https://secure-ai.guide/whats-new Recently added and updated AI security scenarios, solutions, and capabilities on secure-ai.guide. en Sat, 08 Aug 2026 00:00:00 GMT https://secure-ai.guide/guides/microsoft-ai-landscape https://secure-ai.guide/guides/microsoft-ai-landscape Guide Sat, 08 Aug 2026 00:00:00 GMT Introduction to Microsoft's AI Agents — where each one sits, how much of an agent you build and therefore have to secure, and how Agent 365 governs them all once they exist. https://secure-ai.guide/guides/security-frameworks-regulations https://secure-ai.guide/guides/security-frameworks-regulations Guide Sat, 08 Aug 2026 00:00:00 GMT The shared language for AI security — which acronyms are laws, frameworks, standards, and threat references, how they stack together, and how Microsoft turns them into practice. https://secure-ai.guide/solutions/shadow-ai https://secure-ai.guide/solutions/shadow-ai Solution Mon, 03 Aug 2026 00:00:00 GMT Discover, control, and govern unsanctioned AI app usage across your organisation — from building visibility into shadow AI activity to blocking risky destinations, preventing data loss, and governing sanctioned use. https://secure-ai.guide/scenarios/govern-agent-identity-and-access https://secure-ai.guide/scenarios/govern-agent-identity-and-access Scenario Mon, 03 Aug 2026 00:00:00 GMT Give every agent a first-class Entra identity, then govern what it authenticates as and what it can reach — assign a responsible owner, right-size access with packages and reviews, and enforce risk-based Conditional Access before it touches resources. https://secure-ai.guide/scenarios/govern-sanctioned-enterprise-ai https://secure-ai.guide/scenarios/govern-sanctioned-enterprise-ai Scenario Mon, 03 Aug 2026 00:00:00 GMT Bring the AI that runs outside Microsoft's Copilot family — custom apps you build and sanctioned SaaS such as ChatGPT Enterprise and Anthropic Claude — under Microsoft Purview, so their interactions are discovered, audited, and governed like the rest of your estate rather than remaining a blind spot. https://secure-ai.guide/scenarios/investigate-and-respond-to-agent-incidents https://secure-ai.guide/scenarios/investigate-and-respond-to-agent-incidents Scenario Mon, 03 Aug 2026 00:00:00 GMT Gives responders what they need to work an agent incident end to end — the agent inventory, the identity graph behind it, the conversation evidence, and the legal-hold path — so an alert can be scoped, understood, and acted on. https://secure-ai.guide/capabilities/microsoft-defender-xdr-agent-threat-hunting https://secure-ai.guide/capabilities/microsoft-defender-xdr-agent-threat-hunting Capability Mon, 03 Aug 2026 00:00:00 GMT Correlates AI agent alerts into incidents and gives analysts an incident graph to scope the blast radius, then queries Agent 365 observability data with Kusto Query Language in Advanced Hunting — across the AgentsInfo, CloudAppEvents, and BehaviorInfo tables — to investigate threats and proactively hunt for risk. Turns near-real-time agent detections into full investigation and threat-hunting workflows in the Microsoft Defender portal. https://secure-ai.guide/capabilities/microsoft-entra-id-governance-agent-lifecycle-management https://secure-ai.guide/capabilities/microsoft-entra-id-governance-agent-lifecycle-management Capability Mon, 03 Aug 2026 00:00:00 GMT Governs the identity lifecycle of AI agents in Microsoft Entra ID Governance — enabling, disabling, and retiring agents, and keeping an accountable human sponsor on every agent so oversight is never lost. When a sponsor leaves, sponsorship transfers automatically to their manager, and Lifecycle Workflows automate the mover and leaver notifications that keep an agent's access from outliving its oversight. https://secure-ai.guide/capabilities/microsoft-purview-data-lifecycle-management-ai-retention https://secure-ai.guide/capabilities/microsoft-purview-data-lifecycle-management-ai-retention Capability Mon, 03 Aug 2026 00:00:00 GMT Applies Microsoft Purview retention policies and labels to the prompts and responses of Microsoft 365 Copilot, agents, and other AI apps, retaining what the organization must keep and deleting what it no longer needs. Covers both user Copilot experiences and agent interactions across the supported surfaces. https://secure-ai.guide/capabilities/microsoft-purview-dspm-ai-interaction-discovery https://secure-ai.guide/capabilities/microsoft-purview-dspm-ai-interaction-discovery Capability Mon, 03 Aug 2026 00:00:00 GMT Uses Microsoft Purview Data Security Posture Management reports, AI observability, and Activity explorer to surface user interactions with AI apps and agents, identify sensitive information in prompts and responses, and inform follow-up controls such as DLP, insider risk, investigation, and remediation workflows. https://secure-ai.guide/capabilities/microsoft-purview-ediscovery-ai-interactions https://secure-ai.guide/capabilities/microsoft-purview-ediscovery-ai-interactions Capability Mon, 03 Aug 2026 00:00:00 GMT Lets legal and compliance teams search, place holds on, review, and export the prompts and responses of Microsoft 365 Copilot, agents, and other AI apps in Microsoft Purview eDiscovery — treating a user mailbox or an agent instance as the custodian. Reduces the risk of being unable to preserve or investigate AI interaction data for legal and compliance cases. https://secure-ai.guide/capabilities/microsoft-purview-enterprise-ai-app-connectors https://secure-ai.guide/capabilities/microsoft-purview-enterprise-ai-app-connectors Capability Mon, 03 Aug 2026 00:00:00 GMT Connects sanctioned non-Microsoft enterprise AI apps — ChatGPT Enterprise and Anthropic Claude (connector in preview) — to Microsoft Purview so their prompts and responses surface in Data Security Posture Management for AI with auditing, and, for ChatGPT Enterprise, insider risk, communication compliance, eDiscovery, and retention. Brings enterprise AI outside Microsoft under monitoring and compliance, though sensitivity-label, encryption, and DLP enforcement are not supported for these connected apps. https://secure-ai.guide/capabilities/microsoft-purview-entra-registered-ai-apps https://secure-ai.guide/capabilities/microsoft-purview-entra-registered-ai-apps Capability Mon, 03 Aug 2026 00:00:00 GMT Registers custom, in-house AI apps in Microsoft Entra and integrates them with the Microsoft Purview SDK so their prompts and responses inherit the full Purview control plane — data classification, sensitivity labels, encryption, data loss prevention, insider risk, communication compliance, eDiscovery, retention, and Compliance Manager. Gives apps you build the same data governance as Microsoft Copilot rather than leaving them outside compliance. https://secure-ai.guide/capabilities/microsoft-purview-information-protection-encryption-without-labels https://secure-ai.guide/capabilities/microsoft-purview-information-protection-encryption-without-labels Capability Mon, 03 Aug 2026 00:00:00 GMT Enforces Azure Rights Management VIEW and EXTRACT usage rights on content protected without a sensitivity label — such as Message Encryption, Information Rights Management, or Customer Key — so Microsoft 365 Copilot and Copilot Cowork only return data the user is entitled to see. Unlike labeled content, this protection is not inherited by newly generated output. https://secure-ai.guide/capabilities/azure-ai-foundry-abuse-monitoring https://secure-ai.guide/capabilities/azure-ai-foundry-abuse-monitoring Capability Wed, 29 Jul 2026 00:00:00 GMT Detects recurring harmful content and misuse patterns in Azure OpenAI prompts and completions, and flags potentially abusive users through content classification and pattern scoring. Surfaces Risks & Safety monitoring signals so teams can respond to misuse of deployed models. https://secure-ai.guide/capabilities/microsoft-365-admin-center-agent-policy-templates https://secure-ai.guide/capabilities/microsoft-365-admin-center-agent-policy-templates Capability Wed, 29 Jul 2026 00:00:00 GMT Bundle predefined governance and security policies from Microsoft Entra, Purview, SharePoint Online, and Defender into templates that administrators apply to agents in the Microsoft 365 admin center, standardizing controls and reducing manual configuration across the agent estate. Requires the Microsoft Agent 365 license. https://secure-ai.guide/capabilities/microsoft-365-admin-center-copilot-web-grounding-controls https://secure-ai.guide/capabilities/microsoft-365-admin-center-copilot-web-grounding-controls Capability Wed, 29 Jul 2026 00:00:00 GMT Governs whether Microsoft 365 Copilot and Copilot Chat can ground responses on the public web, and which external domains are off-limits. Admins turn web grounding on or off tenant-wide with the Allow web search in Copilot policy and exclude up to 1,000 domains, keeping untrusted or non-compliant web sources out of AI responses. https://secure-ai.guide/capabilities/microsoft-purview-insider-risk-management-adaptive-protection https://secure-ai.guide/capabilities/microsoft-purview-insider-risk-management-adaptive-protection Capability Wed, 29 Jul 2026 00:00:00 GMT Dynamically assigns escalated DLP, data lifecycle, and Conditional Access controls to users whose insider risk level rises — automatically tightening restrictions when risk increases and relaxing them when it subsides. https://secure-ai.guide/capabilities/microsoft-sentinel-power-platform-activity-monitoring https://secure-ai.guide/capabilities/microsoft-sentinel-power-platform-activity-monitoring Capability Wed, 29 Jul 2026 00:00:00 GMT Collects agent and Power Platform activity into Microsoft Sentinel and applies analytics rules to detect, investigate, and respond to suspicious agent behavior alongside other tenant signals. Reduces the risk of undetected malicious agent activity. https://secure-ai.guide/capabilities/microsoft-windows-365-for-agents-isolated-execution https://secure-ai.guide/capabilities/microsoft-windows-365-for-agents-isolated-execution Capability Wed, 29 Jul 2026 00:00:00 GMT Runs agents inside pooled, stateless Cloud PCs that are Microsoft Entra-joined and Intune-enrolled and reset after every session. Contains what a manipulated or compromised agent can reach and leaves a per-session identity and audit trail for every action. https://secure-ai.guide/capabilities/microsoft-purview-information-protection-copilot-label-inheritance https://secure-ai.guide/capabilities/microsoft-purview-information-protection-copilot-label-inheritance Capability Mon, 27 Jul 2026 00:00:00 GMT Copilot responses and generated files inherit the highest-priority sensitivity label of the sources they draw on, carrying that label's encryption and markings onto the AI output so protection follows the content instead of stopping at the grounding data. https://secure-ai.guide/scenarios/establish-foundry-security-foundation https://secure-ai.guide/scenarios/establish-foundry-security-foundation Scenario Fri, 24 Jul 2026 00:00:00 GMT Lock down the Microsoft Foundry platform, its network path, and its data before any agent ships — scoped access, private networking, and customer-controlled encryption as the baseline every project inherits. https://secure-ai.guide/scenarios/protect-foundry-agents-at-runtime https://secure-ai.guide/scenarios/protect-foundry-agents-at-runtime Scenario Fri, 24 Jul 2026 00:00:00 GMT Harden the running agent so it resists prompt attacks, doesn't leak sensitive or protected output, stays aligned to its assigned task, and has its tool traffic mediated. https://secure-ai.guide/capabilities/azure-ai-foundry-ai-red-teaming-agent https://secure-ai.guide/capabilities/azure-ai-foundry-ai-red-teaming-agent Capability Fri, 24 Jul 2026 00:00:00 GMT Runs automated adversarial scans against models and Foundry agents — simulating prompt injection, jailbreak, and agentic attacks with PyRIT strategies — and scores each attempt with an Attack Success Rate to surface safety and security weaknesses before deployment. In preview. https://secure-ai.guide/capabilities/azure-ai-foundry-risk-safety-evaluators https://secure-ai.guide/capabilities/azure-ai-foundry-risk-safety-evaluators Capability Fri, 24 Jul 2026 00:00:00 GMT Scores model and agent outputs against built-in risk and safety evaluators — including groundedness, indirect prompt injection (XPIA), prohibited actions, and sensitive data leakage — so teams can gate releases and catch unsafe behaviour before deployment. Runs from the Azure AI Evaluation SDK or the Foundry portal and feeds results back into observability. https://secure-ai.guide/capabilities/azure-monitor-application-insights-agent-telemetry https://secure-ai.guide/capabilities/azure-monitor-application-insights-agent-telemetry Capability Fri, 24 Jul 2026 00:00:00 GMT Provides a unified Agent details view (in preview) that monitors AI agents across Microsoft Foundry, Copilot Studio, and third-party frameworks using OpenTelemetry Gen AI semantics — tracking performance, token usage and cost, Gen AI errors, and end-to-end traces. Copilot Studio agents can additionally emit opt-in, high-fidelity runtime telemetry for deep query-based analysis in KQL. https://secure-ai.guide/capabilities/microsoft-365-admin-center-copilot-security-dashboard https://secure-ai.guide/capabilities/microsoft-365-admin-center-copilot-security-dashboard Capability Fri, 24 Jul 2026 00:00:00 GMT Surfaces Microsoft 365 Copilot data-security posture in the Microsoft 365 admin center — data loss prevention, oversharing, and compliance insights — so administrators can monitor and act on Copilot data risk in one place. Draws on Microsoft Purview signals to give a single view of Copilot data governance. https://secure-ai.guide/capabilities/microsoft-defender-xdr-security-dashboard-for-ai https://secure-ai.guide/capabilities/microsoft-defender-xdr-security-dashboard-for-ai Capability Fri, 24 Jul 2026 00:00:00 GMT Aggregates AI security posture and real-time risk signals from Microsoft Defender, Microsoft Entra, and Microsoft Purview into one scorecard and inventory spanning Microsoft 365 Copilot, Copilot Studio agents, Microsoft Foundry apps and agents, and third-party or shadow AI. Gives security leaders a single cross-product view of AI assets and their risk; currently in preview. https://secure-ai.guide/capabilities/microsoft-purview-communication-compliance-ai https://secure-ai.guide/capabilities/microsoft-purview-communication-compliance-ai Capability Fri, 24 Jul 2026 00:00:00 GMT Detects inappropriate, risky, or policy-violating content in AI prompts and responses — including Microsoft 365 Copilot, connected AI apps, and browser-accessed third-party AI tools — using built-in classifiers and custom policies. https://secure-ai.guide/capabilities/microsoft-security-copilot-incident-investigation https://secure-ai.guide/capabilities/microsoft-security-copilot-incident-investigation Capability Fri, 24 Jul 2026 00:00:00 GMT Gives SOC analysts a natural-language assistant that summarises incidents, correlates signals across Defender XDR, Sentinel, Entra, and Purview, and recommends guided responses — accelerating triage and response for incidents that involve AI agents. Runs standalone or embedded in the Defender portal, with agent identity and RBAC set by the Security Copilot owner. https://secure-ai.guide/capabilities/microsoft-sharepoint-advanced-management-admin-agent https://secure-ai.guide/capabilities/microsoft-sharepoint-advanced-management-admin-agent Capability Fri, 24 Jul 2026 00:00:00 GMT An AI-powered governance agent that lets administrators investigate tenant-level content risks — oversharing, sprawl, stale sites, and access — through natural-language queries instead of running reports manually. Analyzes SharePoint and SharePoint Advanced Management data to recommend and guide oversharing remediation before a Microsoft 365 Copilot rollout. https://secure-ai.guide/solutions/agent-identity-and-access https://secure-ai.guide/solutions/agent-identity-and-access Solution Thu, 23 Jul 2026 00:00:00 GMT Give every agent a first-class identity, then govern what it authenticates as and what it can reach — registering agents in Microsoft Entra, assigning owners, right-sizing access with packages and reviews, and enforcing risk-based Conditional Access. https://secure-ai.guide/solutions/agent-observability-and-governance https://secure-ai.guide/solutions/agent-observability-and-governance Solution Thu, 23 Jul 2026 00:00:00 GMT Bring the growing population of AI agents into view and under control with Microsoft Agent 365 — from a centralized, cross-platform inventory of every agent and who owns it, to lifecycle governance over which agents are allowed, what tools they can call, and which policies apply. https://secure-ai.guide/solutions/detect-and-respond-to-ai-data-risk https://secure-ai.guide/solutions/detect-and-respond-to-ai-data-risk Solution Thu, 23 Jul 2026 00:00:00 GMT Turn AI audit signals, insider-risk indicators, and communication-compliance findings into investigation and response — bridged into Microsoft Defender XDR and Microsoft Sentinel. https://secure-ai.guide/solutions/protect-enterprise-data-used-by-ai https://secure-ai.guide/solutions/protect-enterprise-data-used-by-ai Solution Thu, 23 Jul 2026 00:00:00 GMT Control what enterprise data AI can read and share — discover where sensitive data and oversharing create AI risk, classify and label it, prevent its loss to AI apps and agents, and govern its lifecycle. https://secure-ai.guide/solutions/secure-the-agent-runtime https://secure-ai.guide/solutions/secure-the-agent-runtime Solution Thu, 23 Jul 2026 00:00:00 GMT Protect the running agent from manipulation — control which destinations it can reach, block risky tool invocations before they execute, and inspect the local agent loop on endpoints. https://secure-ai.guide/scenarios/classify-and-label-ai-data-foundation https://secure-ai.guide/scenarios/classify-and-label-ai-data-foundation Scenario Thu, 23 Jul 2026 00:00:00 GMT Establish the information-protection foundation AI controls depend on — classify sensitive data and apply labels so protection travels with the content agents and Copilots ground on. https://secure-ai.guide/scenarios/detect-and-respond-to-risky-ai-data-activity https://secure-ai.guide/scenarios/detect-and-respond-to-risky-ai-data-activity Scenario Thu, 23 Jul 2026 00:00:00 GMT Close the loop — turn AI audit signals, insider-risk indicators, and communication-compliance findings into investigation and response, bridged into Defender XDR and Sentinel. https://secure-ai.guide/scenarios/discover-sensitive-data-and-ai-risk https://secure-ai.guide/scenarios/discover-sensitive-data-and-ai-risk Scenario Thu, 23 Jul 2026 00:00:00 GMT Start with visibility — find where sensitive data, oversharing, AI interactions, and unsanctioned AI usage create risk before choosing controls. https://secure-ai.guide/scenarios/govern-ai-data-lifecycle-and-retention https://secure-ai.guide/scenarios/govern-ai-data-lifecycle-and-retention Scenario Thu, 23 Jul 2026 00:00:00 GMT Decide how long AI prompts, responses, and related evidence are kept, deleted, preserved, or removed from active AI grounding. https://secure-ai.guide/scenarios/prevent-data-loss-to-ai-apps-and-agents https://secure-ai.guide/scenarios/prevent-data-loss-to-ai-apps-and-agents Scenario Thu, 23 Jul 2026 00:00:00 GMT Turn classification and labels into enforcement boundaries for Copilot, agents, prompts, grounding data, and the browser-based AI apps users reach on their own. https://secure-ai.guide/scenarios/protect-agents-at-runtime https://secure-ai.guide/scenarios/protect-agents-at-runtime Scenario Thu, 23 Jul 2026 00:00:00 GMT Protect the running agent from manipulation — control which destinations it can reach, block risky tool invocations before they execute, and inspect the local agent loop on endpoints for prompt injection and high-risk actions. https://secure-ai.guide/capabilities/microsoft-defender-for-cloud-ai-security-posture-management https://secure-ai.guide/capabilities/microsoft-defender-for-cloud-ai-security-posture-management Capability Thu, 23 Jul 2026 00:00:00 GMT Discovers deployed generative AI apps and models across Azure, AWS, and GCP — the AI bill of materials — and assesses their posture, surfacing identity, data, and internet-exposure recommendations, attack paths, and infrastructure-as-code misconfigurations. https://secure-ai.guide/capabilities/microsoft-entra-internet-access-prompt-injection-protection https://secure-ai.guide/capabilities/microsoft-entra-internet-access-prompt-injection-protection Capability Thu, 23 Jul 2026 00:00:00 GMT Inspects prompts flowing to generative AI apps in Internet Access traffic and blocks adversarial prompt injection and jailbreak attempts before they reach the language model, enforced at the network layer through the Global Secure Access client. It ships with detectors for major generative AI services, extends to custom JSON-based apps, and currently covers text prompts only. https://secure-ai.guide/capabilities/microsoft-purview-data-classification-sensitive-info-types https://secure-ai.guide/capabilities/microsoft-purview-data-classification-sensitive-info-types Capability Thu, 23 Jul 2026 00:00:00 GMT Identifies sensitive data with pattern-based sensitive information types (SITs) and machine-learning trainable classifiers. In AI scenarios these classifiers find sensitive content in user prompts and responses and provide the detection basis that labels, DLP, DSPM reports, and investigation all build on. https://secure-ai.guide/capabilities/microsoft-purview-data-loss-prevention-browser-data-security https://secure-ai.guide/capabilities/microsoft-purview-data-loss-prevention-browser-data-security Capability Thu, 23 Jul 2026 00:00:00 GMT Enforces DLP inline in Microsoft Edge for Business, inspecting text users type or paste into AI app prompts in real time and blocking sensitive submissions before they leave the browser — without onboarding the device. Configuration policies block users from reaching the same unmanaged AI apps in unprotected browsers. https://secure-ai.guide/capabilities/microsoft-purview-data-loss-prevention-endpoint-dlp https://secure-ai.guide/capabilities/microsoft-purview-data-loss-prevention-endpoint-dlp Capability Thu, 23 Jul 2026 00:00:00 GMT Monitors managed devices and blocks paste, upload, or clipboard copy of sensitive information to AI application websites, keeping sensitive data from leaving endpoints through third-party AI apps. https://secure-ai.guide/capabilities/microsoft-purview-data-loss-prevention-network-data-security https://secure-ai.guide/capabilities/microsoft-purview-data-loss-prevention-network-data-security Capability Thu, 23 Jul 2026 00:00:00 GMT Monitors and blocks sensitive data shared with unmanaged AI apps through non-Microsoft browsers, apps, APIs, and add-ins by integrating with SASE and secure web gateway solutions to inspect HTTP/HTTPS traffic at the network layer — the surface Endpoint DLP cannot see. https://secure-ai.guide/capabilities/microsoft-purview-insider-risk-management-ai-signals https://secure-ai.guide/capabilities/microsoft-purview-insider-risk-management-ai-signals Capability Thu, 23 Jul 2026 00:00:00 GMT Uses Microsoft Purview Insider Risk Management to identify users with potentially risky AI-related behavior, such as sharing sensitive content with AI apps or interacting with unsanctioned AI services, by correlating configured activity signals from Microsoft Purview, Microsoft 365, browser, endpoint, and network controls. These insights are integrated into Microsoft Defender XDR, where IRM alerts correlate per user into a single incident for unified investigation. https://secure-ai.guide/solutions/secops-for-ai https://secure-ai.guide/solutions/secops-for-ai Solution Wed, 22 Jul 2026 00:00:00 GMT Connect agent activity to security operations — stream telemetry to the SOC, detect AI-specific threats, and investigate and respond to agent incidents across Microsoft Sentinel, Defender, and Purview.