Microsoft Agent 365 Security Architecture: Identity, Data, Network, and Threat Protection
How Microsoft Agent 365 coordinates visibility and governance while Entra, Purview, Defender, and network controls enforce different parts of the AI agent security architecture — with the licensing, preview boundaries, and deployment mistakes to understand before production.
My architecture rule: identify the agent, minimize its permissions, protect the data, inspect the actions, control the network path, and make sure responders can disable or contain it quickly.
I would not treat Microsoft Agent 365 as the control that secures everything by itself. Agent 365 provides centralized visibility and governance — a registry of agents, ownership accountability, policy templates, and risk overview. But Entra enforces identity and access. Purview enforces data classification and protection. Defender detects and responds to threats. Network controls restrict connectivity. Agent 365 coordinates oversight; the enforcement is distributed across multiple enforcement surfaces that each need to be configured and validated independently.
Why Microsoft Agent 365 Security Matters Now
AI agents are no longer read-only assistants. They retrieve documents, invoke tools through MCP and other protocols, take actions in downstream systems, and communicate with other agents. Each of these capabilities creates a trust boundary that requires authentication, authorization, and inspection.
Prompt injection is not only a model problem — retrieved documents, MCP tools, external content, and agent-to-agent communication can all become untrusted inputs that attempt to manipulate an agent’s authorized capabilities.
Microsoft Agent 365 became generally available for commercial customers on May 1, 2026. It is included in Microsoft 365 E7 and available as a standalone subscription at US$15/user/month. E3 and E5 do not themselves include the Agent 365 subscription.
How Microsoft Agent 365 Works
Agent 365 is a governance and visibility layer. It provides:
Agent registry. A centralized inventory of agents — registered, discovered, and unmanaged.
Ownership and accountability. Each Microsoft Entra Agent ID-governed agent identity requires a sponsor for business accountability; a technical owner is recommended but optional. Agents merely discovered in the registry may not yet have an Agent ID relationship.
Policy templates. Predefined configurations for identity, data, and access controls applied during agent onboarding. Template changes apply to new activations; already-approved agents are not automatically updated.
Risk overview and observability. Aggregated signals from Entra, Purview, and Defender showing agent posture, policy compliance, and detected threats.
Lifecycle controls. The ability to pause, revoke, or investigate an agent when security conditions change.
The Agent 365 registry provides centralized inventory across registered, discovered, and unmanaged agents. Each Agent ID-governed identity requires a sponsor; a technical owner is recommended.
Agent 365 does not itself perform token validation, DLP enforcement, threat detection, or network filtering. Those responsibilities belong to the enforcement services it coordinates.
Microsoft Agent 365 Security Architecture
The architecture maps four enforcement layers to their respective Microsoft services:
Identity with Microsoft Entra
I normally start by identifying who owns the agent, which identity it uses, what data it can access, and which tools or actions it can perform.
Microsoft Entra Agent ID. Agents onboarded through Microsoft Entra Agent ID receive distinct agent identities created from an agent identity blueprint. Not every Agent 365 registry entry automatically becomes an Agent ID object — discovery and onboarding are separate steps.
Three access patterns. I always separate these because Conditional Access and authorization behave differently for each:
Conditional Access for agents requires Microsoft Entra ID P1 or P2 plus Agent 365. API-key authentication bypasses Conditional Access entirely.
Conditional Access policies must target the correct token subject. Delegated requests use user policies; application-only requests target the agent identity directly; the agent’s user account requires separate targeting.
Data protection with Microsoft Purview
For Purview, I focus on data classification, sensitivity labels, DLP scope, audit, and retention.
Grounding data access. The underlying SharePoint and OneDrive permissions that determine what an agent can access are workload access controls, not Purview controls. Reduce excessive access in SharePoint and OneDrive before the agent can reference it — the oversharing problem from Microsoft 365 Copilot applies equally to agents. Purview complements those access controls with classification, labeling, DLP, and compliance.
Sensitivity labels. Agents honor labels on grounding content where supported. But generated content does not automatically inherit source sensitivity labels — Microsoft’s detailed Purview documentation explicitly states this. Verify generated-content labeling separately.
DLP. Microsoft Purview DLP can be scoped to agent instances for human-agent interactions in Teams, SharePoint, OneDrive, and email. This does not establish universal DLP blocking for every arbitrary tool call.
Audit and retention. Configure Purview Audit for agent interactions before production deployment. Define retention requirements. Establish investigation workflows.
Threat protection with Microsoft Defender
I treat Defender detection and Defender blocking as different states. A control running in audit mode is not the same as stopping the activity.
Discovery. Defender identifies registered, unmanaged, and shadow agents.
AI agent posture risk (Preview). Evaluates agent configuration against security recommendations.
Real-time protection. Microsoft Defender real-time protection for AI agents covers supported onboarded Work IQ MCP and customer MCP tool invocations (GA). Copilot Studio real-time protection remains Preview. The default cloud-agent runtime rule audits activity; custom rules enable blocking.
Threat detection and investigation (Preview). Detects anomalous agent behavior, surfaces alerts, and supports investigation workflows.
Network protection
For Azure-hosted agents, I still design private endpoints, network segmentation, controlled outbound connectivity, and workload-specific security separately from Agent 365 registration.
Global Secure Access / Secure Web and AI Gateway. For supported endpoint scenarios, enable traffic forwarding, TLS inspection, and relevant security policies. Copilot Studio agent discovery requires its integration. Prompt Injection Protection applies to supported JSON-based generative-AI prompt traffic, supports text prompts, does not inspect files, and truncates prompts beyond 64,000 characters.
Get Hasib Munib’s stories in your inbox
Join Medium for free to get updates from this writer.
Azure hosting. Private endpoints, network segmentation, and controlled outbound traffic through Azure Firewall are workload architecture decisions beyond Agent 365 registration. These do not require Microsoft Entra Internet Access.
How the Microsoft Agent 365 Security Layers Work Together
One attack path, four checkpoints
A retrieved document attempts to inject a prompt that triggers an unauthorized external tool action. Here is where each enforcement layer could intervene:
1. Identity (Entra). Conditional Access evaluates applicable signals before issuing a token to an Entra-protected resource. The target resource must still authorize the requested action. If the agent’s identity is not permitted — based on agent risk, execution environment, or network conditions — the token is not issued.
2. Data (Purview). The retrieved document carries a sensitivity label. DLP evaluates whether the agent interaction can process that content. If the label triggers a blocking rule in a supported interaction channel, the content is excluded from grounding.
3. Network (Global Secure Access). Network controls can restrict destinations and inspect supported traffic. Prompt Injection Protection applies when supported generative-AI prompt traffic is routed through the configured inspection path — it is not a generic inspection control for every external tool invocation.
4. Threat (Defender). Real-time protection inspects the tool call for supported runtimes. If the action matches a blocking rule, execution is stopped. If in audit mode, the event is recorded but the action proceeds.
Layered controls reduce dependence on any single control, but applicable protections depend on the agent’s identity model, runtime, data path, and network path.
Common Microsoft Agent 365 Security Mistakes
Using the maker’s standing credentials for shared tools. One common mistake is letting an agent use the maker’s or developer’s standing privileges instead of a purpose-built least-privilege identity. Microsoft’s operational guidance identifies MCP tools running with maker privileges as an overpermissioning risk.
Assuming registration proves enforcement. Registering an agent or assigning a policy does not prove the control is actually enforced. I validate the real token flow and runtime behavior. An assigned Entra policy may not enforce at runtime if the agent does not authenticate through Entra.
Assuming “All users” covers the agent’s user account. It does not. Policies targeting an agent identity or its blueprint also do not automatically cover its linked user account. Each access pattern needs its own Conditional Access targeting.
Claiming generated content inherits source labels. Microsoft’s detailed Purview documentation explicitly states that newly created Agent 365 content does not inherit source sensitivity labels.
Equating detection with blocking. Defender’s default cloud-agent runtime rule audits. Blocking requires custom rules with explicit configuration.
Assuming template edits update existing agents. Template changes apply to new activations. Already-approved agents are unaffected.
Treating network isolation as complete protection. Private connectivity must be complemented by authorization, tool controls, content checks, and protected agent-to-agent communication.
What I Recommend in Production
Inventory and assign accountability. Register agents, discover unmanaged agents, assign sponsors, and define how responders can pause or revoke an agent.
Design identity boundaries deliberately. Give each agent a purpose-built identity from an agent identity blueprint. Use managed identities or workload identity federation for Azure-hosted agents where supported.
Target Conditional Access to the actual token subject. Delegated requests, application-only requests, and the agent’s user account each require their own targeting.
Reduce grounding data exposure in SharePoint and OneDrive. Apply sensitivity labels. Scope DLP to agent instances. Verify generated-content labeling separately.
Set Defender to the intended enforcement mode. Configure blocking rules for scenarios that require it.
Prove unauthorized actions fail. Test with an unauthorized agent identity. Test with a blocked sensitivity label. Test with prompt injection in retrieved content. If any succeed, the enforcement model is incomplete.
Microsoft Agent 365 Security Deployment Checklist
→ Agents inventoried in the Agent 365 registry; sponsor assigned for each Agent ID-governed identity; owner recommended. → Agent identities purpose-built from blueprints with least privilege; maker credentials not shared with agent tools. → Conditional Access policies target the correct token subject: user, agent identity, and agent’s user account separately. → API-key authentication replaced with Entra-authenticated flows where Conditional Access enforcement is required. → SharePoint and OneDrive grounding permissions reviewed and reduced. → Sensitivity labels applied to grounding content; generated-content labeling verified separately. → Purview DLP scoped to agent instances for supported interaction channels. → Purview Audit configured for agent interactions; retention requirements defined. → Defender real-time protection rules set to the intended enforcement mode (audit vs block); posture risk reviewed (Preview). → Global Secure Access configured where supported; Prompt Injection Protection scope and limitations documented. → Azure-hosted agent networking designed separately: private endpoints, segmentation, controlled outbound. → Unauthorized access paths tested: wrong identity, blocked label, prompt injection, direct tool invocation. → Template limitations understood: changes apply to new activations, not existing agents.
Microsoft References
→ Overview of Microsoft Agent 365 — Product scope, commercial availability, and governance capabilities.
→ Secure AI agents at scale using Microsoft Agent 365 — Distributed security model across Entra, Purview, Defender, and network controls.
→ Protect agent identities with Microsoft Entra — Blueprints, Agent ID, sponsors, owners, and access patterns.
→ Administrative relationships in Microsoft Entra Agent ID — Sponsor requirement, optional owner, and accountability model.
→ Conditional Access for agents — Authentication flows, policy targeting, agent risk, and CA boundaries.
→ How Microsoft Purview supports Agent 365 — Labeling, DLP scope, audit, retention, and generated-content labeling behavior.
→ Use Purview for Microsoft Agent 365 — Detailed DLP, labeling, and interaction-channel support.
→ Agent 365 policy templates — Onboarding configurations and template-update limitations.
→ AI agent posture risk in Microsoft Defender (Preview) — Agent posture assessment and security recommendations.
→ Protect AI agents in real time using Microsoft Defender — Audit vs block, custom rules, supported runtimes, and GA/Preview status.
→ Detect and investigate threats to AI agents (Preview) — Anomaly detection, alerts, and investigation workflows.
→ Prompt Injection Protection in Global Secure Access — JSON text-prompt scope, file exclusions, 64K truncation, and TLS inspection requirements.
→ Microsoft Agent 365 service description — Plan comparison and feature availability.
→ Agent 365 licensing FAQ — Pricing, prerequisites, June 2026 foundation requirements, and user-licensing scope.
→ Secure agents: Identity, access, and data protection — Operational best practices for registration, permissions, and lifecycle.
→ Agent 365 security operations — Microsoft Tech Community — MCP tool credential risks and overpermissioning examples.
→ Azure AI Foundry architecture baseline — Azure Architecture Center — Private endpoints, network segmentation, and workload-specific security.
The Microsoft Learn references above reflect documentation current as of September 2026. Microsoft Agent 365 features, licensing, integrations, and preview status change — verify against the latest documentation and applicable Product Terms before deploying.
