Microsoft’s layered answer to AI sprawl puts agents, data and identity under scrutiny

As employees and developers deploy AI across the enterprise, Microsoft is combining app discovery, data protection and agent identity controls to expose hidden usage and limit the risks.

Artificial intelligence is moving into the enterprise faster than many security teams can document it. Employees are using Microsoft 365 Copilot alongside public chatbots such as ChatGPT, Claude and Gemini to draft text, summarise documents and analyse information, while organisations are also building their own AI agents through Microsoft Copilot Studio, Microsoft Foundry and other platforms. The problem is no longer whether AI is present, but whether the business can see what is being used, what it can reach and where sensitive data may already be flowing.

Microsoft’s answer is not a single product but a layered security approach. Its documentation positions Defender for Cloud Apps as a way to discover SaaS services and monitor cloud app risk, while Microsoft Purview focuses on data security and compliance controls for generative AI, including Data Security Posture Management and AI-related observability. In practice, that means security teams need to combine application discovery, data protection and identity governance rather than treat AI as a separate silo.

That distinction matters because different AI risks call for different controls. Discovering shadow AI is not the same as inventorying autonomous agents or assessing cloud AI workloads. A staff member using an unapproved AI website, a finance team deploying an internal agent and a developer publishing an exposed AI workload all create different exposure patterns. Microsoft’s own guidance suggests that organisations should track the application, the agent and the underlying infrastructure separately, rather than assuming one tool will provide complete visibility across every environment.

Purview’s newer AI observability capabilities are designed to help with the data side of that picture. Microsoft says the experience can surface supported AI applications and agents, highlight high-risk entities and identify potentially sensitive interactions over a rolling 30-day window. The emphasis is on understanding not just where AI is present, but how it is interacting with enterprise information. For organisations already concerned about oversharing or exfiltration, that is a useful step beyond simple inventory.

For shadow AI, Defender for Cloud Apps remains the most practical starting point. Microsoft’s documentation says its cloud discovery features analyse traffic telemetry to identify the SaaS applications employees are actually using, including generative AI services. That allows security teams to review usage, user groups, device context and app risk, then decide whether a service should be sanctioned, monitored, restricted or blocked. The limitation is that discovery depends on supported telemetry sources, so visibility will vary with the organisation’s endpoint and network setup.

As AI agents become more common, Microsoft has also introduced a stronger governance story around identity and ownership. Microsoft Agent 365 is intended to centralise inventory and administration for supported enterprise agents, while Microsoft Entra Agent ID provides the identity layer needed to apply least-privilege principles to agent access. According to Microsoft’s documentation, that separation is important because an agent that has broad access to SharePoint, customer records or internal systems can do far more damage, whether through misconfiguration or compromise, than a conventional chatbot ever could.

The infrastructure layer matters too. Defender for Cloud continues to provide AI workload posture management for supported cloud deployments, including discovery of components, configuration risk analysis and attack-path assessment. Microsoft’s guidance also makes clear that some agent-level capabilities moved to Agent 365 licensing in July 2026, so organisations need to check where visibility now sits and which entitlements apply. In other words, assessing AI security is not just a question of policy design; it is also a licensing and architecture exercise.

At the protection layer, Purview’s browser and endpoint controls are meant to reduce the chance that sensitive data is pasted into unapproved AI services. Microsoft says Browser Data Security can integrate with supported Edge scenarios to detect sensitive information in browser-based AI interactions, while Endpoint DLP can extend controls to managed devices, including supported Chrome-based workflows. The sensible operating model is to start with audit, test carefully for false positives, then move to warnings and blocking only once the organisation understands how employees actually work. The broader lesson is that AI governance cannot be a one-off project: it has to evolve as tools, identities, permissions and workloads change.

Source Reference Map

Inspired by headline at: ^[1]

Sources by paragraph:

• Paragraph 1: ^[2], ^[3], ^[4], ^[5]
• Paragraph 2: ^[2], ^[3], ^[5]
• Paragraph 3: ^[2], ^[3], ^[4], ^[5]
• Paragraph 4: ^[5]
• Paragraph 5: ^[2], ^[3], ^[4]
• Paragraph 6: ^[5], ^[6]
• Paragraph 7: ^[5], ^[7]

Source: Fuse Wire Services