Agent 365 | Security Operations in Defender

Surface every AI agent in your tenant and expose the ones throwing security signals — across both the IT and SOC view. Triage high-severity alerts as IT in the Microsoft 365 admin center, then pivot into the full incident graph as a SOC analyst in Microsoft Defender. Block malicious tool invocations the instant they fire and catch jailbreak attempts on Copilot Studio agents before they take hold.

Trace a compromised user back to suspicious agent activity, then trigger Microsoft Entra conditional access to revoke the session and force a password reset straight from the incident. Hunt overpermissioned agents with pre-built advanced hunting templates — including one that exposes every agent running MCP tools on the maker's standing credentials — and pull risky builds from the Agent Store using the Agent Registry.

Spencer Berg, AI & Security Product Manager, shares how to turn agent risk signals into coordinated remediation across Defender, Entra, and the Microsoft 365 admin center.

► QUICK LINKS:

00:00 - Stay in control with Agent 365

00:40 - Gain visibility with unified control plane

01:48 - Unified IT & SOC agent view

02:54 - Real-time blocking and jailbreak detection

04:08 - Auto-revoke via Entra conditional access

04:32 - Prevent future incidents

05:28 - Advanced hunting for AI agents

06:43 - Block risky agents

07:15 - Wrap up

► Link References

Check out https://aka.ms/Agent365SecOps

► Unfamiliar with Microsoft Mechanics?

As Microsoft's official video series for IT, you can watch and share valuable content and demos of current and upcoming tech from the people who build it at Microsoft.

• Subscribe to our YouTube: https://www.youtube.com/c/MicrosoftMechanicsSeries

• Talk with other IT Pros, join us on the Microsoft Tech Community: https://techcommunity.microsoft.com/t5/microsoft-mechanics-blog/bg-p/MicrosoftMechanicsBlog

• Watch or listen from anywhere, subscribe to our podcast: https://microsoftmechanics.libsyn.com/podcast

► Keep getting this insider knowledge, join us on social:

• Follow us on Twitter: https://twitter.com/MSFTMechanics

• Share knowledge on LinkedIn: https://www.linkedin.com/company/microsoft-mechanics/

• Enjoy us on Instagram: https://www.instagram.com/msftmechanics/

• Loosen up with us on TikTok: https://www.tiktok.com/@msftmechanics

Denne episoden er hentet fra en åpen RSS-feed og er ikke publisert av Podme. Den kan derfor inneholde annonser.

Episoder(100)

Windows 365: Five Years In, See What's New

An AI agent works inside your Windows 365 Cloud PC from a Teams chat on your phone — finding downloaded files, editing documents, and drafting emails with your laptop lid closed. Microsoft Scout, a ne...

21 Aug 15min

Build your first Power App from data in seconds

Build a fully working model-driven app from your existing Dataverse, SharePoint, or SQL data in under a minute — screens, navigation, and forms included. Generate new pages from a natural language pro...

16 Jul 7min

Microsoft Entra Suite hands-on tour of identity and network access protections

Unify identity and network access controls. Enforce least privilege access across every app and resource. Wire lifecycle workflows directly to your HR system to strip stale permissions on role changes...

15 Jul 9min

New agentic platform in Dynamics 365 for Sales and Service

Qualify a lead, close a case, or walk into a renewal meeting fully briefed, all from the sales and service agents built into Dynamics 365. Ask a question and pull a grounded answer straight from your ...

14 Jul 10min

Tokenomics | The new AI currency & your options explained

Control what you're billed on. Tokens are the currency of AI, and how you design your app determines how many you spend. Compress conversation history instead of resending it raw, cap output tokens wi...

9 Jul 14min

Deploy Windows updates to counter AI-discovered threats

The speed that AI can now discover and exploit vulnerabilities means that our defenses also need to adjust. For the devices that you manage where you can afford to tighten deployment timelines, we'll ...

7 Jul 3min

Zero Trust security for AI agents

Apply Zero Trust controls to every AI agent in your environment across identity, tool usage, and data access. Extend Conditional Access in Microsoft Entra to evaluate every agent authorization request...

2 Jul 10min

Secure containers from code to runtime | Microsoft Defender

Secure containerized apps end-to-end using Microsoft Defender for Cloud. Correlate cross-cloud attacks into a single incident, catch runtime threats that image scanning misses, and block vulnerable im...

29 Jun 9min