You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
title: Discover and detect threats using the AI agents inventory (Preview)
3
+
ms.author: abbyweisberg
4
+
author: AbbyMSFT
5
+
description: Learn how to view all of the AI Agents in your organization using Microsoft Defender.
6
+
ms.date: 11/02/2025
7
+
ms.topic: how-to
8
+
ms.service: defender-for-cloud-apps
9
+
ms.reviewer: gayasalomon
10
+
#customer-intent: As a security administrator, I want view all of the AI Agents in my organization, and detect threats on my AI agents using advanced hunting.
11
+
---
12
+
13
+
# Discover and protect your AI Agents (Preview)
14
+
15
+
Microsoft Defender detects all Copilot Studio custom AI agents in your tenant and provides tools to identify misconfigured or potentially risky agents, and collects data from Copilot Studio for use in [advanced hunting](/defender-xdr/advanced-hunting-overview).
16
+
17
+
## Prerequisites
18
+
To enable AI agent inventory and detection you must opt in to the [Microsoft Defender preview features](https://security.microsoft.com/securitysettings/defender/preview_features) of:
19
+
- Microsoft Defender for Cloud Apps
20
+
- Microsoft Defender for Cloud
21
+
- Microsoft Defender XDR
22
+
23
+
## Enable the Copilot Studio AI agent inventory
24
+
25
+
> [!NOTE]
26
+
> The onboarding process for the AI agent inventory requires collaboration with Power Platform administrators.
27
+
28
+
To enable the Copilot Studio AI agent inventory, follow these steps:
29
+
30
+
1.**Sign in to the [Microsoft Defender portal](https://security.microsoft.com)** as the System Administrator.
31
+
1. Go to **System > Settings > Cloud Apps > Copilot Studio AI Agents**.
32
+
1. Turn on **Copilot Studio AI Agents**. Enabling Copilot Studio AI Agents confirms that you read the disclaimer and agree to use the Microsoft Defender AI agent protection features.
33
+
34
+
:::image type="content" source="media/protect-ai-agents/copilot-studio-ai-agents-button.png" alt-text="Screenshot of the Copilot Studio AI Agent configuration toggle.":::
35
+
36
+
1. Work together with the Power Platform administrator to complete these steps in the [Power Platform Portal](https://admin.preview.powerplatform.microsoft.com/security/threatdetection):
37
+
1. Select **Microsoft Defender - Copilot Studio AI Agents**.
38
+
1. Turn on **Enable Microsoft Defender - Copilot Studio AI Agents**.
39
+
40
+
When Copilot Studio AI Agents are connected, a green indicator appears in the **AI Agents Inventory** section in the Microsoft Defender system settings. It can take up to 30 minutes for the initial connection status to update. Depending on the size and complexity of your environment, it might take longer to see the full deployment of the AI agent inventory.
41
+
42
+
43
+
## Identify misconfigured or risky AI agents using advanced hunting
44
+
45
+
After you give Microsoft Defender access to your custom agents, you can use advanced hunting to help identify misconfigured or risky agents and minimize organizational exposure to potential threats.
46
+
We recommend that you reach out to the owners of the risky agents for more information, and that you consider quarantining or deleting risky agents.
47
+
48
+
1. Sign in to the Defender portal, and go **Investigation & response** -> **Hunting** -> **Advanced hunting**.
49
+
1. In the **Apps & identities** section, the [AIAgentsInfo table](/defender-xdr/advanced-hunting-aiagentsinfo-table) contains data for all your custom AI agents created using Copilot Studio. You can use this data to create custom queries.
50
+
51
+
### Sample queries
52
+
53
+
Run this query to get a list of all the agents in your tenant:
54
+
55
+
```kusto
56
+
AIAgentsInfo
57
+
| summarize arg_max(Timestamp, *) by AIAgentId
58
+
```
59
+
60
+
Run this query to identify all published agents that are configured with an incorrect authentication mechanism:
61
+
62
+
```kusto
63
+
AIAgentsInfo
64
+
| summarize arg_max(Timestamp, *) by AIAgentId
65
+
| where AgentStatus != "Deleted"
66
+
| where AgentStatus == "Published"
67
+
| where UserAuthenticationType == "None" or AuthenticationTrigger == "As Needed"
See [Proactively hunt for threats with advanced hunting in Microsoft Defender](/defender-xdr/advanced-hunting-overview) to learn how to use queries to proactively hunt for threats.
73
+
74
+
## Related articles
75
+
76
+
-[Protect your Copilot Studio custom AI Agents (Preview)](ai-agent-protection.md)
77
+
-[Enable real-time protection for Microsoft Copilot Studio Agents](real-time-agent-protection-during-runtime.md)
title: Protect your Microsoft Copilot Studio AI agents (Preview)
3
+
description: Learn how to enable and manage AI Agent protection for Microsoft Copilot Studio AI agents using Microsoft Defender.
4
+
ms.date: 11/02/2025
5
+
ms.topic: how-to
6
+
ms.service: defender-for-cloud-apps
7
+
ms.reviewer: gayasalomon
8
+
#customer-intent: As a security administrator, I want my Copilot Studio AI agents to be protected against suspicious or harmful actions so that I can reduce security risks to my organization.
9
+
---
10
+
11
+
# Protect your Microsoft Copilot Studio AI agents (Preview)
12
+
13
+
As No code/Low code platforms become increasingly accessible, organizations face new types of security risks. These platforms empower non-technical users to build and deploy custom agents without centralized security review or controls in place. Attackers can attempt to manipulate these agents by:
14
+
- Injecting malicious prompts
15
+
- Triggering unintended tool executions
16
+
- Exploiting data sources to escalate privileges or exfiltrate data.
17
+
18
+
## AI agent protection features
19
+
20
+
Microsoft Defender addresses critical security gaps with comprehensive AI agent protection that includes proactive exposure, threat hunting, real time protection, and alerts. With AI agent protection, Microsoft Defender:
21
+
22
+
- Detects all of your custom AI agents created with Microsoft Copilot Studio, and integrates their data into advanced hunting for proactive threat detection. You can use this data to create custom queries and hunt for potential threats. See [Copilot Studio AI agent inventory (Preview)](ai-agent-inventory.md) to learn how to set up and make use of the AI agent inventory.
23
+
- Collects audit logs for your custom AI agents created with Copilot Studio, continuously monitors the agents for suspicious activity, and enables detections and alerts. To enable this monitoring, make sure that you:
24
+
-[Enable the AI agent inventory](ai-agent-inventory.md#enable-the-copilot-studio-ai-agent-inventory).
25
+
-[Enable the Microsoft 365 app connector](protect-office-365.md#connect-microsoft-365-to-microsoft-defender-for-cloud-apps).
26
+
- Provides real-time protection to block suspicious or harmful actions initiated by your AI agents, and triggers an informative alert integrated into the XDR incidents and alerts environment. See [Enable real-time protection for Microsoft Copilot Studio Agents](real-time-agent-protection-during-runtime.md) to learn how to set up real-time protection.
27
+
28
+
## Related articles
29
+
30
+
-[Discover and protect your Copilot Studio custom AI Agents (Preview)](ai-agent-inventory.md)
31
+
-[Enable real-time protection for Microsoft Copilot Studio Agents](real-time-agent-protection-during-runtime.md)
Copy file name to clipboardExpand all lines: defender-for-cloud-apps/real-time-agent-protection-during-runtime.md
+16-47Lines changed: 16 additions & 47 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -1,22 +1,16 @@
1
1
---
2
-
title: Real-time protection during agent runtime for Microsoft Copilot Studio AI agents (Preview)
3
-
description: Learn how to enable and manage real-time runtime protection for Microsoft Copilot Studio AI agents using Microsoft Defender.
4
-
ms.date: 10/26/2025
2
+
title: Protect your agents in real-time during runtime (Preview)
3
+
description: Learn how to Protect your environment in real-time during agent runtime using Microsoft Defender for Cloud Apps.
4
+
ms.date: 11/02/2025
5
5
ms.topic: how-to
6
6
ms.service: defender-for-cloud-apps
7
7
ms.reviewer: gayasalomon
8
-
#customer-intent: As a security administrator, I want my Copilot Studio AI agents to be protected against suspicious or harmful actions during runtime so that I can reduce security risks to my organization.
8
+
#customer-intent: As a security administrator, I want my Copilot Studio AI agents to be protected against suspicious or harmful actions so that I can reduce security risks to my organization.
9
9
---
10
10
11
-
# Real-time protection during agent runtime for Microsoft Copilot Studio AI agents (Preview)
12
-
13
-
14
-
## Overview
15
-
11
+
# Protect your environment in real-time during agent runtime
16
12
As AI agents become increasingly accessible through low-code/no‑code (LCNC) platforms like Microsoft Copilot Studio, organizations face new types of security risks at scale. These platforms empower non‑technical users to build and deploy custom agents without centralized security review or controls in place. Attackers can attempt to manipulate these agents by injecting malicious prompts, triggering unintended tool executions, or exploiting data sources to escalate privileges or exfiltrate data.
17
13
18
-
## Capabilities
19
-
20
14
Real-time protection during agent runtime in Microsoft Defender reduces these risks by inspecting tool invocations before the agent runs any actions.
21
15
22
16
If Microsoft Defender determines that a prompt is suspicious:
@@ -25,54 +19,29 @@ If Microsoft Defender determines that a prompt is suspicious:
25
19
- The user gets notified that their message was blocked.
26
20
- An informative alert is created and appears in the Microsoft Defender portal under XDR Incidents and Alerts.
27
21
28
-
29
-
This capability adds another security layer on top of Microsoft Copilot Studio, helping ensure AI agents remain resilient against evolving threats.
22
+
## Enable real-time protection for Microsoft Copilot Studio agents during runtime
30
23
31
24
> [!NOTE]
32
-
> Real-time protection during agent runtime currently supports only AI agents created with Microsoft Copilot Studio custom agents.
33
-
34
-
35
-
## Prerequisites
36
-
37
-
Before enabling real-time agent protection during runtime, make sure:
38
-
39
-
- You have a valid Microsoft Defender for Cloud Apps license.
25
+
> - The onboarding process for real-time protection during agent runtime requires configuration in Power Platform and collaboration with other administrators.
26
+
> - If the Microsoft 365 connector isn’t properly connected, real-time agent protection during runtime continues to block suspicious activity on the AI agent, but alerts and incidents related to these actions won't appear in the Microsoft Defender portal.
40
27
41
-
- You have Security Administrator privileges in the Microsoft Defender portal.
42
-
43
-
44
-
> [!NOTE]
45
-
> The onboarding process for real-time protection during agent runtime involves configuration in Power Platform and collaboration with other administrators.
46
-
>
47
-
> [!IMPORTANT]
48
-
> This feature is currently in preview and included with your Microsoft Defender for Cloud Apps license at no extra cost. Licensing requirements might change when the feature becomes generally available. If that happens, the feature will be disabled, and you'll be notified should you wish to re-enable it under the new license.
49
-
50
-
## Turn on real-time protection during agent runtime
51
-
52
-
The following steps describe the Security Administrator’s required actions to enable real-time protection during agent runtime.
53
-
54
-
1.**Sign in to the [Microsoft Defender portal](https://security.microsoft.com)**:
28
+
1. Sign in to the **[Microsoft Defender portal](https://security.microsoft.com)**:
55
29
1. Navigate to **System > Settings > Cloud Apps > Copilot Studio AI Agents**.
56
30
1. Check the Microsoft 365 App Connector status:
57
31
-**If the connector is already connected:** Continue to step 5.
58
32
-**If the connector isn’t connected:**
59
33
- Under **Microsoft 365 connector**, select **Connect** or **Edit**.
60
34
- Select **Microsoft Entra ID Management events** and **Microsoft 365 activities**.
61
35
- Select **Connect Microsoft 365**.
36
+
1. Work together with a Power Platform administrator to and Enter the App ID provided by your Power Platform administrator and select **Save**.
37
+
38
+
:::image type="content" source="media/protect-ai-agents/turn-on-real-time-agent-protection.png" alt-text="Screenshot that shows how to turn on Real time agent protection during runtime in the Defender portal." lightbox="media/protect-ai-agents/turn-on-real-time-agent-protection.png":::
62
39
63
-
> [!IMPORTANT]
64
-
> If the Microsoft 365 connector isn’t properly connected, real-time agent protection during runtime continues to block suspicious activity on the AI agent. Alerts and incidents related to these actions won't show in the Microsoft Defender portal.
65
-
66
-
1. Enter the App ID provided by your Power Platform administrator and select **Save**.
67
-
:::image type="content" source="media/protect-agents-real-time/turn-on-real-time-agent-protection.png" alt-text="Screenshot that shows how to turn on Real time agent protection during runtime in the Defender portal." lightbox="media/protect-agents-real-time/turn-on-real-time-agent-protection.png":::
68
-
69
-
> [!IMPORTANT]
70
-
> - Completing the onboarding process requires collaboration with a Power Platform administrator. The onboarding instructions on the Power Platform side are specified here: [Enable external threat detection and protection for Copilot Studio custom agents](/microsoft-copilot-studio/external-security-provider#step-2-configure-the-threat-detection-system).
71
-
> - The application ID that the Power Platform administrator needs to provide is this [Microsoft Entra ID application](/microsoft-copilot-studio/external-security-provider#step-1-configure-microsoft-entra-application).
72
-
> - To allow the Power Platform administrator to complete the onboarding steps, share the URL provided in the Defender portal with them.
73
-
74
-
1. No further action is needed on your part. Once the Power Platform administrator completes the onboarding steps on their side, you’ll see a green **Connected** status.
40
+
1. Work together with a Power Platform administrator to complete these onboarding steps: [Enable external threat detection and protection for Copilot Studio custom agents](/microsoft-copilot-studio/external-security-provider#step-2-configure-the-threat-detection-system).
41
+
- The Power Platform administrator must use the same App ID as the App ID used in [Microsoft Entra ID application](/microsoft-copilot-studio/external-security-provider#step-1-configure-microsoft-entra-application).
42
+
- Share the URL provided in the Defender portal with the Power Platform administrator to help them complete the onboarding steps.
75
43
44
+
Once the Power Platform administrator completes the onboarding steps, a green **Connected** status appears in the **Microsoft 365 connector** section.
0 commit comments