Securing AI Adoption in the DIB-Part 2: Microsoft's Approach to Discovering & Securing AI

Part 2 of 3 | October 2026

By Michael Crane, Principal Cloud Solution Architect (Security); Kelly Lunghamer, Senior Solution Engineer (Security); Brooke Robinson, Security Specialist; and Sarah Vyzas, Security Specialist

In Part 1 of this series, we examined how AI is changing the risk landscape for the Defense Industrial Base (DIB). Those risks span three layers: how people use AI, the AI applications organizations build and deploy, and the platforms that host them. Agents add a new dimension, acting as non-human identities that hold credentials, access data, and take actions on behalf of users. Yet the most significant risks remain rooted in identity, access, data governance, monitoring, and lifecycle management. These are familiar problems, and they can be solved by extending Zero Trust. Part 2 describes Microsoft's approach to AI security and walks through the first two priorities, Discover & Observe and Secure, using capabilities available in GCC High today.

Microsoft's Approach

Microsoft's approach to AI security starts with a foundational principle: AI should inherit the security, identity, and data governance controls of the environment in which it operates. Rather than treating AI governance as a separate security program, Microsoft extended the same Zero Trust disciplines already used to govern users, applications, devices, workloads, and data.

That principle is easiest to illustrate where Microsoft has the most operational experience. Microsoft 365 Copilot was the first generative AI capability deployed internally at enterprise scale, so many of these practices were tested there first. However, the practices themselves are not Copilot-specific. They apply to any AI system reasoning over enterprise data or performing actions on behalf of users. This effort was led by Microsoft Digital, the company's IT organization, which developed and operationalized governance practices for enterprise-scale AI adoption.[1]

Microsoft Digital identified several governance practices that proved important for enterprise AI adoption:

• Establish executive sponsorship and clear governance ownership
• Enable self-service with appropriate guardrails
• Keep information protection labels simple and intuitive
• Review sharing defaults to reduce oversharing risk
• Govern collaboration containers (Teams, SharePoint, and Microsoft 365 groups)
• Use inheritance to scale protection automatically
• Train employees on responsible AI use
• Trust users, but verify outcomes through monitoring and automation
• Establish lifecycle management, ownership, and periodic attestation
• Continuously assess and remediate information exposure

Microsoft describes this as a “trust but verify” model, where users collaborate productively while policy, automation, and monitoring provide additional guardrails. Microsoft Digital applied this approach at enterprise scale by combining user accountability with automated governance controls. Rather than relying entirely on manual processes, protections were applied at the collaboration-space level where possible, inherited by content where appropriate, and reinforced through monitoring, policy enforcement, and periodic review.

Microsoft's experience also reinforces the importance of data classification and protection. AI systems can only make informed access decisions when the organization's data is governed, labeled, and appropriately protected. Sensitivity labels, information protection controls, DLP policies, and oversharing remediation therefore became important enablers of Microsoft's AI adoption because it allows existing access and governance controls to effectively operate at scale.

While this insight is impactful, most DIB organizations start from a very different place. Many DIB organizations are managing decades of legacy content, multiple classification schemes, and information estates that simply cannot be remediated overnight. Even aggressive labeling programs can take years to reach broad coverage. Full labeling coverage should not be treated as a prerequisite for progress. The practical approach is to prioritize risk: label the repositories that AI will reach first, apply container-level defaults so new content inherits protection automatically, and expand coverage on a schedule the organization can sustain. Partial classification applied to the right data enables AI safely; waiting for complete classification does not.

Governing AI is ultimately a balance, not a ceiling. Guardrails opened too wide create unacceptable risk; over-governing suppresses the innovation the tooling was bought to produce. Microsoft's internal posture is deliberately weighted toward enablement – risk-aware but not risk-averse – a conscious leadership decision calibrated to Microsoft's own risk profile. The transferable practice is the intentionality, not the setting: governance that is deliberate, documented, reviewed, and owned.

Agent Governance

These practices need a structure to sit in. Microsoft organizes its own controls under the Copilot Control System. Despite the name, this is not a Copilot-only construct: it is an architectural framework spanning identity, data protection, threat protection, agent development, and administration across the AI estate. It describes how existing capabilities are organized and applied, not a product to be purchased.

Within that framework, agents deserve additional scrutiny because they do more than generate responses. They hold identities, access data, invoke tools, and can take actions that affect business processes. As agent capabilities expand, governance becomes less about managing AI outputs and more about managing what AI systems are permitted to do. Microsoft Digital therefore applies six governance pillars to agents, building on the broader security, identity, data protection, and operational controls that govern the rest of the AI estate:

1. Identity and ownership – Every autonomous agent receives an Entra identity and multiple named owners, so none is orphaned when its creator changes roles.
2. Least privilege – Agents are provisioned with the minimum access their scope requires, not broad access scaled back later.
3. Data protection – Sensitivity labels travel with the agent, which cannot reclassify a protected asset to finish a workflow.
4. Lifecycle – Agents follow a defined path from build through retirement.
5. Monitoring and audit – Agentic actions are captured and monitored, with the ability to block or disable.
6. Policy and management – A standing council evolves the policies, because agent capability outpaces policy written once and left alone.

Figure 5: The six pillars of agent governance applied within Microsoft Digital

Governance should also scale with an agent's reach rather than uniformly apply. Microsoft Digital gates by risk tier: Simple agents built on Microsoft Graph inside the tenant inherit existing labels and permissions and pass without IT gating, while enterprise agents reaching business systems go through the same environment, connector, design, and privacy review as a professionally developed application. A personal productivity agent and an agent embedded in a critical operational process should not face the same approval path. The same principle of proportionate control based on reach, data sensitivity, and consequence applies across the AI estate, whether the workload is a chat assistant, a custom model, or an autonomous agent.

Microsoft AI Shared Responsibility Model

Microsoft's AI shared responsibility model extends the traditional cloud responsibility model to generative AI.[2] The division of responsibility depends on whether an organization consumes AI as software as a service (SaaS), platform as a service (PaaS), or infrastructure as a service (IaaS), and on who designs, configures, operates, and monitors each control. Microsoft organizes these responsibilities across the AI platform, AI application, and AI usage layers.

For Microsoft-managed SaaS capabilities, Microsoft operates the application and AI platform, while the customer remains responsible for identity and access management, data classification and protection, acceptable-use policy, user education, output validation, and compliance. With PaaS implementations such as Azure AI or Azure OpenAI Service, the customer also owns application design and integration decisions, including prompts, retrieval data, plugins, connectors, safety controls, monitoring, and human oversight. In customer-managed models and IaaS deployments, the organization assumes greater responsibility for securing and operating the model, application, data, and supporting infrastructure.

Industry evidence reinforces why this division of responsibility matters. ISC2's 2024 survey of 1,123 cybersecurity professionals found that 35% were already experiencing AI's effect on their daily work, while 88% expected AI to significantly affect their work in the coming years.[3] Although 82% expected AI to improve efficiency, three quarters were concerned that AI could be used to launch cyberattacks or other malicious activity. For DIB organizations, AI should augment security teams by accelerating analysis and automating repeatable tasks, while people retain accountability for high-impact decisions, investigations, access approvals, and validation of AI-generated recommendations.

Discover & Observe

Key Considerations

For DIB organizations operating in GCC High, AI security begins with visibility. Security teams should maintain an inventory of approved AI services, custom AI workloads, agents, their owners, associated data sources, and the sensitive information those systems can access or process. Every control discussed in this series depends on that inventory. Security teams cannot govern what they have not identified, and they cannot investigate activity they are not logging.

Two existing disciplines provide the foundation for that visibility. First is identity. Every user, workload, and agent interacting with AI operates through an identity, and the same identity controls used to meet DFARS 7012, NIST SP 800-171, and ITAR requirements apply equally to AI systems. Microsoft Entra provides the identity plane for those controls.

Second is data classification and protection. Understanding who has access is only part of the picture; organizations must also understand the sensitivity of the information being accessed. Microsoft Purview provides the classification, labeling, and data protection capabilities that help organizations identify, govern, and protect sensitive information. As AI adoption expands, both identity and data governance become increasingly important because they determine who can access information, what information is available, and under what conditions.

Agent governance remains an evolving area, but the direction is clear. Agents should have unique identities, defined ownership, governed access, lifecycle management, and auditable activity. Organizations do not need to wait for every future capability to arrive before establishing those practices. The opportunity today is to build governance processes around ownership, access reviews, monitoring, and auditability using the capabilities already available in GCC High, so that emerging agent-specific controls can be incorporated into an existing governance structure rather than creating a new one later.

Technical Guidance

Table 4. Establishing AI visibility: Security team actions and current GCC-H capabilities

What's next

Discovering AI is only the first step. Once security teams understand which AI capabilities and agents are operating in their environment, who owns them, and what data they can access, the next question is how those systems should be secured and governed.

Part 3 moves from visibility to action. It will complete the Secure and Govern priorities, translating Zero Trust principles into practical controls for identity, access, data protection, workloads, agents, monitoring, ownership, and lifecycle management. It will conclude with a 30-60-90 day implementation plan designed to help DIB security teams turn the guidance from this series into an actionable path forward using capabilities available in GCC High today.