How to discover Shadow AI, monitor AI agents, assess AI workloads, and protect sensitive enterprise data
Introduction
Artificial intelligence is transforming how organizations operate. Employees use Microsoft 365 Copilot, ChatGPT, Claude, Gemini, and other AI assistants to summarize documents, analyze information, and automate everyday tasks.
At the same time, organizations are deploying AI agents using Microsoft Copilot Studio, Microsoft Foundry, and third-party platforms.
But this rapid adoption introduces a fundamental security challenge:
How can you protect enterprise data when you don’t know which AI applications are being used, which agents have access to sensitive information, or where AI workloads are deployed?
Consider these scenarios:
- An employee uploads a confidential financial report to an unauthorized AI website.
- A department creates an AI agent without notifying the security team.
- An AI agent receives excessive permissions to SharePoint sites.
- A developer deploys an AI application with an exposed cloud endpoint.
- Microsoft 365 Copilot is enabled before the organization addresses existing data oversharing risks.
Traditional security controls remain important, but organizations also need visibility into AI-specific activities and risks.
This is where Microsoft’s security ecosystem comes into play.
In this article, we’ll explore how Microsoft Purview, Microsoft Defender, Microsoft Agent 365, and Microsoft Entra work together to help organizations discover, observe, protect, and govern AI.
1. Understanding AI Discovery: Three Different Security Challenges
Before implementing AI security controls, it’s important to understand what needs to be discovered.
Shadow AI — Discovering AI applications
Shadow AI refers to AI tools used without appropriate organizational approval or oversight.
Examples include employees accessing ChatGPT, Claude, Gemini, or other generative AI services using corporate devices.
The security challenge is understanding which applications are used, by whom, and whether sensitive business information is being shared.
AI agents — Discovering autonomous capabilities
AI agents can perform tasks, retrieve enterprise information, and interact with applications.
Unlike traditional chatbots, some agents can execute multi-step workflows and perform actions using delegated or application permissions.
Security teams therefore need to understand agent ownership, identities, access rights, activities, and security posture.
AI workloads — Discovering deployed AI infrastructure
Organizations also build their own AI applications using cloud services.
These may involve Microsoft Foundry, Azure OpenAI, Azure Machine Learning, Amazon Bedrock, or Google Vertex AI.
Security teams must assess the underlying infrastructure, identities, dependencies, configurations, and exposure risks.
Key takeaway: Discovering an AI website, identifying an AI agent, and assessing a cloud AI workload are different security requirements.
No single Microsoft security tool provides complete coverage across every AI environment.
2. Microsoft AI Security Discovery Tools
Microsoft offers several complementary solutions.
| Microsoft solution | Primary security capability |
|---|---|
| Microsoft Purview DSPM | AI data security posture and sensitive data risk |
| Purview AI Observability | AI application and agent activity insights |
| Defender for Cloud Apps | Shadow AI and SaaS application discovery |
| Microsoft Agent 365 | AI agent inventory and governance |
| Microsoft Entra Agent ID | AI agent identity and access governance |
| Defender for Cloud | AI workload security posture |
| Purview Browser Data Security | Sensitive data protection in supported AI browser interactions |
| Purview Endpoint DLP | Sensitive data monitoring and protection on managed endpoints |
| Microsoft Sentinel | Centralized security analytics using connected telemetry |
The objective is to combine these capabilities into a coherent AI security architecture.
3. Microsoft Purview DSPM: Understanding AI Data Security Risks
Microsoft Purview Data Security Posture Management (DSPM) focuses on discovering, assessing, and reducing risks associated with sensitive enterprise information.
Instead of concentrating primarily on infrastructure, DSPM examines the data itself.
It helps answer four important questions:
- What sensitive information does the organization have?
- Where is it stored?
- Who or what can access it?
- How is that information protected?
The newer DSPM experience extends these capabilities to supported AI applications and agents.
AI Observability
AI Observability provides a dedicated view of supported AI applications and agents with activity during the previous 30 days.
It can surface information such as:
- AI applications and agents with observed activity.
- High-risk AI entities.
- Sensitive AI interactions.
- Potential oversharing and exfiltration risks.
- Policies associated with supported agents.
This helps security teams move from simple AI discovery toward understanding how AI interacts with enterprise data.
Practical scenario
Imagine an organization where employees use Microsoft 365 Copilot and several external AI applications.
The security team wants to identify whether sensitive information is being exposed through these interactions.
Using Purview DSPM, administrators can investigate supported AI activities, review data security risks, and prioritize protection policies.
Getting started
- Open Microsoft Purview at https://purview.microsoft.com.
- Navigate to Data Security Posture Management.
- Open AI observability.
- Review the available AI application and agent inventory.
- Investigate sensitive interactions and recommended actions.
The newer DSPM experience and DSPM for AI (classic) have different interfaces and feature coverage. Organizations should verify which experience is available in their tenant.
Microsoft Learn: Learn about Data Security Posture Management
4. Microsoft Defender for Cloud Apps: Discovering Shadow AI
Microsoft Defender for Cloud Apps helps organizations discover cloud applications, including generative AI services.
Its Cloud Discovery capabilities analyze supported traffic telemetry to identify applications being accessed by users.
This is particularly useful for understanding Shadow AI adoption.
What can administrators investigate?
- Discovered generative AI applications.
- Application usage patterns.
- Associated users and devices.
- Application risk assessments.
- Sanctioned and unsanctioned applications.
Practical scenario
An organization officially supports Microsoft 365 Copilot but discovers that employees are also using external generative AI applications.
The security team can assess those applications and determine whether they should be approved, monitored, restricted, or blocked.
Not every unapproved AI application is necessarily malicious. Decisions should consider business requirements, privacy, contractual obligations, and security posture.
Getting started
- Open https://security.microsoft.com.
- Navigate to Cloud apps → Cloud discovery.
- Select Discovered apps.
- Filter for generative AI applications.
- Review usage, risk, and governance options.
Important prerequisite: Cloud Discovery requires supported traffic telemetry, such as configured log sources or applicable endpoint integrations. Discovery and enforcement coverage depend on the deployment architecture.
5. Microsoft Agent 365: Centralized AI Agent Governance
As AI agents become more common, organizations need an inventory that extends beyond traditional applications.
Microsoft Agent 365 provides management and governance capabilities for supported enterprise AI agents.
Its agent registry helps administrators identify agents and establish accountability.
Why does agent inventory matter?
Consider an organization with AI agents supporting HR, finance, IT operations, and customer service.
Without governance, some agents may have:
- No clearly assigned owner.
- Unnecessary access to sensitive information.
- Inadequate lifecycle management.
- Insufficient security monitoring.
Agent 365 helps establish a central management approach for supported agents.
Getting started
Open the Microsoft 365 admin center and navigate to the available agent management experience, including Agents → All agents where supported.
Review agent ownership, inventory information, and management status.
Important licensing change — July 2026
Effective July 1, 2026, Microsoft requires eligible Agent 365 licensing for specified security capabilities involving Copilot Studio and Microsoft Foundry agents that were previously covered by Defender for Cloud Apps or Defender for Cloud.
These include certain agent discovery, security posture, and threat protection capabilities.
Agent 365 purchasing also has prerequisite licensing requirements. These must be evaluated separately from the licenses required for Microsoft Purview or Defender.
Microsoft Learn: Transition agent security capabilities to Agent 365
6. Microsoft Entra Agent ID: Securing AI Agent Identities
AI agents often need identities to access enterprise resources.
Microsoft Entra Agent ID provides an identity foundation for supported AI agents.
From a security architecture perspective, agent identities should follow the same fundamental Zero Trust principles applied to human and workload identities.
These include:
- Explicit authentication and authorization.
- Least-privilege permissions.
- Appropriate lifecycle management.
- Identity ownership and accountability.
- Monitoring of access and suspicious behavior.
Practical scenario
An AI agent retrieves documents from SharePoint to answer employee questions.
The agent should only have access to the information required for its business purpose.
Granting unnecessary tenant-wide permissions could increase the impact of a compromised or misconfigured agent.
Agent identity discovery and permission reviews help reduce this risk.
Microsoft Learn: Discover AI apps and data
7. Microsoft Defender for Cloud: Discovering AI Workloads
Organizations increasingly deploy custom AI applications across Azure and other cloud platforms.
Microsoft Defender for Cloud, particularly Defender Cloud Security Posture Management (CSPM), provides security posture capabilities for supported AI workloads.
These include:
- AI workload and component discovery.
- Generative AI Bill of Materials visibility.
- Security recommendations.
- Cloud configuration risk analysis.
- Attack path analysis.
- Assessment of exposed resources and dependencies.
Practical scenario
A development team deploys an AI application connected to an internal data repository.
The security team needs to assess the supporting cloud infrastructure, authentication, network exposure, and security configuration.
Defender for Cloud can help identify relevant risks and prioritize remediation.
Important distinction
Defender CSPM continues to provide supported AI workload discovery, including Microsoft Foundry accounts and projects.
However, specified agent-level discovery and security capabilities transitioned to Agent 365 licensing in July 2026.
Workload discovery and agent inventory should therefore be assessed separately.
Microsoft Learn: AI security posture management in Defender for Cloud
8. Microsoft Purview Browser Data Security
Discovering AI applications is only the beginning.
Organizations also need to understand whether sensitive information is being shared through browser-based AI interactions.
Microsoft Purview Browser Data Security provides capabilities to identify and protect sensitive information during supported browser interactions.
For supported scenarios, Purview can integrate directly with Microsoft Edge to detect sensitive information entered into AI applications.
Practical scenario
An employee opens an AI website and attempts to enter confidential customer information into a prompt.
A configured DLP policy may detect the sensitive information and apply an appropriate response.
Depending on the supported scenario and policy configuration, that response may involve auditing, warning, or blocking.
Implementation considerations
Before enabling enforcement, verify:
- Supported browsers and applications.
- Required Edge configuration policies.
- Licensing and permissions.
- Sensitive information types and classifiers.
- DLP policy conditions and supported actions.
- Audit and alerting capabilities.
Browser Data Security should be evaluated alongside Endpoint DLP rather than assumed to be identical to it.
Microsoft Learn: Data security for other AI apps
9. Microsoft Purview Endpoint DLP: Protecting Data Shared with AI
Endpoint Data Loss Prevention extends Microsoft Purview protection to supported activities on managed devices.
This becomes particularly relevant when employees interact with third-party AI websites.
Example
An organization uses three sensitivity labels:
| Sensitivity label | Example |
|---|---|
| Public | Approved public information |
| Internal | Internal operational documents |
| Confidential | Financial reports and customer information |
The security team wants to prevent employees from sharing confidential information with unapproved AI services.
A supported Endpoint DLP policy can help detect and restrict certain activities involving sensitive content.
Implementation workflow
Step 1 — Device onboarding
Onboard supported Windows devices to Microsoft Purview using an approved deployment method, such as Microsoft Intune.
Step 2 — Browser integration
Configure the required browser integration. For example, Chrome-based scenarios may require the Microsoft Purview browser extension.
Step 3 — Data classification
Configure sensitivity labels and relevant sensitive information types.
Step 4 — DLP policy design
Create policies targeting supported endpoint and browser activities.
Step 5 — Audit-first testing
Validate detection using test files and representative user activities before introducing blocking actions.
Step 6 — Enforcement
Gradually apply restrictive controls after evaluating false positives and business impact.
Step 7 — Monitoring
Review DLP events, alerts, and activity information to confirm that policies are operating as expected.
Endpoint DLP does not provide universal inspection of every AI interaction. Capabilities depend on device onboarding, browser support, policy configuration, licensing, and the activity being performed.
Microsoft Learn: Endpoint DLP policy scenarios
10. Licensing, Permissions, and Visibility Limitations
One of the most important considerations when designing AI security architecture is understanding the dependencies between solutions.
| Capability | Key dependencies to validate |
|---|---|
| Purview DSPM | Supported licensing, roles, region, data sources |
| AI Observability | Supported AI telemetry and applicable integrations |
| Defender for Cloud Apps | Licensing and configured discovery data sources |
| Agent 365 | Eligible Agent 365 license and prerequisite licenses |
| Entra Agent ID | Supported agent identity capabilities and access |
| Defender for Cloud | Appropriate cloud security plans and connected environments |
| Browser Data Security | Supported Edge configuration and DLP capabilities |
| Endpoint DLP | Supported licensing, device onboarding, browser integration |
A successful AI security assessment should document not only which capabilities are available but also where visibility is incomplete.
For example, detecting access to an AI website does not automatically mean the security team can inspect every prompt or uploaded document.
Similarly, an agent inventory may not contain every unmanaged or unsupported third-party agent.
11. Practical Enterprise AI Security Assessment
A structured assessment can be organized into seven phases.
| Phase | Activities | Primary tools |
|---|---|---|
| 1. Discover | Identify AI applications and Shadow AI | Defender for Cloud Apps |
| 2. Observe | Assess AI activities and sensitive data exposure | Purview DSPM |
| 3. Inventory | Identify agents, owners, and governance gaps | Agent 365 |
| 4. Assess identity | Review agent identities and permissions | Entra Agent ID |
| 5. Assess workloads | Review AI infrastructure security posture | Defender for Cloud |
| 6. Protect | Configure classification and DLP controls | Purview |
| 7. Monitor | Investigate activity and improve controls | Purview, Defender XDR, Sentinel |
This sequence is a recommended consulting methodology, not a mandatory Microsoft deployment order.
Organizations should adapt it based on their architecture, licensing, maturity, and business requirements.
12. Recommended Assessment Deliverables
An enterprise AI security assessment should produce actionable deliverables rather than only a collection of portal screenshots.
Recommended deliverables include:
- AI Application Inventory: Discovered AI applications, usage, ownership, and risk.
- AI Agent Inventory: Supported agents, owners, identities, and governance status.
- AI Workload Assessment: Cloud resources, configuration risks, and exposure.
- Sensitive Data Risk Assessment: Classification coverage, oversharing risks, and AI-related data interactions.
- Licensing and Permissions Matrix: Required capabilities, prerequisites, and access.
- Security Gap Analysis: Existing controls compared with target requirements.
- AI Security Architecture: Recommended integration of Microsoft security solutions.
- Implementation Roadmap: Prioritized remediation activities and deployment phases.
Each finding should include evidence, business impact, remediation guidance, and a clearly assigned owner.
13. Common AI Security Mistakes
Assuming Microsoft 365 Copilot is the only AI tool employees use
External generative AI services may already be used throughout the organization.
Assuming discovery means complete visibility
Identifying an AI application does not necessarily reveal every interaction or the sensitive information shared with it.
Ignoring agent identities
Agents can introduce significant access risks when permissions are broader than required.
Deploying DLP without testing
Blocking policies should be validated in a controlled pilot before broad enforcement.
Treating AI governance as a one-time assessment
AI applications, agents, identities, and workloads evolve continuously.
Security teams need an ongoing discovery and monitoring process.
14. Conclusion: Discover, Observe, Protect, and Govern AI
Enterprise AI security starts with visibility.
Organizations need to understand which AI applications employees use, which agents operate in their environment, which cloud AI workloads are deployed, and how sensitive information interacts with those systems.
Microsoft provides complementary capabilities across its security ecosystem:
Discover AI applications, agents, and workloads using Defender for Cloud Apps, Agent 365, Entra Agent ID, and Defender for Cloud.
Observe AI-related data risks and supported interactions using Microsoft Purview DSPM and AI Observability.
Protect sensitive information using Microsoft Purview Information Protection, Browser Data Security, and Endpoint DLP.
Govern AI through ownership, least-privilege access, security policies, investigation, and continuous improvement.
The goal is not simply to identify AI tools.
It is to build a sustainable security architecture that enables organizations to adopt AI confidently while protecting enterprise information.
Discover what AI is being used. Understand what it can access. Protect the data it interacts with. Govern it continuously.
Official Microsoft Documentation
- Discover AI apps and data
- Microsoft Purview Data Security Posture Management
- DSPM deployment considerations
- Manage data security for AI agents
- Manage data security for other AI applications
- Transition agent security capabilities to Agent 365
- AI security posture management in Defender for Cloud
- Microsoft Purview Endpoint DLP scenarios
- Microsoft Security for AI
