The part I would like to understand better is what happens when one task spans several systems.

A simple example. An agent is asked to reconcile an invoice. It reads the invoice record, it calls a payments API to check status, and it writes a settlement note. Three steps, three systems, all within the agent's role. Now suppose the amount it settles differs from the amount it read, or the settlement goes to a different counterparty. Every individual entry is valid: the identity is correct, the permission was granted, the API call succeeded. The run as a whole is outside what the agent was asked to do.

Prevention, detection and containment all depend on recognising the event. Here nothing is exploited and no signature matches, so there is nothing to recognise until a human notices the money is wrong.

So my question is this. What is the recommended way to hold the authority for a run, meaning what the agent was asked and permitted to do across the whole task, alongside the observed actions, so the two can be compared afterwards? And is that record produced independently of the components under investigation, or does it rely on the same telemetry that would itself be in question?

Thank you everyone for joining today and making this an exciting and engaging AMA! We hope you all learned something new 😄. Be sure to check out our upcoming Security AMA as well, happening in a couple weeks: Ask Microsoft Anything: Securing your Agentic Insiders with New Capabilities.

How can we restrict the capabilities of an agent created within our Microsoft 365 tenant? For example, how can we prevent the agent from accessing Outlook and Teams or communicating with resources outside our tenant? Additionally, do we need any additional licenses beyond our existing Microsoft 365 Enterprise licenses to configure and enforce these restrictions?

Thanks everyone, the agent ID and the owner trail establish who an agent is and who sponsors it. For a multi-step workflow, what is the recommended record of what the agent was authorised to do alongside what it actually did, so the two can be compared after the fact?

How does Microsoft recommend organizations govern and restrict MCP servers and tools that can be connected to Copilot Studio agents? Specifically, is there a way for administrators to maintain an allowlist of authorized MCP servers or tools and prevent makers or agents from connecting to unapproved ones?

Please take this as feedback: Coordinate with your Entra and Copilot teams. These teams keep pushing settings that are "on by default" without considering the security risks. A recent example is "Users can register agent identity blueprints," which was enabled by default in the tenant.

Another thing still can't figure out is why any user with a Microsoft 365 Enterprise license can create an agent in the tenant. This creates another major security risk for organizations to deal with.

This is just one of many instances where potentially risky settings have been enabled by default. It feels like Microsoft's teams work in silos with little collaboration. On one hand, the Defender team tries to minimize security risks, while on the other, different teams seem to throw security out the window just to push their features.

If I hand you a hashed record of a single agent's actions, what would you need besides that record before you would trust it?

M365 Copilot and Copilot in SharePoint has a lot of great OCR capabilities that we are using throughout the Power Platform to further capture and write data from images as metadata. Are there any current redaction tools to redact data before official upload anywhere? For example if an ID is captured through a PowerApp or SharePoint upload, to quickly register guests by autofill first, last, city. Etc. But NEVER to store or retain any other PII information?

Hello everyone! The event will begin soon. We hope everyone learns something new today. Reminder that the livestream is embedded at the top of this page, you don't have to go anywhere!

I have encountered a problem on my laptop especially on excel sheet and cell. I can't enter more than 1 characters into a cell and can't edit sheet. I've tried many possible ways to resolve it but its not working like I have disabled Add-On, Trust, Insert and so on. Can anyone help me how I can solve this issue on my laptop to fix my excel microsoft apps because it affected entire microsoft excel app. Thanks