AB-650 Step by step · Lab 15

Secure and Govern AI Agents in Microsoft 365

Monitor agents with the agent map and advanced hunting, protect data with DSPM for AI, measure compliance, block risky sites with Secure Access.

8 November 2026 · 5 min read

Microsoft 365 admin center agent map: 366 agents clustered by platform — Watch the lesson: Lab 15: Secure and govern agents | AB-650 Microsoft 365 Step By Step

Once agents are in place, four questions follow: what are they doing, can they reach sensitive data, are we compliant, and where on the web can they go? In Lab 15 of the AB-650 course, Pragati Industries answers all four with tools already included in its licences and trials. Nothing here is billed.

Step 1: What are our agents doing?

Microsoft 365 admin center → Agents → Agent map shows every agent, clustered by platform: in our tenant 366 of them, third-party agents, Microsoft’s own, and six built in Copilot Studio. Filters narrow it by status, publisher, platform, channel or usage, and cards show agents at risk, without owners, or unmanaged.

Agent map with total agents, agents at risk, agents without owners and unmanaged agents — The agent map: every agent in one view, with the risk cards on the left.

For detail, Microsoft Defender → Advanced hunting has an Agents section in the schema, with the AgentsInfo table. One query counts agents by platform.

Advanced hunting query summarizing AgentsInfo by platform with results — KQL over AgentsInfo: the same inventory, ready for detection rules.

Step 2: Keep sensitive data away from agents

Purview → DSPM for AI gives recommendations made for Copilot and agents: protect items from Microsoft 365 Copilot and agent processing, and protect sensitive data referenced in Copilot and agent responses.

DSPM for AI recommendations list for Copilot and agents — DSPM for AI recommendations. Pragati already did the two key ones in Lab 10: DLP and encrypting labels.

Step 3: Are we compliant?

Compliance Manager builds a compliance score from improvement actions. Under Regulations, premium AI templates include the NIST AI Risk Management Framework, ISO/IEC 42001, ISO/IEC 23894 and the EU AI Act. Each becomes an assessment.

Compliance Manager regulations: premium AI templates such as NIST AI RMF, ISO 42001 and the EU AI Act — Premium AI templates use regulation licences; spend one when the AI programme is audited.

Step 4: Control where agents can go

Agents call websites and APIs. Entra → Global Secure Access → Web content filtering policies → Create policy: name Agents Block Risky, action block, and a rule for risky categories: hacking, cryptocurrency mining, and web repositories and storage, where an agent could paste company data.

Web content filtering policy rule blocking hacking, cryptocurrency mining and web repository categories — A policy only applies once it is linked to a security profile and the traffic reaches Global Secure Access.

How you know it worked

The agent map and hunting query agree on the inventory; DSPM shows the Copilot and agent protections in place; Compliance Manager shows the score and the open actions; and the web filtering policy is ready to link to a profile.

What a tech lead should take away

Inventory first. You cannot govern agents you cannot see.
Data protection for agents is the same as for Copilot: labels and DLP.
Give every agent an owner, and treat “agents without owners” as an incident, not a statistic.

Do it yourself

Lab guides, practice and full mock exams come with a subscription. See the plans