# Image sources

Every screenshot on the page, where it came from, and where it is used. Generated 4 September 2026. Update this file and `manifest.json` together when a screenshot is replaced.

| Id | Used in | Feature and view | Source | Crop |
| --- | --- | --- | --- | --- |
| `deck-s045` | #s7-3 | Defender agent posture: Agent page: risk level, blast radius, attack surface graph, recommendations | Deck `FSI NL Agent 365 event 02.09.pptx`, slide 45 (`ppt/media/image192.png`) | none, downscaled to 1600px |
| `deck-s046` | #s7-3 | Defender incidents: Incidents and alerts tab for an agent | Deck `FSI NL Agent 365 event 02.09.pptx`, slide 46 (`ppt/media/image193.png`) | none, downscaled to 1600px |
| `deck-s047` | #s7-3 | Defender incident graph: Attack story with incident graph across agent, user and URL | Deck `FSI NL Agent 365 event 02.09.pptx`, slide 47 (`ppt/media/image194.png`) | none, downscaled to 1600px |
| `deck-s048` | #s7-3 | Defender advanced hunting: AgentsInfo query for MCP tools with maker credentials | Deck `FSI NL Agent 365 event 02.09.pptx`, slide 48 (`ppt/media/image195.png`) | none, downscaled to 1600px |
| `deck-s049` | #s7-3 | Defender real-time protection: Policies and rules: default audit rule and custom block rule | Deck `FSI NL Agent 365 event 02.09.pptx`, slide 49 (`ppt/media/image196.png`) | none, downscaled to 1600px |
| `deck-s055` | #s5-5 | Shadow AI page: Shadow AI (Frontier) list in Microsoft 365 admin center | Deck `FSI NL Agent 365 event 02.09.pptx`, slide 55 (`ppt/media/image203.png`) | none, downscaled to 1600px |
| `learn-mde-discovery` | #s5-5 | Defender AI Assets (preview), Local agents tab: inventory and the ChatGPT Desktop detail pane with MCP servers | Learn, Local AI agent discovery, `discovery-overview.png`, CC BY 4.0 | none, downscaled to 1600px |
| `deck-s057` | #s5-5 | Defender exposure map: Local agent exposure map to cloud resources | Deck `FSI NL Agent 365 event 02.09.pptx`, slide 57 (`ppt/media/image205.png`) | none, downscaled to 1600px |
| `learn-mde-block-toast` | #s7-4 | Claude Code: Read blocked by Defender, tool result blocked, Windows Security toast | Learn, Set up AI agent runtime protection, `ai-runtime-agent-block-and-toast.png`, CC BY 4.0 | none, downscaled to 1600px |
| `deck-s060` | #s7-4 | Purview runtime DLP block: Claude Code read blocked by Purview DLP with dialogue | Deck `FSI NL Agent 365 event 02.09.pptx`, slide 60 (`ppt/media/image208.png`) | x370 y110 1299×868: remove desktop wallpaper; keep PowerShell, Claude Code and DLP dialogue |
| `learn-mde-pi-alert` | #s7-4 | Suspicious AI prompt injection alert with process tree, detection name and MITRE technique | Learn, Set up AI agent runtime protection, `runtime-protection-suspicious-prompt-injection-alert.png`, CC BY 4.0 | none, downscaled to 1600px |
| `deck-s062` | #s7-4 | Defender hunting local agents: Exposure graph query: local agents reaching sensitive assets | Deck `FSI NL Agent 365 event 02.09.pptx`, slide 62 (`ppt/media/image210.png`) | none, downscaled to 1600px |
| `deck-s063` | #s7-4 | Intune agent execution policy: Create policy: agent execution in container, filesystem and network | Deck `FSI NL Agent 365 event 02.09.pptx`, slide 63 (`ppt/media/image211.png`) | x195 y40 705×726: keep the policy form only |
| `deck-s077` | #s6-7 | Communication Compliance: Unethical behaviour in AI agents policy with matched sources | Deck `FSI NL Agent 365 event 02.09.pptx`, slide 77 (`ppt/media/image218.png`) | none, downscaled to 1600px |
| `deck-s078` | #s6-7 | Data lifecycle management: Retention policy for AI agents data | Deck `FSI NL Agent 365 event 02.09.pptx`, slide 78 (`ppt/media/image219.png`) | none, downscaled to 1600px |
| `deck-s079` | #s6-7 | eDiscovery: Review set with agent interaction and custodian metadata | Deck `FSI NL Agent 365 event 02.09.pptx`, slide 79 (`ppt/media/image220.png`) | none, downscaled to 1600px |
| `deck-s080` | #s6-7 | Audit: Audit search results with ConnectedAIAppInteraction | Deck `FSI NL Agent 365 event 02.09.pptx`, slide 80 (`ppt/media/image221.png`) | none, downscaled to 1600px |
| `deck-s085` | #s6-7 | DSPM AI observability: Agent registry view with risk levels and policy coverage | Deck `FSI NL Agent 365 event 02.09.pptx`, slide 85 (`ppt/media/image231.png`) | none, downscaled to 1600px |
| `deck-s088` | #s7-2 | DSPM agent risk profile: Agent overview with risk level and Insider Risk alerts | Deck `FSI NL Agent 365 event 02.09.pptx`, slide 88 (`ppt/media/image232.png`) | none, downscaled to 1600px |
| `deck-s090` | #s7-2 | Insider Risk Management alert: Agent exfiltration attempt sequence and scatter plot | Deck `FSI NL Agent 365 event 02.09.pptx`, slide 90 (`ppt/media/image234.png`) | none, downscaled to 1600px |
| `deck-s091` | #s7-2 | DLP rule match: Activity explorer detail: blocked message and files | Deck `FSI NL Agent 365 event 02.09.pptx`, slide 91 (`ppt/media/image235.png`) | none, downscaled to 1600px |
| `deck-s116` | #s6-6 | Access package basics: New access package for agent permissions | Deck `FSI NL Agent 365 event 02.09.pptx`, slide 116 (`ppt/media/image281.png`) | none, downscaled to 1600px |
| `deck-s117` | #s6-6 | Access package resource roles: Request API permissions for the package | Deck `FSI NL Agent 365 event 02.09.pptx`, slide 117 (`ppt/media/image282.png`) | none, downscaled to 1600px |
| `deck-s118` | #s6-6 | Access package requests: Who can get access: all agents (preview) | Deck `FSI NL Agent 365 event 02.09.pptx`, slide 118 (`ppt/media/image283.png`) | none, downscaled to 1600px |
| `deck-s119` | #s6-6 | Access package lifecycle: Assignment expiry in days | Deck `FSI NL Agent 365 event 02.09.pptx`, slide 119 (`ppt/media/image284.png`) | none, downscaled to 1600px |
| `deck-s120` | #s6-2 | Policy template custom policies: Policy template with Conditional Access, access package, custom attribute | Deck `FSI NL Agent 365 event 02.09.pptx`, slide 120 (`ppt/media/image285.png`) | none, downscaled to 1600px |
| `deck-s123` | #s7-1 | Agent identity in Entra: Agent identity overview with sponsor, blueprint, permissions | Deck `FSI NL Agent 365 event 02.09.pptx`, slide 123 (`ppt/media/image302.png`) | none, downscaled to 1600px |
| `deck-s124` | #s7-1 | Conditional Access agent risk: Policy with Agent risk (Preview) condition and block | Deck `FSI NL Agent 365 event 02.09.pptx`, slide 124 (`ppt/media/image303.png`) | none, downscaled to 1600px |
| `deck-s125` | #s7-1 | Risky agent details: ID Protection risky agent with confirm compromised | Deck `FSI NL Agent 365 event 02.09.pptx`, slide 125 (`ppt/media/image304.png`) | none, downscaled to 1600px |
| `deck-s134` | #s7-5 | GSA web filtering rule: Session type Agent, HTTP methods, destinations | Deck `FSI NL Agent 365 event 02.09.pptx`, slide 134 (`ppt/media/image351.png`) | none, downscaled to 1600px |
| `learn-mac-registry` | #s5-1 | Agent registry in Microsoft 365 admin center: Agent registry in Microsoft 365 admin center | [Learn](https://learn.microsoft.com/en-us/microsoft-365/admin/manage/agent-registry) image `agent-registry.png`, CC BY 4.0 | none, downscaled to 1600px |
| `learn-mac-overview` | #s5-1 | Agent overview in Microsoft 365 admin center: Agent overview in Microsoft 365 admin center | [Learn](https://learn.microsoft.com/en-us/microsoft-365/admin/manage/agent-365-overview) image `agent-overview.png`, CC BY 4.0 | none, downscaled to 1600px |
| `learn-mac-map` | #s5-2 | Use Agent Map: Use Agent Map | [Learn](https://learn.microsoft.com/en-us/microsoft-365/admin/manage/agent-map) image `agent-map.png`, CC BY 4.0 | none, downscaled to 1600px |
| `learn-mac-risks-card` | #s5-3 | Agent registry: agents at risk: Agent registry: agents at risk | [Learn](https://learn.microsoft.com/en-us/microsoft-365/admin/manage/agent-registry) image `risks-card.png`, CC BY 4.0 | none, downscaled to 1600px |
| `learn-mac-requests` | #s6-1 | Agent requests: Agent requests | [Learn](https://learn.microsoft.com/en-us/microsoft-365/admin/manage/agent-requests) image `agent-requests.png`, CC BY 4.0 | none, downscaled to 1600px |
| `learn-mac-upload-template` | #s6-1 | Upload custom agent: apply security template: Upload custom agent: apply security template | [Learn](https://learn.microsoft.com/en-us/microsoft-365/admin/manage/agent-registry) image `agent-upload-02.png`, CC BY 4.0 | none, downscaled to 1600px |
| `learn-mac-settings` | #s6-3 | Agent settings: Agent settings | [Learn](https://learn.microsoft.com/en-us/microsoft-365/admin/manage/agent-settings) image `agent-settings.png`, CC BY 4.0 | none, downscaled to 1600px |
| `learn-mac-tools-registry` | #s6-5 | Manage tools for agents: Manage tools for agents | [Learn](https://learn.microsoft.com/en-us/microsoft-365/admin/manage/manage-tools-for-agent) image `agent-tools-registry.png`, CC BY 4.0 | none, downscaled to 1600px |
| `learn-a365-registry-sync` | #s5-4 | Connected platforms: Connected platforms | [Learn](https://learn.microsoft.com/en-us/microsoft-agent-365/admin/connected-platforms) image `platform-registry-sync.png`, CC BY 4.0 | none, downscaled to 1600px |
| `learn-a365-sdk-integration` | #s5-4 | Agent 365 SDK overview: Agent 365 SDK overview | [Learn](https://learn.microsoft.com/en-us/microsoft-agent-365/developer/agent-365-sdk) image `integration-model.png`, CC BY 4.0 | none, downscaled to 1600px |
| `learn-mde-block-toast` | #s7-4 | Set up AI agent runtime protection: Set up AI agent runtime protection | [Learn](https://learn.microsoft.com/en-us/defender-endpoint/configure-ai-agent-runtime-protection) image `ai-runtime-agent-block-and-toast.png`, CC BY 4.0 | none, downscaled to 1600px |
| `learn-xdr-setup` | #s7-3 | Enable security for AI agents: Enable security for AI agents | [Learn](https://learn.microsoft.com/en-us/defender-xdr/security-for-ai/get-started-defender-security-for-ai) image `security-for-ai-setup-checklist.png`, CC BY 4.0 | none, downscaled to 1600px |
| `learn-xdr-detection-types` | #s7-3 | Real-time protection: detection types: Real-time protection: detection types | [Learn](https://learn.microsoft.com/en-us/defender-xdr/security-for-ai/ai-agent-real-time-protection) image `create-rule-detection-types.png`, CC BY 4.0 | none, downscaled to 1600px |
| `learn-gsa-prompt-shield` | #s7-5 | Prompt injection protection architecture: Prompt injection protection architecture | [Learn](https://learn.microsoft.com/en-us/entra/global-secure-access/how-to-ai-prompt-injection-protection) image `prompt-shield-architecture.png`, CC BY 4.0 | none, downscaled to 1600px |
| `learn-gsa-mcp-tools` | #s7-5 | MCP firewall: discovered tools: MCP firewall: discovered tools | [Learn](https://learn.microsoft.com/en-us/entra/global-secure-access/how-to-configure-mcp-firewall) image `mcp-discovered-tools.png`, CC BY 4.0 | none, downscaled to 1600px |
| `learn-entra-risky-agents` | #s7-1 | ID Protection for agents: risky agents report: ID Protection for agents: risky agents report | [Learn](https://learn.microsoft.com/en-us/entra/id-protection/concept-risky-agents) image `risky-agents-report.png`, CC BY 4.0 | none, downscaled to 1600px |

## How to replace a screenshot

1. Find the row by feature. The `keywords` in `manifest.json` help match a new blog or deck image to the right slot.
2. Crop or downscale the new image to at most 1600 px wide and save it under the same file name, or a new name.
3. Update the `<img src>` and the figure caption's source line in `index.html`, then this table and `manifest.json`.
4. Deck screenshots show demo-tenant data approved for publication; check any new capture carries the same approval.

## Link preview card

`og.png` (1200×630) is the Open Graph and Twitter card image referenced from the `<head>` of `index.html`. It is not used on the page. It is rendered from `scripts/og-card.html`, a standalone copy of the hero route plate with the animation frozen. To regenerate after changing the plate:

```
chrome --headless=new --disable-gpu --hide-scrollbars --window-size=1200,630 --virtual-time-budget=8000 --screenshot=images/og.png scripts/og-card.html
```

Prefer the Learn original where it shows the same view as a deck slide: it is CC BY 4.0, full resolution, and carries no baked-in callouts. Keep a deck slide when Learn has no matching view or the Learn version contradicts the prose (checked 21 September 2026: 27 slides kept, 3 replaced).