How to secure AI agents connected to Microsoft 365

By Michael Obraitis, Managing Partner, and Michael Dale, CEO · Published August 28, 2026 · Last reviewed August 2026 · ADAM Pulse Knowledge Base

Short answer

Treat every AI agent that can read or write Microsoft 365 as a principal in Entra, not as a feature toggle. Give it a unique identity, a named owner, an allowlist of tools, and a revoke path that invalidates tokens. Review OAuth grants the same way you review standing mailbox access. Use Microsoft’s Shadow AI admin-center page if you have the license — and do not treat it as the inventory. Use Purview DLP for Copilot where it exists, and read the documented limits before you brief the board that “DLP covers AI.”

This is the Microsoft 365 cut of AI agent security for business. It is risk management, not a CMMC Level 2 or FedRAMP certificate. Menu names and SKUs change; the Learn pages in the references control.

Entra identity: agents as principals

Microsoft documents agent identities as a distinct construct in Entra: a special service principal created from an agent identity blueprint, used so an agent can request tokens, receive tokens, or act on behalf of a signed-in user with the agent as actor. Agent identities do not carry their own passwords; the blueprint holds credentials. That is the opposite of a shared mailbox and the opposite of “run as whoever clicked Copilot.”

Microsoft 365 Copilot prompts still run in the security context of the user who initiated the prompt (Purview DLP Learn page). That is a different principal from an autonomous agent with tools. Do not collapse them:

• User-initiated Copilot — sees what that user can already see, plus whatever DLP/labels exclude. Identity is the user.
• Agent with tools — needs its own identity, owner, and allowlist before it can send, write, pay or delete. Identity is the agent.

Least privilege for AI agents names the failure modes: identity ambiguity, permission creep, over-broad tool access, weak audit trails, and slow revocation. The metric Microsoft cares about for the last one is mean time to revoke or disable the agent identity, including token invalidation.

Do not mix the two Microsoft surfaces. Entra Agent ID is generally available as the identity foundation (authenticate, Conditional Access, owners/sponsors). Microsoft Agent 365 is the unified registry in the Microsoft 365 admin center (Agents > All agents): discover and manage Microsoft and non-Microsoft agents, including agents that do not yet have an Entra Agent ID. The Entra admin center still manages identities for agents that have Agent ID. Viewing the All-agents inventory needs a role such as AI Reader; applying Conditional Access still needs Entra Agent ID licensing. Menu names change; those Learn pages control.

Least privilege in the tenant

Do this in the platform, not in a Copilot instruction file.

1. Unique identity, named owner/sponsor and approver, documented purpose and tool list.
2. Task-scoped roles. Separate read (retrieve, summarize) from write (create ticket, send mail, update a record).
3. Deny unreviewed tools, plugins, and cross-tenant paths by default.
4. Re-validate authorization at every hop: orchestrator → tool → Exchange / SharePoint / Graph. Do not rely on the orchestrator alone.
5. Time-bound elevation (PIM or equivalent) for destructive actions. Standing tenant-wide roles are how pilots become production accidents.

The general argument, including OWASP MCP examples, is AI agent permissions and least privilege explained.

Shadow agents: one feed, not the inventory

As of this August 2026 review, Microsoft documents Shadow AI in the Microsoft 365 admin center as a Frontier preview. Prerequisites Microsoft lists include opting into Frontier, Microsoft Defender for Endpoint for local-agent detection, Microsoft 365 E5 to view Shadow AI agents, Intune enrollment for managed Windows, and (for traffic metadata) Global Secure Access. Blocking currently applies to managed Windows devices enrolled in Intune. Microsoft’s published table shows detection for several desktop agents (including ChatGPT Desktop, Claude Desktop, Ollama Desktop) and blocking available for OpenClaw.

Use it if you have the license. Do not treat it as a complete Shadow AI inventory. It does not see a personal ChatGPT tab on a phone, a contractor’s home PC, or a meeting bot that only exists as an OAuth grant. How to find those: What is Shadow AI and how do you find it?

Microsoft’s Cloud Adoption Framework also names shadow AI proliferation and unused (dormant) agents as operational risks when you manage agents across the organization. Dormant is an inventory state: named owner, last-used date, disable if nobody will claim it.

OAuth grants are identity events

Meeting bots, calendar assistants, and “summarize my inbox” apps rarely show up as a blocked domain. They show up as consent. In Entra:

• User consent settings — Identity > Applications > Enterprise apps > Consent and permissions > User consent settings. Restrict who can grant what. Microsoft documents options that limit user consent to verified publishers and low-impact permissions.
• Admin consent workflow — so a denied user consent becomes a ticket, not a personal workaround on a phone.
• Regular review of enterprise applications and OAuth grants. Microsoft’s illicit-consent guidance tells you to search the audit log for Consent to application and to treat unexpected admin consent as an incident indicator.

Revoke anything with no named owner. A bot that joined ten calendars last night is an identity event, not an IT anecdote. Put new high-privilege grants on the same change path as a new vendor.

Purview and DLP, as available

Microsoft Purview DLP has a dedicated location: Microsoft 365 Copilot and Copilot Chat (Learn page dated 2026). Documented capabilities, with licensing and roles on that page:

• Restrict Copilot from using external web search when the prompt contains configured sensitive information types (SITs). Copilot can still answer from internal Microsoft 365 sources.
• Restrict Copilot from processing the prompt at all when it contains those SITs (preview / rolling out — check the tenant).
• Exclude files and emails that carry chosen sensitivity labels from grounding. Citations may still appear; the content is not used.
• Exclude external email from grounding (preview), evaluating sender domain against accepted domains — an injection-path control, not a body scan.

Limits you should say out loud:

• Selecting the Copilot location disables other locations in that same policy.
• You cannot combine SIT and sensitivity-label conditions in the same rule (separate rules in the same policy are allowed).
• DLP cannot scan the contents of files uploaded directly into a prompt. It checks the typed prompt text.
• Policy updates can take up to four hours to show in Copilot.
• This location does not cover consumer Copilot, ChatGPT, or a personal Mac.

Labels and DLP catch a lot of well-intentioned desktop use. They are not the program. Classification, approved-tool lists, and discovery still sit underneath. This article does not use health-record examples; if you are a covered entity, your existing privacy program owns that mapping.

A sequence that survives contact with a real tenant

1. Inventory Copilot SKUs, Agent 365 (All agents), Entra Agent ID principals, and OAuth grants. Write them on the living list: enterprise AI inventory. All agents is the registry; Agent ID is the identity. Neither is the OAuth-grant list.
2. Restrict user consent. Stand up admin consent. Revoke orphans.
3. Turn on the Copilot DLP location for the data classes you already use, inside the documented limits.
4. If licensed, open Shadow AI (Frontier) and treat it as one feed.
5. Do not grant an agent send/write until it has a unique identity, an allowlist, HITL in the orchestrator, tool-call logs, and a tested revoke including tokens.

Frequently asked questions

Related articles

• AI agent security for business: 12 safeguards — the pillar this page sits under.
• AI agent permissions and least privilege explained — OWASP and read-before-write, including MCP.
• What is Shadow AI and how do you find it? — the methods Microsoft’s admin-center page does not replace.
• AI security checklist for businesses: 40 controls — identity and monitoring groups this tenant work maps to.

References

Microsoft Learn pages were checked in August 2026. Preview features and SKUs change; the live Learn page controls.

1. Microsoft Learn — Agent identities— Entra Agent ID as a first-class principal; blueprint-held credentials.
2. Microsoft Learn — What’s new in Microsoft Entra Agent ID (dated 1 May 2026)— Agent ID generally available; registry experiences converging under Agent 365.
3. Microsoft Learn — Agent Registry convergence with Microsoft Agent 365— All agents in the Microsoft 365 admin center versus identity management in Entra.
4. Microsoft Learn — Least privilege for AI agents (updated 14 July 2026)— identity, scope, tool allowlists, audit fields, kill-switch metric.
5. Microsoft Learn — Shadow AI in the Microsoft 365 admin center (updated 25 August 2026)— Frontier preview; E5; Intune; Defender for Endpoint; blocking limits.
6. Microsoft Learn — Manage AI agents across your organization— shadow AI proliferation and unused agents as operational risks.
7. Microsoft Learn — Configure user consent settings— Entra user-consent options.
8. Microsoft Learn — Detect and remediate illicit consent grants— audit-log activity “Consent to application.”
9. Microsoft Learn — Purview DLP for Microsoft 365 Copilot and Copilot Chat— location capabilities and limits, including uploaded files not scanned.