Agent 365mapped for defenders

2.1 What the licence unlocks

The service description splits capabilities between ordinary Microsoft 365 plans and Microsoft 365 E7 or the Agent 365 add-on. A tenant without the add-on can already see its registry and take basic actions.

Agent 365 is included in Microsoft 365 E7 and sold as a per-user add-on. The licensing FAQ sets what you must already own before you can buy it.

The pricing page lists the add-on at 13 euro and E7 at 91.92 euro, per user per month, annual commitment, Dutch-localised pricing page; check your own region and agreement. An admin-led trial of 25 seats for 30 days is available from the admin centre banner.

Two Learn pages list Entra ID P1 or P2 beside Agent 365 as a prerequisite. That is not a second purchase: every plan that qualifies you to buy Agent 365 already carries Entra ID P1 at least. E5, A5 and Defender Suite include P2; E3, EMS E3, Business Premium, F1 and F3 include P1 (Entra licensing). So:

• Covered by your base plan. Conditional Access for agents needs Microsoft 365 E7, or an Agent 365 licence paired with at least Entra ID P1 or Microsoft 365 E3, and your base plan already includes P1. Microsoft says enforcement of the Agent 365 requirement is coming.
• Covered by your base plan. Entra ID Governance for agents is the same: Microsoft 365 E7, or Agent 365 on any qualifying base plan. The agent features (access packages for agents, sponsor tasks in lifecycle workflows) sit in the Agent 365 column of the governance licensing table; the rest of ID Governance still needs its own licence or the Entra Suite.
• The one extra. Learn's Conditional Access page says network controls for agents need Microsoft Entra Internet Access, standalone or in the Entra Suite, which E7 includes. The FAQ narrows that: Agent 365 on E3 or P1 covers the network controls for cloud agents such as Copilot Studio, while controls for local agents on devices need the Entra Suite or standalone Internet Access.
• Free for everyone. Entra Agent ID is available to all Entra customers. Extending Entra security to those identities needs Agent 365.

2.2 The 1 July 2026 transition

Agent security for Copilot Studio and Foundry is licensed differently since 1 July 2026. From that date, discovery, posture, detection and real-time protection for those platforms require Agent 365 and are no longer covered by Defender for Cloud Apps or Defender for Cloud. The AIAgentsInfo hunting table is replaced by AgentsInfo. Legacy real-time protection rules set to Block stopped enforcing on that date and must be redefined under Settings, Security for AI, Policies and rules. Third-party cloud agents previously found through Defender for Cloud connectors now arrive through Connected platforms. Update saved hunting queries and redefine blocking rules first.

2.3 Roles you will need

Agent management roles are Entra roles. Only two can act.

The enforcing products add their own roles.

No one person will hold all of these in a well-run tenant, so staff the evaluation accordingly.

4.1 Start from what you need to stop

Most questions arrive as a scenario. This table starts from the scenario and lands on the control, the product that enforces it, and its status today. The GA only switch in the header hides the rows you cannot deploy yet.

Every row lands in a product you already run and a role you already staff. What Agent 365 adds is that the product can see the agent at all. If your scenario is missing, it still belongs to one of the five products above; the table at the top of this chapter says which.

5.1 The registry and the overview page

The registry is the inventory. Open Agents, All agents, Registry in the admin centre. Agents fall into four types: Microsoft agents, external partner-built agents, agents published by your organisation, and agents shared by their creator. Summary cards show total agents, agents without owners, and unmanaged agents, meaning agents created outside Agent 365 without its risk protection or observability.

123

Filters cover status, publisher type, channel, platform and data source. Use the data source filter first: it isolates agents with embedded knowledge, meaning maker-uploaded files, and agents on fine-tuned models. Both carry data handling implications the rest of the inventory does not.

Export to CSV gives more than thirty attributes per agent, including owner, platform, version and instructions. Export on day one of an evaluation to get a baseline to diff against. A custom agent can be uploaded as a zip through the same wizard described in 6.1. Microsoft Graph access is : the package management APIs list all agents and return per-agent detail under the AI Administrator role.

The overview page at Agents, Overview shows a thirty-day snapshot: total agents, active users, agent run-time in hours, and which connected external platforms have been scanned. Four action cards link to prefiltered views: pending requests, agents without owners, agents at risk, and agents with exceptions. Activity metrics start only when licences are activated, so the first month is partial. The overview shows the top five platforms only. Draft agents are visible only for Copilot Studio.

5.2 The agent map

The agent map at Agents, All agents, Map is and needs Global Administrator or AI Administrator plus an E7 or Agent 365 licence. It clusters agents by the platform that built them: Agent Builder, Copilot Studio and its legacy version, the Microsoft 365 Agents Toolkit, SharePoint, Azure AI Foundry, Amazon Bedrock, Google Vertex AI, Microsoft first-party, external partners, and Others. Usage filters such as active users, sessions, exception rate and security alerts are limited to tenants below a threshold of four thousand.

How Microsoft Agent 365 works

03:23 How it works04:48 The control plane07:31 Zero in on risks08:18 Agent map

Microsoft Mechanics on YouTube. Press play, or pick a chapter.

Single Agent Map is . It draws one agent with its top fifty users and top fifty tools over seven or thirty days, weights lines by volume, and highlights any tool with an exception rate above one percent. It works only for agents that emit observability data: Microsoft-built agents, Copilot Studio agents, and SDK-integrated agents. The map is a planning view for a large estate; for one agent's blast radius, the Single Agent Map is the one to open.

5.3 Risk aggregation

The Risks column and the Agents at risk tile need an E7 or Agent 365 licence. They aggregate risk signals from Entra, Purview and Defender into one count per agent, covering high, medium and low severity. Selecting the count opens the Risk details pane, grouped by severity, and a Review link opens the originating portal. A zero means no active signals across the connected platforms, and the admin centre count can lag the source portals by up to an hour.

AI mode for the registry is . Microsoft's What's new post of 30 September 2026 describes a natural-language search that finds agents without owners, inactive agents and agents that warrant review. No Learn page documents it yet, so the badge says early preview until one does.

5.4 Connecting external platforms

Two routes bring outside agents in. The Connected platforms page gives inventory; the SDK adds identity, tool access and notifications to agents you run yourself. Microsoft announced Connected platforms as Registry sync in April 2026, and several Learn pages still link to it under that name. Connected platforms, under Agents, All agents, brings agents from Amazon Bedrock, Google Vertex AI, Salesforce Agentforce, Databricks Genie, Anthropic Claude Managed Agents, Oracle Generative AI Agents and Snowflake Cortex into the same inventory. The Anthropic connection is because its API is in beta. Each platform's setup page, linked above, lists the credentials and permissions to grant, and the scope varies. Amazon Bedrock and Oracle need only read access, with delete rights optional for admins who will delete agents from Agent 365. Google Vertex AI lists the delete permission among those it requires, and Salesforce Agentforce uses an external client app with API scopes. A delete in Agent 365 reaches the source platform, so check what each connection can delete before you save it. Sync is manual today.

Every platform syncs agents into the registry, but observability of what they do differs. The Connected platforms page lists it for Amazon Bedrock, Google Vertex AI and Anthropic, with the other four coming soon. Third-party agent observability is , and its own page also lists Salesforce Agentforce.

For agents built outside Microsoft platforms that need more than inventory, the Agent 365 SDK adds three capabilities to an agent you already run: an Entra-backed identity, governed access to Work IQ MCP tools, and notifications. It does not build, host or orchestrate. Observability comes from the separate Microsoft OpenTelemetry Distro, not the SDK; the SDK's own observability packages are deprecated. Packages exist for Python, JavaScript and .NET with extensions for LangChain, Semantic Kernel, the OpenAI Agents SDK, the Microsoft Agent Framework and the Claude Agent SDK. Notifications, and agents needing their own user account, are Frontier only.

Copilot Studio, Foundry and Agent Builder agents integrate automatically and send observability data by default once a licence or trial is active.

One more route is announced but not yet documented. Microsoft's What's new post of 30 September 2026 says agents, tools, models and MCP servers onboarded to Azure API Management will appear in Agent 365 without manual registration, with Agent 365 governing access and API Management applying authentication, routing and runtime controls, rolling out from the same day. The integration is until a Learn page describes it.

5.5 Shadow AI and local agents on endpoints

Take the agent inventory from Defender for Endpoint, which sees the widest set of tools, and use the admin centre pages for the governance actions they offer. Blocking from the admin centre reaches only OpenClaw and its Node.js family and the Visual Studio Code extensions.

The Shadow AI page at Agents, Shadow AI is . It lists consumer AI applications and standalone agents found on managed Windows devices. Prerequisites: Frontier opt-in, Defender for Endpoint, Microsoft 365 E5, Intune enrolment, and optionally Global Secure Access for traffic metadata. The tools each surface lists are in the table below. Blocking is available only for OpenClaw. It creates an Intune policy named A365 - Block OpenClaw that reaches all enrolled Windows devices in fifteen minutes to eight hours and can be edited in Intune.

The Local agents page at All agents, Local agents (Frontier) is also and deliberately separate. Shadow AI covers unmanaged autonomous applications; local agents are developer tools chosen on purpose. Viewing needs Microsoft 365 E3 and Intune enrolment. Blocking covers only Gemini CLI, the Visual Studio Code extensions, and OpenClaw's Node.js siblings QClaw and Claw/Nanobot, which share a single Intune policy per run type; every other tool in the list is detection-only. Both pages show first access, last activity, device and user counts, and with Global Secure Access, endpoints, requests and bytes per agent, plus a per-device list with Defender last-seen timestamps.

Beneath it, Defender for Endpoint local agent discovery, , covers Windows and macOS and, of the four surfaces, the widest set of tools. An agent is one user, one device, one agent type, so a developer running Claude Code in fifteen folders is one entry. Discovery captures local and remote MCP server configurations, feeds an exposure map from agent to device to identity to reachable resources, and populates advanced hunting.

Which surface sees which tool, and which can block it

The four surfaces above list different tools, and only some of them can block. This table joins the Shadow AI page, the Local agents page, Defender for Endpoint discovery and runtime protection as their Learn pages list them. Global Secure Access is not a column because it attributes traffic to any agent on a device with its client rather than recognising named tools.

For every other tool, stopping it means runtime protection where it is supported or an Intune policy of your own.

5.6 What observability data is, and where it lives

Observability data records what happened during an agent action: invocations, tool calls, inference, timing, status, errors, and any inputs and outputs the platform or developer chose to include. Collection starts only when a trial or licence is active and the terms are accepted. Data is stored in the tenant's default geography, honours the EU Data Boundary, and is deleted after thirty days. Advanced Data Residency is not supported. Agent 365 is not yet a Core Online Service under the Product Terms, though it runs on services that are. If your framework needs that status, record the gap.

6.1 Onboarding through one IT-controlled flow

Publishing asks four questions: who can install, who gets it preinstalled, which policy template applies, and which permissions to consent to. An agent published from Copilot Studio, Foundry or the Agents Toolkit lands in Agents, All agents, Requests as pending review, pending update or pending activate. The flyout shows its description, owner, knowledge sources, tools, custom actions and requested permissions before you decide.

Availability and installation are independent, so one group can discover an agent while another has it preinstalled. Only AI Administrators and Global Administrators can complete the wizard. Pending update covers new versions; users keep the old one until you approve. Pending activate is for templates a user wants an instance of, described in 6.8.

6.2 Policy templates

A policy template bundles predefined policies from Entra, Purview, SharePoint Online and Defender and applies them at onboarding. Every tenant has default policies for all agents, some enabled automatically and some needing configuration in the source product.

The defaults are easier to understand grouped by the product that enforces them:

• Purview: audit, DSPM detection of sensitive information in AI interactions, and the Compliance Manager AI assessment.
• Entra: Identity Protection, lifecycle management for agent identities, and network visibility for Copilot Studio agents through Global Secure Access.
• SharePoint: agent access insights, restricted external sharing, access control for SharePoint and OneDrive, and content permission insights. Three of these policies need a Microsoft 365 Copilot licence and still require the admin to create the report or apply the setting in the SharePoint admin centre.
• Defender: real-time protection, investigation and advanced hunting.

Custom templates add Entra policies of your choice. Every policy must already exist in Entra, and custom templates need an Agent 365 licence.

12

6.3 Lifecycle actions and management rules

Block and delete do not mean the same thing on every platform. The Actions flyout offers install and uninstall, block and unblock, delete, owner changes and, for Foundry agents, start and stop.

If an action fails on a Copilot Studio agent, check whether its Power Platform environment runs the IP firewall in active enforcement mode. Admin centre actions arrive from a Microsoft service IP and are rejected; audit-only mode allows them. The workaround is the Power Platform API.

Management rules under Agents, Settings apply actions in bulk after a review step. Five exist: install Microsoft first-party agents for all users; reassign ownerless Agent Builder agents to the previous owner's manager; block ownerless agents with no usage; apply a policy template to the agents a rule's conditions select; reject publish requests older than a set number of days. Each run shows the affected agents before applying. The template rule runs once rather than on a schedule, and it reaches only registry agents with an identity. Blueprints and AI teammates are outside it. Microsoft's What's new post of 30 September 2026 calls custom rules a public preview and lists ownership, tags, Entra Agent ID, publisher, risk signals and usage as conditions. The Learn page does not list those conditions yet.

6.4 Tenant settings

The same page controls agent and plugin access (Microsoft, your organisation, external publishers), sharing scope for Agent Builder agents, user access (all, none, or specific groups), developer feedback, and up to fifty tags. User access is the blunt instrument: specific groups means only those groups can use any agent. Agent and plugin access is the finer one, and it covers plugins too: tools, MCP servers, connectors and skills. Disabling external publishers hides third-party agents and plugins from the Agent store; Microsoft-built ones stay visible when disabled but cannot be installed. Data processed by non-Microsoft agents and plugins is not covered by your Microsoft agreements, so review the publisher's terms before allowing that category.

6.5 Tools and MCP servers

Agents, Tools, Registry lists every tool and MCP server, with block and unblock. A blocked server cannot be invoked from any client. First-party examples are Dataverse, Windows 365 for Agents, MCP management, and admin tools. The page also shows which agents use which Power Platform connector, with a link to govern the connector itself.

Bring your own MCP server is . A developer registers a remote server through the Agent 365 CLI with URL, authentication type (none, API key in header or query, external OAuth, or Entra OAuth) and declared tools. It appears under Tools, Requests; an AI or Global Administrator reviews the tools, approves, and consents to the Entra permissions the server needs. Approved servers route through the tooling gateway, which is what produces telemetry. Supported clients are Copilot Studio, Visual Studio Code, Claude Code and GitHub Copilot CLI; Foundry and declarative agents are not. Republishing a new version and deleting a registered server are both unsupported. Invocations appear in the CloudAppEvents table under the ExecuteToolByGateway action.

The page carries a legal notice: a third-party server may receive authentication keys and prompt content outside your compliance boundary, and Microsoft takes no responsibility. Treat the registry as an allow-list.

6.6 Identity governance in Entra

Every agent identity can have a sponsor, a human accountable for its lifecycle and access. Copilot Studio records the creator as sponsor. Sponsors manage their agents from the My Account portal and request access packages for them from My Access.

Access packages grant what the blueprint does not: security group membership, application permissions including Graph application permissions, and Entra roles. In the assignment policy, under Who can get access, choose users, service principals and agent identities in your directory, then All agents. Requests come from the agent itself, from its sponsor, or by direct admin assignment. Assignments expire. The sponsor is notified, can request an extension that may trigger fresh approval, or lets it lapse and the agent loses access. Standing access becomes the exception.

PreviousNext

Lifecycle workflows handle sponsor departures with three mover and leaver tasks: email the manager, email co-sponsors, and transfer sponsorships to the manager. Configure them under ID Governance, Lifecycle workflows.

6.7 Compliance in Purview

Purview treats an agent instance as a user. On creation it is enabled for audit, sensitive data detection, and the AI regulation assessments in Compliance Manager. Everything else works by adding the instance, or a group containing it, to a policy.

Audit covers agent-to-human, human-to-agent, agent-to-tool and agent-to-agent interactions, with dedicated Agent 365 activities in the unified audit log and the AI activities tab of activity explorer. Data lifecycle management applies retention and deletion in Teams, SharePoint, OneDrive and email. Communication Compliance detects non-compliant content in agent conversations across Teams and email with built-in classifiers. eDiscovery finds interactions in the associated mailbox; treat the instance as a custodian and filter on Copilot activity. Compliance Manager provides AI regulation templates.

Start on the DSPM AI observability page in the new Purview portal. Classic DSPM for AI does not support Agent 365. The page lists every agent active in the last thirty days, ranked by the Insider Risk Management risk level, with risky activities grouped as oversharing, exfiltration and unethical behaviour, and per-agent recommendations. It is the one view that ranks every agent by risk, so it tells you which instance to add to a policy first.

Agent 365: controls for data security and compliance in Purview

01:13 IT and data security teams using Agent 36503:14 End user perspective04:05 DLP on agent-initiated messages04:23 Communication Compliance06:39 Purview Audit

Microsoft Mechanics on YouTube. Press play, or pick a chapter.

6.8 Agents with their own identity

Agents with their own identity are and need a 25-seat Frontier subscription enabled by a Global Administrator who has accepted the Agent 365 terms. Approved templates appear in the Copilot and Teams stores under Agents for your team. A user requests an instance; an administrator or AI administrator activates the template and assigns licences and policies; the user creates the instance with name, alias, icon and an allowed domain. Activation and instance creation are separate, so a Global Administrator or AI Administrator can also create the instance on behalf of a manager from the agent's details in the registry; the wizard checks that a licence is free before it provisions anything. The agent gets its own identity, licence, mailbox, OneDrive and Teams presence, appears in the org chart under its creator or the manager it was created for, and can be blocked or deleted from Teams or from the Instances tab in the registry. Deletion keeps resources for thirty days; audit logs are retained.

7.1 Identity

The four objects in Entra Agent ID

Entra Agent ID introduces four objects.

The blueprint is what the agent is; the identity is who is acting. Policies at blueprint level cover every identity created from it, which is how controls scale across hundreds of instances.

Managed identities are the preferred blueprint credential, certificates are acceptable, and client secrets should not be used in production. Blueprints and their children cannot start interactive authorisation flows, so delegated permissions must be preauthorised as inheritable permissions on the blueprint.

How tokens flow

In the on-behalf-of exchange, Entra never gives the agent the user's original token. The blueprint proves its own identity, the child identity carries both contexts into the exchange, and Entra issues a resource token only after validating the chain. Conditional Access evaluates at that final issuance. The stepper below carries the six-step mechanics; a refresh-token variant supports background work.

An autonomous agent skips the user token: the blueprint obtains an exchange token, the identity trades it for a resource token, and the subject is the agent identity. Agent users add one further exchange so the final subject is the user account.

Where Conditional Access is evaluated

Conditional Access evaluates whenever Entra issues or refreshes a token to a target resource. That is the enforcement boundary. Policy is not evaluated when a blueprint acquires a Graph token to create an identity or agent user, because blueprints can do nothing else. Nor is it evaluated on the intermediate exchange at the token exchange endpoint, whose tokens cannot call Graph, or anywhere if security defaults are enabled. And it cannot help when an agent reaches a resource with an API key, because that path never touches Entra.

The target depends on the access pattern. In on-behalf-of flows the user is the subject, so policies target users and groups, and the agent inherits the user's posture; a risky user handing a task to an agent faces multifactor authentication first. In app-only flows the agent identity is the subject, so policies target identities, blueprints or custom security attributes. Where an agent user is the subject, policies target agent users. Targeting a blueprint covers its identities but not their agent users. Policies targeting all users exclude agent users. Agent users cannot be scoped by group.

Policies to build first

Microsoft's recommended policies for autonomous agents form an evaluation sequence.

1. Block all agent identities from all resources, excluding reviewed identities or blueprints through the enhanced object picker. Report-only first.
2. Replace the manual exclusion with custom security attributes: an approval status on agents and a department on resources, so only agents approved for a department reach that department's resources. New agents inherit the policy once tagged.
3. Block high-risk agents with the Agent risk condition, , set to High. Microsoft publishes a template.
4. For agent user accounts, block on medium and high risk. Where agents run on Windows 365 Cloud PCs for Agents, require a compliant device and network using the Agent execution environments condition, , so cloud-native agents without a device are excluded rather than blocked.

Run every policy in report-only first. Agent traffic patterns will surprise you.

123

Identity Protection for agents

ID Protection baselines each agent's sign-in behaviour and flags anomalies. Learning mode suppresses behavioural alerts for agents without history, with a parallel detection for malicious early-life activity. All eight detections are offline.

In on-behalf-of flows risk is attributed to the user, so remediation lands on the compromised session without disrupting the agent for others. The Risky agents report supports confirm compromise, confirm safe, dismiss and disable; detections are kept ninety days and export through diagnostic settings. Licence enforcement for this feature is coming.

Platform specifics

Copilot Studio has created an Entra Agent ID for every new agent since May 2026 under a tenant blueprint named Microsoft Copilot Studio agent identity blueprint; opting out is no longer possible. Older agents keep app registrations until migrated, manually or by Microsoft. On publish, the agent's connectors become API permissions on its identity, so a specific connector can be targeted with Conditional Access. Foundry provisions a default blueprint and identity per project and a dedicated pair on publish. The Agent 365 CLI creates blueprints and instances explicitly for any framework.

123

7.2 Data

Label first, then gate access on risk rather than identity alone: fix oversharing before an agent finds it, and block at the moment of interaction.

Purview data security extends to agent instances with behaviours that catch people out.

• Sensitivity labels are honoured, but an instance reads only files explicitly shared with it, and an encrypting label must grant it VIEW and EXTRACT by name. A label granting all users in the organisation is not enough. Content an agent creates does not inherit labels.
• DLP covers agent-to-human and human-to-agent interactions in Teams, SharePoint, OneDrive and email, by naming the instance or its group. The agent is unaware of a block, so its owner must monitor the policy.
• Insider Risk Management accepts instances as subjects and ships a Risky AI usage template detecting prompt injection and access to protected material; insights flow to Defender XDR.
• Endpoint DLP can warn or block users pasting sensitive data into third-party AI sites in a browser on onboarded Windows devices.
• Encryption without a sensitivity label is the one capability listed as unsupported.

12

7.3 Threats

Enabling Defender for agents

Onboarding to Agent 365 enables Security for AI automatically. Confirm at Settings, Security for AI, Get started, where two steps remain. Connect the Microsoft 365 connector with Entra ID management events and Microsoft 365 activities selected; without it, Copilot Studio real-time protection still blocks but its alerts do not reach the portal. For Copilot Studio real-time protection, toggle it on, hand the generated URL to a Power Platform administrator, and paste the resulting App ID back. Security Administrator is required.

Inventory and posture

Assets, AI agents lists agents from Copilot Studio, Foundry, Microsoft 365, supported non-Microsoft platforms and endpoints, each with risk level, indicators, recommendation count and active alerts. Posture risk is . Indicators include weak instructions, high usage, indirect prompt injection exposure, privileged business-system access and active threat; local agents add critical device, critical user, vulnerable device and privileged development access. Risk level and recommendations are computed separately, so a high-risk agent may have none and a low-risk agent may have one. AgentsInfo stores snapshots; use arg_max(Timestamp, *) by AgentId for current state.

123

Real-time protection

Real-time protection blocks risky actions before execution. What is inspected depends on the agent type.

A default rule audits all agents and records matches as behaviours. Custom rules block. Create them under Settings, Security for AI, Policies and rules, Real-time protection, scoped to agents that hold an Entra Agent ID, with detection types secret exfiltration, malicious content propagation, evasion techniques and unsafe email domain. Events land in BehaviorInfo with agent, user and tool, which is where custom detections and automation are built. A blocking rule replaces near-real-time alerts for the agents it covers. Prompt evidence collection, on by default, includes redacted suspicious snippets in alerts; disable it under Settings, Security for AI if data handling rules require.

Detection, investigation and hunting

Near-real-time detection is . Defender analyses observability data for jailbreak, indirect prompt injection, malicious content propagation, secret leakage, evasion, LLM reconnaissance and suspicious user or IP access, and correlates alerts into incidents with blast radius. Foundry detection covers published agents only. Six hunting tables cover agents: AlertInfo and AlertEvidence, CloudAppEvents for observability data, AgentsInfo for inventory, and BehaviorInfo and BehaviorEntities for protection events.

Agent 365: security operations in Defender

01:48 Unified IT and SOC agent view02:54 Real-time blocking and jailbreak detection04:08 Auto-revoke via Entra Conditional Access05:28 Advanced hunting for AI agents06:43 Block risky agents

Microsoft Mechanics on YouTube. Press play, or pick a chapter.

7.4 Local agents on the endpoint

A local agent runs with the user's identity, tokens, sessions and files, outside every onboarding flow above. Three layers apply, and they are not equally mature.

Discovery is in 5.5, .

A replay of the workshop demos, wording as shown on screen. The real screenshots follow.

Runtime protection in Defender for Endpoint is . It inspects the user prompt, the tool request before execution, and the tool response after, for prompt injection and high-risk actions. Agent-native event inspection uses vendor hooks and supports Claude Code, Codex CLI, GitHub Copilot CLI and the GitHub Copilot app. Network inspection covers agents without hooks, except those using certificate pinning or HTTP/3. Each runs Disabled, Audit or Block. Prerequisites: Defender for Endpoint Plan 2, Microsoft 365 E5, and Agent 365 or E7. Devices must be onboarded, run Defender Antivirus with signature 1.451.224.0 or later, and take platform and engine updates from the Beta Channel while the feature is in public preview. Enable per device:

Set-MpPreference -AiAgentProtection Audit
Set-MpPreference -AiAgentNetworkInspection Audit

Intune has a native policy for agent-native event inspection: an endpoint security Antivirus profile named Microsoft Defender AI agent runtime protection. The same profile can be created in the Microsoft Defender portal, which also reaches devices under Defender for Endpoint security settings management. Network inspection has no native policy, so deploy the same commands as a PowerShell platform script in system context. Microsoft's recommended rollout: Audit on a small group for one to two weeks, review, widen, then Block per device group, from either console. In Block mode the user sees the block in the terminal and as a toast, protection history records it, and a Suspicious AI prompt injection alert reaches the SOC with process context; in Audit mode the alert is informational. Tamper protection covers the setting.

12

12

12

Containment at the operating system is the least mature layer. Intune blocks unsanctioned agents through the admin centre, OpenClaw from the Shadow AI page and the Node.js family and Visual Studio Code extensions from the Local agents page, and can require device compliance for agent Conditional Access. The service description also lists a policy-controlled runtime through Windows 365 for Agents, Intune-managed Cloud PCs that agents check out and in. Isolated execution containers with per-agent file and network permissions appear only in the Windows platform blog as Microsoft Execution Containers, on Insider builds. Treat them as roadmap.

7.5 Network controls on agent traffic

Global Secure Access for Copilot Studio agents is enabled per environment in the Power Platform admin centre. HTTP node traffic, custom connectors and the MCP server connector then route through Global Secure Access and meet the baseline profile: web content filtering, threat intelligence filtering and network file filtering. Local agents on devices with the Global Secure Access client are covered by the Internet Access profile.

12

Prompt injection protection applies Prompt Shields inline to eleven supported models plus custom JSON endpoints, without code changes. It needs Entra Internet Access, TLS inspection, and a prompt policy linked to a security profile applied by Conditional Access. Text only, up to 64,000 characters, JSON applications only.

The MCP firewall is . It inspects MCP over streamable HTTP and server-sent events to remote servers and can block all MCP, allow or deny servers by URL, allow or block tools, resources and prompt templates per server, and block outdated versions or unencrypted transport. Discover usage first through Generative AI Insights, which suggests servers seen recently. Local servers, stdio transport and JSON-RPC batches are not inspected.

Generative AI Insights events, including prompt bodies and MCP payloads, stream to Sentinel through the NetworkAccessGenerativeAIInsights diagnostic category.

Of the three, the MCP firewall is the one to pilot first: it is the only control here that can name a single tool.

Zero Trust security for AI agents

03:40 Conditional Access for agent identities04:59 Agent ID and access packages06:07 Runtime observability06:58 DLP, labels and data access governance07:47 MCP catalogue

Microsoft Mechanics on YouTube. Press play, or pick a chapter.

8.1 Three workstreams

Each workstream closes on evidence (a workshop is not evidence).

8.2 The named workshop rhythm across twelve weeks

This template names workshops in weeks 1, 2 and 4 to 10, with a weekly sync throughout. It assigns no standalone activity to weeks 3, 11 or 12.

8.3 Responsibilities

The customer owns every final decision. Microsoft or a partner may lead delivery; neither owns acceptance.

Governance actions need an AI Administrator in the room. Investigation needs Security Reader at minimum. Those are usually different people.