AI agents are transforming how organizations work, but their autonomy introduces new runtime security risks. Today, we're announcing new Microsoft Defender capabilities that help security teams detect, investigate, and block attacks targeting Microsoft Agent 365 agents.
Organizations are rapidly adopting AI agents to automate workflows, access enterprise data, invoke tools, and take actions on behalf of users. This autonomy creates a fundamentally new security challenge.
Unlike traditional AI applications, agents operate across dynamic execution flows, interacting with external content, calling tools, and accessing sensitive resources. These interactions create new attack paths that traditional security controls were not designed to address.
Today, we're announcing two major milestones for Security for AI in Microsoft Defender for Microsoft Agent 365:
- Threat detection for Microsoft Agent 365 agents — now in public preview.
- Real-time protection for Microsoft Agent 365 tooling servers — now generally available.
Together, these capabilities help security teams detect, investigate, and block attacks targeting AI agents, extending Microsoft Defender's threat protection capabilities into the agent runtime.
Threat detection for Microsoft Agent 365 Agents (Public Preview)
Threat detection provides SOC teams with detailed visibility into attacks and suspicious activity targeting AI agents. By analyzing runtime signals across agent interactions, tool usage, and execution patterns, Microsoft Defender identifies suspicious and malicious behavior throughout the agent execution lifecycle and surfaces actionable security alerts for SOC teams.
Threat detection supports cloud agent types that emit observability logs to Microsoft Agent 365, including:
- Microsoft Copilot Studio
- Microsoft Foundry
- Microsoft 365 Copilot Agent Builder
- Agents integrated through the Microsoft Agent 365 SDK
This provides consistent threat visibility across supported Microsoft Agent 365 agent experiences, regardless of how the agent was built.
Fig. 1. Microsoft Security for AI alerts in Microsoft Defender XDR (Preview)
Microsoft Defender identifies a broad range of AI-specific threats, including:
- Indirect prompt injection (XPIA) — malicious instructions embedded in external content designed to manipulate agent behavior.
- Evasion techniques — attempts to bypass agent instructions or security controls.
- Malicious content propagation — attempts to use agents to generate or distribute malicious content.
- Secret leakage — exposure of credentials, API keys, or other sensitive information through agent interactions.
- LLM reconnaissance — attempts to probe agent capabilities, instructions, or security boundaries.
- Suspicious IP access — agent access originating from anonymized or suspicious IP addresses.
Alerts are surfaced directly in Microsoft Defender, enabling SOC analysts to investigate and respond using familiar workflows, Advanced Hunting queries, and the Defender XDR investigation experience.
Real-time protection for WorkIQ and Custom MCP servers (General Availability)
Real-time protection moves beyond detection by blocking threats inline when AI agents interact with WorkIQ and custom MCP servers (see Microsoft Agent 365 tooling servers).
When an agent invokes a registered tool or receives a tool response, Defender evaluates the interaction against configured security policies and determines whether to allow or block it directly within the agent's execution flow.
This helps prevent malicious actions and data leakage in real time, without requiring agent developers to implement custom security logic.
Fig. 2. Microsoft Security for AI Real-Time Protection policy in Defender
Real-time protection currently guards against high-impact threats, including:
- Evasion techniques — attempts to bypass agent guardrails or security controls.
- Malicious content propagation — preventing agents from spreading malicious content through tool actions.
- Secret leakage — blocking agents from inadvertently exposing credentials or sensitive data through tool calls.
- Communication with untrusted domains — preventing agents from sending email or data to high-risk or untrusted email domains.
Better Together: Detection and Protection
Threat detection and real-time protection address complementary parts of the agent security lifecycle.
Real-time protection provides inline enforcement to block malicious interactions during execution, while threat detection gives SOC teams the visibility and investigation context needed to identify attack patterns, assess impact, and respond to suspicious activity.
Together, they provide a defense-in-depth approach that combines runtime enforcement with SOC-driven detection and investigation, purpose-built for AI agents.
Getting Started
Both capabilities are available through Microsoft Defender, using a dedicated Security for AI workload experience that brings together AI threat detections, investigations, and runtime protection policies.
To learn more:
As AI agents become more autonomous and gain access to enterprise data and tools, securing their runtime behavior becomes critical. With Threat Detection and Real-Time Protection, Microsoft Defender helps organizations adopt AI agents with security controls designed for how agents actually operate—detecting attacks, enabling SOC investigation, and blocking malicious interactions at runtime.
Microsoft