Copilot Studio Agents Inventory Security Posture
In my previous blogpost we talked about Microsoft Copilot Studio, how AI Agents can be created as AI Assistants for specialized tasks like managing the mailbox of the user and about the risks (e.g., [in]direct prompt injection) and mitigations on how Microsoft Defender for Cloud Apps provides real-time protection during runtime (malicious behavior blocks tool usage like Send Mail for example).
AI Agent Inventory
AI Agent Inventory is the proactive approach to AI Agent Security Posture which provides insights into Security related information of the Copilot Studio AI Agents in the Microsoft Tenant.
For this Microsoft Defender for Cloud Apps (Preview) feature, we need Preview features enabled in the Microsoft Defender XDR settings.
Greyed out means the Tenant is onboarded in the Microsoft Management Customer Connection Program (aka Private Preview Program).
Enable AI Agent Inventory
Go to the Microsoft Defender Portal, go to Settings -> Cloud Apps -> AI Agents -> Copilot Studio for AI Agents we see the configuration screen.
The Microsoft 365 App Connector is required with the following Microsoft 365 components connected:
- Microsoft Entra ID Management events
- Microsoft 365 activities
To enable the AI Agents Inventory we need a Power Platform Admin (shown on the right side).
The Power Platform Admin needs to logon to the Power Platform Admin Center
Enable Microsoft Defender — Copilot Studio AI Agents in the Power Platform Admin Center -> Security -> Threat Detection -> Microsoft Defender — Copilot Studio AI Agents
Verify in Microsoft Defender for Cloud Apps -> AI Agents -> Copilot Studio AI Agents that the AI Agent Inventory is connected.
DISCLAIMER: Data population of the AI Agent Inventory security posture data takes 2 hours for the average tenant size up to a day. You can verify the status by querying the AIAgentsInfo table.
The AI Agents Inventory provides insights in the Security Posture for the Copilot Studio AI Agents.
Advanced Hunting
In the Schema for Apps & identities, a new table is created called AIAgentsInfo.
AIAgentsInfo
| summarize arg_max(Timestamp, *) by AIAgentIdExample of table AIAgentsInfo and columns.
With the new AIAgentsInfo table information, we can see security-related information of the agents. I will discuss some examples, but you can create your own KQL queries based on the risk and information available.
UserAuthenticationType
UserAuthenticationType is the authentication value for the Agent. The default value is ‘Integrated’ (security in the context of the user).
But if you set the authentication to ‘No Authentication’, the agent can be used by anyone who has access to Teams.
AIAgentsInfo
| summarize arg_max(Timestamp, *) by AIAgentId
| where UserAuthenticationType == "None"
| project AgentCreationTime ,AIAgentId, AIAgentName, AgentStatus, CreatorAccountUpn, OwnerAccountUpnsExample of no authentication via Advanced Hunting in Microsoft Defender.
From here we can write an Analytics query that checks if the value is changed from authenticated to no authentication and create an Incident.
// Query to detect when UserAuthenticationType changes to "None"
AIAgentsInfo
| summarize arg_max(Timestamp, *) by AIAgentId
| where AgentStatus == "Published"
| order by AIAgentName
| extend PreviousAuthType = prev(UserAuthenticationType, 1)
| where UserAuthenticationType == "None" and PreviousAuthType != "None"
| project AIAgentName, PreviousAuthType, UserAuthenticationType, ReportId = tostring(AIAgentId), TimestampDISCLAIMER: By design, users can change the value of other agents where they are not the owner.
Pro tip: In the Community queries, there is a section called AI Agents, which contains multiple queries created initially by the Microsoft Product Group.
AI Agent UI
Microsoft Copilot Studio Agents are registered and visible in
- Microsoft 365 — Agents
- Microsoft Entra — Agent ID
- Microsoft Purview — DSPM for AI provides an overview and insights into Data Security for Agents.
The new AI Agents assets are visible in the Defender portal in the Assets section. The view provides an overview of agents and related Security Posture information like Security Recommendations and Attack Paths.
I hope this blog gives guidelines on Security Posture for AI Agents created in Microsoft Defender for Cloud Apps.
