Designing the first experience of BlueVoyant AI — from signed contract to a live, protected environment.

Every new security client was set up by hand. Microsoft permissions were chased over email, data was re-typed from Salesforce, and clients waited 4–6 weeks to see a single alert.

Interviewed existing clients with complex environments and the deployment team, designed a guided onboarding from Microsoft Graph authorization to a final review, worked with engineers on edge cases, and joined client launch calls in Europe and the USA.

The product shipped. Onboarding was designed to take contract-to-data-visibility from 4–6 weeks to under a day, and a PMO dashboard tracked the first 15 pilot clients by hand, then every client automatically.

4–6 week onboarding

Manual configuration across several internal teams stretched every go-live.

Permissions chased over email

Clients were unsure which Microsoft roles and consents they needed.

Clients waiting in the dark

No self-service and no visibility while setup happened behind the scenes.

A bottleneck for the PMO

Deployment and engineering teams were pulled into nearly every step.

Permission clarity

Clients needed the exact admin role named up front, and to know why each permission was required.

Change control is real

Many clients, especially in Europe, route access approvals through formal change boards and can't finish in one sitting.

Honest expectations

Finishing onboarding isn't the same as full go-live, and the experience had to say so.

No dead ends

When a permission check fails, people need to know exactly what to fix and who can fix it.

Microsoft Graph authorization

Sign in with the right Microsoft admin role, named clearly before the client starts.

App consent

Every permission listed with what it's used for, so a change board can approve it.

Platform deployment

Automated deployment with live progress, so the screen never looks frozen.

Response actions

Clients choose which actions the platform can take on their behalf.

Call chain

Who BlueVoyant contacts, and in what order, when something needs attention.

Review

One page to confirm everything before going live.

Bounded & honest

Upfront time estimate and step count, and clear about what onboarding does and doesn't include.

Never a dead end

Save and exit, skip for now, and send a step to a colleague. Errors name the next action.

Nothing hidden

Every permission and access request is named and explained.

First 15 clients, by hand

Tracked the first 15 pilot clients manually, so we could learn what the team actually needed to see.

Then every client, automatically

Automated tracking for the rest, so the PMO could manage exceptions instead of chasing status.

Research is the spec

Tracing decisions to what clients told us kept debates about evidence, not opinions.

Design the unhappy path first

Failure states in security onboarding are the normal path.

Honesty builds trust

Naming exactly what's accessed reduced friction more than reassuring copy could.