Shadow AI Pilot
Find the AI tools your people already use from managed devices, sign one app list, test a scoped block.
See the engagementAI SECURITY AND GOVERNANCE
Know which agent can act, on whose authority.
Agents are arriving from Copilot Studio, Microsoft Foundry and vendors you did not pick, and your name is on what they do. We inventory them, map each one's identity and data reach, and put an approval and evidence path around every consequential action.
01 Source02 Boundary03 Human decision04 Evidence
HOW IT WORKS
The control path in practice.
- Inventory the agent, owner, permissions, and connected data.
- Test the proposed action against policy and the caller's access.
- Present the exact change to a named human for approval.
- Retain an outcome record and watch for drift.
WAYS TO START
The fixed engagements behind this page.
AI Governance Starter
Turn the AI policy you signed into controls Microsoft Purview enforces.
See the engagementBuy through Microsoft Marketplaceiboss and Purview AI Data Security
Find which AI data paths iboss catches, which Purview catches and which neither does.
See the engagementTHE QUESTION
Which agent can act, on whose authority?
The one with an owner, an identity and a permission row, acting under an approval that is recorded with the outcome; any agent without those three is inventoried and paused.
Copilot governance controls what an assistant can see. Agent governance controls what an agent is allowed to do, and that is the question your examiner, your board and your CEO will each ask in their own words. This engagement answers it with an inventory, a row per agent and an evidence path, inside your Microsoft tenant.
THE MICROSOFT INSIGHT
What governs an agent your business unit built last month?
Microsoft Agent 365, which is the control plane for agents built on Microsoft platforms or acquired from vendors, through the admin center, Microsoft Entra, Defender and Purview you already run.
Microsoft Agent 365 is the control plane that observes, governs and secures agents built on Microsoft platforms or acquired from third parties, through the Microsoft 365 admin center, Microsoft Entra, Microsoft Purview and Microsoft Defender. (Microsoft Learn, checked Oct 31, 2026)
Bring the agents under the control plane now and the inventory is a report. Leave them and the inventory is the first task of the incident.
THE METHOD
How does AI security and agent governance work in practice?
Four steps, each ending in a record you can show: inventory, test, approve, retain.
- Inventory each agent, its owner, its permissions and the data it can reach, read-only.
- Test the proposed action against policy and the caller's own access before it runs.
- Present the exact change to a named person for approval, with the evidence beside it.
- Retain the outcome record, watch for drift, and retire what nobody owns.
THE DEFENSE
Can an agent be stopped before it does something wrong?
Yes, at the tool call: Microsoft Defender evaluates Agent 365 tool invocations made through Work IQ MCP before they run, and custom rules can block a matching action.
Microsoft Defender real-time protection evaluates Agent 365 tool invocations made through Work IQ MCP before they run; the default rule audits and custom rules can block matching actions. (Microsoft Learn, checked Oct 31, 2026)
A blocking rule turns a bad action into an alert with an owner. Without it, the same action is a line in an audit log.
THE FIRST RUNG
Where do you start when the agents are already in the tenant?
With the free AI security check, then the AI Data Readiness and Agent Governance Assessment, read-only, before any control is changed.
The assessment produces the inventory, the one-page Tested or Assumed record and the first permission rows. Microsoft co-markets a related engagement as the Security for AI Assessment; the scope here is set with you and quoted after a scoping call.
AFTER TWO WEEKS
What will be working after two weeks?
- Every agent in scope is inventoried with its owner, identity and data reach, and the orphans are named.
- The first permission rows are drafted and the approval path for consequential actions is agreed.
- One page separates the controls that were tested from the ones that were assumed.
- You hold the remediation scope and its quote as a written decision.
The work is delivered remotely inside your own Microsoft tenant, wherever your business is, and on site only when the work needs it.
HONEST ABOUT LIMITS
What this does not do yet
It does not detect every attack on an agent with a generally available control today. Microsoft Defender threat detection for Agent 365 managed agents, in public preview, raises near real time alerts for jailbreak attempts, indirect prompt injection, credential leakage and suspicious access. (Microsoft Learn, checked Nov 4, 2026, preview) The preview is labeled as such in the plan, and the design relies on the approval gate and the blocking rule that are available now.
It does not give every agent its own governed identity on day one: Microsoft Entra Agent ID is generally available, the agent Conditional Access and lifecycle controls need a Microsoft Agent 365 license, and the first wave names which agents get an identity first.
It does not make a compliance claim for you: the engagement produces the evidence and your compliance officer owns the attestation.
THE ONE THING TO REMEMBER
Copilot governance is about what AI can see; agent governance is about what it is allowed to do.
Said another way: inventory, owner, permission row, gate, record, in that order.
Said a third way: an agent without an owner is an incident waiting for a name.
SHOW YOUR WORK
See the control path on a fictional bank.
The agent action gate
The fictional bank records the exact action and approver.
Coming
See every demonstrationDIRECT ANSWERS
Questions before you decide.
Which agents are in scope?
Every agent that can reach your data or act in your tenant: Copilot Studio and Microsoft Foundry agents, Agent Builder agents, and vendor agents, which join Microsoft Agent 365 through registry sync or the SDK.
Does this slow the business units down?
It gives them a permission row and an approver instead of a ban. An agent that may draft keeps working while the may-do-alone decision waits for the evidence.
What does the inventory record?
Owner, identity, platform, permissions, the data it can reach, the actions it has taken and who approved them. It is the first page of the evidence pack.
What about identities for agents?
Microsoft Entra Agent ID, which gives each agent its own governed identity with Conditional Access and sponsor lifecycle workflows, is generally available; the agent security controls need a Microsoft Agent 365 license, and the admin center wizard and agent user accounts are still in preview. The engagement plans on what is released and labels the rest.
How is it priced?
Quoted after a scoping call. The assessment is read-only and scoped separately from remediation, and each widening of agent permissions is your written decision.
NEXT STEP
Start with a boundary you can explain.
Choose a focused check, or speak with the team about the workflow you need to improve.