Please take this as feedback: Coordinate with your Entra and Copilot teams. These teams keep pushing settings that are "on by default" without considering the security risks. A recent example is "Users can register agent identity blueprints," which was enabled by default in the tenant.

Another thing still can't figure out is why any user with a Microsoft 365 Enterprise license can create an agent in the tenant. This creates another major security risk for organizations to deal with.

This is just one of many instances where potentially risky settings have been enabled by default. It feels like Microsoft's teams work in silos with little collaboration. On one hand, the Defender team tries to minimize security risks, while on the other, different teams seem to throw security out the window just to push their features.