14 min · standard L2 avg 1h 12min

SharePoint inherited permissions broken — new hire missing on one departmental site only

What the admin reports

Admin · IT lead, mid-size firm "We added Lin (new hire) to the Operations security group two days ago. She sees every SharePoint site except 'Operations · Procurement.' That site uses the same group. Group membership is correct on our end. Where do I look?"

ARIA's reasoning trail

FRAMEWORKFirst Principles — what controls SP access at the site, library, and item level?
HYPOTHESIS AGroup sync lag (Azure AD → SharePoint) · ruled out: other sites show the group.
HYPOTHESIS BSite-level inheritance broken — admin once clicked "Stop Inheriting Permissions" on this site.
HYPOTHESIS CConditional Access / sensitivity label override · low likelihood — only one site affected.
KB MATCHArticle SP-PERM-11 · "Diagnose broken inheritance on a SharePoint site collection".

ARIA's response

ARIA · L2
High-confidence diagnosis: site inheritance was broken at some point. Here is the verification path and the fix.
  1. Verify: Open the "Operations · Procurement" site → ⚙ Site settings → Site permissions. If you see "This site has unique permissions" instead of "Same as parent" → confirmed.
  2. Choose your fix:
    (a) Add the group on this site only — fastest. Add the Operations security group with the same role (Member / Edit).
    (b) Restore inheritance — cleaner long term, but check that no per-site exceptions will break.
  3. Verify (1 min): Have Lin clear her SharePoint cache (Ctrl+F5 on the site) and confirm access.

I can also generate a PowerShell snippet to audit every site collection where inheritance is broken — want it?

Resolved · 14 min · root cause confirmed, audit script delivered Typical L2 routing: handoff to senior admin · 1h 12min average

This is a real failure mode I've fixed dozens of times on the desk. The audit script ARIA generates catches it across the whole tenant in one pass.

Try this scenario live →
Level 3 · P1 incident · hybrid identity Triaged in 47 min · typical P1 escalation 4h+

Hybrid identity sync conflict — half of cloud users lost group memberships overnight

What the on-call admin reports

On-call · regulated healthcare environment "Half our cloud users came in this morning with no group memberships. SharePoint sites are locked. Teams channels show empty rosters. On-prem AD looks fine. AAD Connect ran overnight. What changed?"

ARIA's reasoning trail

FRAMEWORKDMAIC — Define · Measure · Analyze · Improve · Control. P1 scope first, fix second.
DEFINESymptom: cloud group memberships dropped. Scope: only objects originally synced from on-prem AD.
MEASUREWhich AAD Connect sync run? Run history check via Get-ADSyncConnectorRunStatus. Look for partition-deletion-threshold-exceeded.
ANALYZEMost likely root: a botched merger / OU restructure on on-prem caused mass objectGUID change → soft-match collision → AAD Connect dropped memberships rather than corrupting.
KB MATCHArticle AAD-HYB-07 · "Soft-match collision after AD OU restructure — recovery via targeted re-sync".

ARIA's response

ARIA · L3 P1
Treat as a sync-rules incident, not a data loss. Containment first, then recovery.
  1. Containment (do this now): Stop-ADSyncSyncCycle on the AAD Connect server. Prevents further damage until we know what's writing.
  2. Diagnose: Run Get-ADSyncConnectorRunStatus and check the last 24h run history. Look for any run flagged partition-deletion-threshold-exceeded — that's the smoking gun for accidental mass deletion.
  3. Identify scope: In AAD Connect's Synchronization Service Manager → MA → search connector space for objects in pending-export-delete state. That's your impacted user list.
  4. Recover memberships: If on-prem AD is healthy (it is), re-enable sync and force a full import. Memberships re-flow from source-of-truth.
  5. Root cause (for the postmortem): Check on-prem OU activity 24h before the symptom. A bulk OU move or import of staged users from an acquired domain commonly triggers this.

I can generate a full incident-response runbook for this in your incident format — Aperture-ready, with timestamps. Want it?

Triaged · 47 min · containment + recovery path defined Typical P1 hybrid-identity escalation: 4h+ to senior consultant · $$$

This is the exact scenario from our Aperture command-center demo (L3, Hard). The same reasoning fires in the live trial.

Try this scenario live →

Want to test ARIA on your own scenario right now?

Open the trial, paste a real ticket or describe a workflow problem you'd want triaged. 15 free minutes — no card, no commitment. Same engine, same KB, same reasoning trail as the samples above.

Try ARIA live → Ask about a pilot program