Microsoft Mechanics Blog articles

Build your first Power App from data in seconds

Zachary-Cavanell — Wed, 22 Jul 2026 18:35:50 GMT

Generate new pages from a natural language prompt with Generative Pages, auto-populate records from any document in seconds with Automatic Form Fill, and embed Copilot to query your app data directly.

Layer in an Agent Feed to proactively surface decisions, missing data, and action items, then connect to Outlook and Microsoft 365 through Work IQ to act on your app data without leaving your inbox.

Jed Brown, Power Platform Group Product Manager, shares how to turn existing business data into a modern, AI-powered app.

Create a simple app from existing data.

Power Apps generates a fully working model-driven app in under a minute. Get started.

Describe what you want.

Power Apps generates the page — map controls, filtered list views, and click-to-assign interactions wired up automatically. Take a look.

Power Apps connects to Microsoft 365 through Work IQ.

Prompt Copilot to pull contact details from an email and add them directly to your Power App. Check it out.

QUICK LINKS:

00:00 — Create apps using Power Apps

01:07 — Create an app from existing data

02:26 — Copilot + Form Fill Assist

03:46 — AI-generated pages from a prompt

04:53 — Agent feed for proactive intelligence

06:16 — M365 integration via Work IQ

06:46 — Wrap up

Link References

Build your first Power App today at https://make.powerapps.com

Unfamiliar with Microsoft Mechanics?

Microsoft’s Official Video Series for IT

— Subscribe https://www.youtube.com/c/MicrosoftMechanicsSeries

— Microsoft Tech Community: https://techcommunity.microsoft.com/t5/microsoft-mechanics-blog/bg-p/MicrosoftMechanicsBlog

— Podcast: https://microsoftmechanics.libsyn.com/podcast

Join us on social:

— https://twitter.com/MSFTMechanics

— https://www.linkedin.com/company/microsoft-mechanics/

— https://www.instagram.com/msftmechanics/

— https://www.tiktok.com/@msftmechanics

Video Transcript:

-With Power Apps, you can create apps using the data that your business already runs on in seconds with modern experiences using AI, Copilot, and agents, all without writing a single line of code. And you can also transform your existing model-driven apps into automated agentic experiences without needing to rewrite them. Today, I’ll show you just how fast it is to do that. Starting with spinning up your first model-driven app on top of existing business data, then how you can take that app or any Power App you already have and modernize it with generated pages using AI. Then add Copilot Chat experiences to your app, letting users interact with it using natural language, as well as an agent feed that brings proactive intelligence right into your app.

-For a lot of workflows, the data is already there, whether it’s in Dataverse, SharePoint list, SQL Server, or longstanding line-of-business systems. The challenge has always been turning that data into something that people can easily interact with. That’s where Power Apps comes in. You bring the data and it builds the app structure for you, screens, navigation, relationships included. Let’s start by creating a simple app from existing data. I’m in the Power Apps maker portal at make.powerapps.com, and I want to build a model-driven app for our human resources team. They’ve been tracking open roles and candidates in the spreadsheet for far too long, and that data is already imported into Dataverse. I’ll click create and choose to start from a blank page with navigation. I’ll give it a name.

-Now, I can set up new data and I already have a Dataverse table for candidates, so I’ll search for that. This data can be from SharePoint lists, Dataverse, Excel, SQL databases, or you can even upload a CSV file as a data source. Power Apps connects directly to my table. In just a second, it inspects the schema and it generates a fully working model-driven app. Even calculated columns appear instantly. I can see all of my candidate data, their roles, profile completion percentage, current status, days on current stage, and more based on the underlying table. I automatically get a top navigation bar for each page as well as forms for adding and editing records. This looks good, and to make it a working app, I can just save and publish and then I’ll open the app full screen. And you’ll see that I can drill into each candidate and view their details. And this is the same view you get if you were to add new candidates as well.

-So it’s a real app built on real business data in under a minute. And here’s where it gets interesting. Whether you just built this app or you have a Power App that’s been running in production for years, you can modernize it and you don’t even need to start over. For example, I can give this app Copilot and automatic data entry capabilities in just a few clicks. On my new HR app, I’ll just navigate into the settings. From there, in Features, I’ll enable M365 Copilot in model-driven apps. So I’ll change that from default to on and below that, for form fill assist toolbar, I’ll turn that one on as well.

-Now, I’ll save those settings and if we run the app, it adds a Copilot control. This capability uses a Microsoft 365 Copilot paid license. This works with data in the app. So for example, I can use a prompt for a candidate, Ellis Turner. I’ll ask it to help me identify where there are hiccups in the process and why is it taking so long. And it takes a moment to reason over the data. It lists several different issues and summarizes that the root cause is related to securing specific interviews amid fluctuating schedules. Now, let me show you the form fill assist toolbar. Back from the candidate’s view, I can create a new candidate. I have this resume ready to go as you can see here. And to enter the corresponding data into all my fields, I just need to drag and drop this resume file in. And in just a few seconds, AI fills in all of the corresponding fields.

-Next, let’s take this app to the next level using AI-generated pages. Back in my app, I’ll select from the navigation menu, and I’ll select new page followed by the generative page option. Here, I just need to describe what I want instead of dragging controls onto a form. I’ll paste in my request to create a recruiting operations dashboard for hiring managers. And here, it’s important to be specific about what you want generated. So I describe that in the rest of the prompt. The app agent reads my data model, figures out which tables and columns to use and generates the page. It also gives me a preview of the code it’s using to generate the report so that I can review its logic. The nice thing with these pages is that you can continue iterating with additional prompts to build out everything that you want to see.

-Moving now to my finished page, I’ve asked the agent to add a few more tiles and visuals to track the status of my recruiting operation with pipeline funnel, stage health and bottlenecks, time to hire trending, interview performance and more. And this doesn’t just work on new apps. For your existing apps, you can layer in new pages like I just showed so that you can add new experiences without having to move to a whole new app.

-Next, I want to add the agent feed. Here, instead of waiting for users to ask questions, it proactively surfaces what matters like decisions to make, items to review, actions to take, and this is all powered by AI agents working behind the scenes using your instructions. To do that, I’ll move over to agent controls. And in my case, using Copilot Studio, I’ve already created a few agents in advance as you can see. And to add any of these to my new feed, I just need to select them and hit add to feed.

-Now, I’ll choose a few agents in this case. In addition to the onboarding agent, I’ll add the data quality agent followed by the screener agents. And then last, I’ll add the Zava HR agent. Finally, I’ll save the changes to my app. At this point, the agents will start populating my feed. This takes a few moments, so I’ll move forward a little bit in time to show their work.

-Now, I have all four agents working for me to prioritize the actions that I need to make. These, for example, are new candidates who don’t have enough data entered to meet our quality bar in order for them to move to the next stage. And if I click on the filter for needs attention, these are agents that are requesting human intervention to resolve issues. And if I open an item in the agent feed, I can directly take action on the missing data for this candidate. And for an app you already have in production, adding an agent feed or other AI features is just as easy as what I showed with the new app.

-Also, since these apps connect through Work IQ, you can access interact with the same data and context from your favorite Microsoft 365 apps. For example, from Outlook, when a candidate email comes into your inbox with a resume attached, you can use Copilot along with your agent to add the candidate details directly to your app. I’ll prompt it to add the details from this email to a new candidate record. And in just a moment, it adds Mona’s details right into the Zava HR app, and I just need to accept and save to confirm.

-Whether you’re building a brand new model-driven app or modernizing one that’s been part of your business for years, Power Apps now makes it much faster to get there with generated pages, embedded Copilot, and proactive agent feeds built right in, plus seamless integration across Microsoft 365. To go deeper, the best way to learn this is by building. So head over to make.powerapps.com, pick a data set you already got, and build your first Power App today. Keep watching Microsoft Mechanics for the latest on low-code and AI. Thank you for watching.

Microsoft Entra Suite hands-on tour of identity and network access protections

Zachary-Cavanell — Thu, 16 Jul 2026 13:22:33 GMT

Enforce least privilege access across every app and resource. Wire lifecycle workflows directly to your HR system to strip stale permissions on role changes, gate sensitive data behind biometric step-up verification, and replace your VPN with per-app, identity-scoped access that revokes tokens the moment risk spikes. Secure AI usage at every layer. Block confidential data from reaching public AI tools and stop adversarial prompt injections before your agents process them.

John Damon, Microsoft Entra Suite Senior Product Manager, shares how to lock down identity, network access, and AI usage from a single control plane.

Zero stale permissions after a role change.

Entra Suite lifecycle workflows auto-assign the right access package and remove old entitlements. Check it out.

Cut legacy VPN.

Global Secure Access in Entra Suite scopes access per app, ties it to identity, and exposes no inbound ports or public IPs. See how it works.

Expose adversarial instructions hidden in plain text.

Prompt Injection Protection in Entra Suite matches the injection class and blocks the prompt before the model processes it. Check it out.

QUICK LINKS:

00:00 — Identity and network controls

00:45 — Lifecycle Workflows

01:28 — Verified ID with Face Check

02:15 — Request access for direct reports

03:17 — Global Secure Access + Token Revocation

04:32 — Secure AI usage

06:20 — Network DLP / ChatGPT Block

07:12 — Prompt Injection Protection

08:31 — Wrap up

Link References

Check out our related deep dives at https://aka.ms/EntraSuitePlaylist

For more information, go to https://aka.ms/EntraSuite

Unfamiliar with Microsoft Mechanics?

As Microsoft’s official video series for IT, you can watch and share valuable content and demos of current and upcoming tech from the people who build it at Microsoft.

Subscribe to our YouTube: https://www.youtube.com/c/MicrosoftMechanicsSeries
Talk with other IT Pros, join us on the Microsoft Tech Community: https://techcommunity.microsoft.com/t5/microsoft-mechanics-blog/bg-p/MicrosoftMechanicsBlog
Watch or listen from anywhere, subscribe to our podcast: https://microsoftmechanics.libsyn.com/podcast

Keep getting this insider knowledge, join us on social:

Follow us on Twitter: https://twitter.com/MSFTMechanics
Share knowledge on LinkedIn: https://www.linkedin.com/company/microsoft-mechanics/
Enjoy us on Instagram: https://www.instagram.com/msftmechanics/
Loosen up with us on TikTok: https://www.tiktok.com/@msftmechanics

Video Transcript:

-With AI, where action happens at machine speed and where access can be granted and inherited instantly, identity and network access has never been more important. Securing AI starts with securing people, and for that, your identity and network controls need to come together to close gaps that attackers can exploit, and that’s where Microsoft Entra Suite comes in. It combines best-in-class capabilities into a single solution to help you enforce least-privilege access to make sure users have access to what they need, and only as long as necessary. Apply unified access controls to any app and resource, and secure access to AI by discovering AI apps and agents, assessing risk, and enforcing policy.

-Let’s bring this to life by following a user, Violet Martinez, throughout her day, I’ll start by showing how she gets access to exactly what she needs, with least-privilege access. In this scenario, our user has changed job roles. Her role change was signaled overnight by an HR system, Workday, and her permissions need to be adjusted for her new position in the IoT department. This is where a lifecycle workflow we set up in advance in Entra Suite comes into play. We’ve created a “Mover” workflow that automatically adjusts access when a user role changes, and I can click to see how it’s defined. Importantly, stale entitlements from her previous role are automatically removed, and a new access package bundling the right apps and permissions for her new IoT product marketing role is automatically assigned.

-Now let’s switch to showing you our user Violet’s experience. When she signs in with a passkey for her new role, every app and permission from the baseline package is already set up, and she can request access to specific resources that she might be missing using the My Access page at myaccess.microsoft.com. For example, in order to start her work in competitive analysis, she needs access to Zava’s on-prem IoT Pricing Dashboard. So she makes the request. Because the package grants access to highly confidential on-prem pricing data, the workflow requires Verified ID step-up with Face Check. This requires Microsoft Authenticator, which prompts for Face Check, a verification process to match her real-time selfie to her government-issued ID on file, and once verified, she’s given access to the dashboard.

-Now, as a manager, you can request access for your direct reports to make it easier for users to onboard with the access they need. In fact, let me show you the perspective from Violet’s manager. In the same My Access page, I can see the Pricing Dashboard access package we just saw, along with another access package that I can assign to my team. In this case, I want to extend the access to the Zava Assistant AI agent used by the team, and can initiate an access package request for the agent on Violet’s behalf.

-From the dropdown, I see the directs on my team, I’ll choose Violet. Now I’ll choose a start date followed by an end date, and along with those, I’ll type in the business justification, which was set up by IT as mandatory properties for this access package. And because in this instance, as the manager, I am both the requester and approver, Entra ID Governance both provisions and grants just-in-time and time-bound access. Least-privilege access is enforced automatically, with stale permissions removed and updated baselines assigned, and sensitive access controlled using step-up verification.

-From here, let’s move on to applying real-time context-aware access controls to apps and resources as our user goes about her day. She starts in the Edge browser and navigates to local IP to open on-prem Pricing Dashboard. We can see that she has the Global Secure Access client installed, so she doesn’t need to use a VPN. To access internal resources, our IT policy requires her to sign in using her work account with passkey, which uses Conditional Access to evaluate her risk and session context before allowing access to on-prem Pricing Dashboard. Importantly, Global Secure Access permissions are granted per app and scoped to identity, with no inbound firewall ports and no public IPs exposed. And by the way, Global Secure Access will also work with other on-prem apps and Active Directory that do not natively support modern authentication.

-The good news is, even if her device is compromised because of a hardware-based token theft and a token replay attack, with dynamic policies in place, once the user risk is flagged as elevated, token access can be automatically revoked. This forces self-remediation for any user account with elevated risk. That way, privilege never accumulates and trust is continuously reevaluated without standing privilege to stop identity attacks. Next, we already saw that our user is expected to use AI as part of her job, but how does Entra Suite help with securing AI usage?

-Let’s take a look. When our user leaves the office, she uses her personal laptop to work on an FY27 presentation from her team’s SharePoint site. She’s in Microsoft Edge, and using her personal browser profile. A SharePoint site is bookmarked, and she tries to access it. In order to get to the protected location on her laptop, she signs in with her work account, and Conditional Access requires an app protection policy, which then prompts her to switch the Edge profile to her work account. When she does, the device is now registered and the app protection policy is delivered to the browser. This automatically applies security settings and policies to the work browser profile. It enables explicit forward proxy settings and TLS inspection to add visibility into encrypted traffic, so that the company’s data protection policies can work with it. This includes Microsoft Edge data loss protection controls, as well as Microsoft Entra Internet Access, Secure AI and Web gateway policies. That way, she can access her work documents securely, like you’re seeing here with the internal FY27 planning presentation.

-That said, when using her work profile in the browser, if she opens a new tab and she tries to access a social media site, we can see access is blocked based on the company policy. But once she switches back to her personal profile, access to Facebook works as expected. Policies are pushed automatically, even though she’s not using a managed device.

-In fact, Entra Suite inspects and controls access to data. As she interacts with any website, her traffic routes through Entra Internet Access as a forward proxy. So every egress path is inspected in real time against the Purview sensitivity label applied at the source. Same label, same policy, whether she’s on a corporate laptop or a personal device. This time, our user returns to work with her managed work laptop, and she wants to analyze the data from the Pricing Dashboard using ChatGPT. She has a confidential internal product pricing schedule opened as a PDF and selects everything in the document, and she copies everything on the page. Then she moves over to ChatGPT and pastes the pricing info from her clipboard.

-Here, Secure Web and AI Gateway in Entra Suite blocks the upload because there’s an organization-wide policy that prohibits sharing confidential data through a public AI tool. This adds an important layer of protection because a standalone web gateway or CASB can only see traffic, but not the data classification. This is made possible because network DLP parsed the chat text to spot sensitive information before ChatGPT saw the payload, and network DLP also will block the sharing of sensitive files over non-Microsoft email services like Gmail. Next, let’s look at the secure AI usage when the user leverages her company-sanctioned AI tool. Here’s the Zava Assistant that her manager approved. She starts opening a competitor blog and copies everything into her clipboard. Then she invokes the agent and starts to interact by pasting in the blog for summarization, but there’s a catch. Hidden inside the text is a human-invisible instruction telling the model to leak her query history.

-Here, prompt injection protection inspects the outbound prompt against Microsoft’s adversarial pattern model, matches the known injection class, and blocks it before it’s processed. Additionally, new web filtering rules let you block agents from conducting risky operations on specified resources, by creating policies for browser-based and local apps communicating over web protocols. This time, our user remembers that she’s left a sensitive Zava partner memo in the shared Dropbox location.

-So, using her locally installed Claude app, she requests another in-house developed Zava agent to remove that file from Dropbox. Immediately, she can see that this action was prevented based on the network policy from her company. And moving to the admin experience, these rules can differ whether it’s a user or agent session performing the operation. They can be configured to assess multiple HTTP methods, including POST, PATCH, PUT, and DELETE operations scoped to specific URLs or FQDNs.

-Those were just a few examples of Microsoft Entra Suite and its unified approach to access. With Microsoft 365 E7, you can get Entra Suite protections and apply them to AI agents with Agent 365.

-Check out our related deep dives at aka.ms/EntraSuitePlaylist, and to learn more, go to aka.ms/EntraSuite. Subscribe to Microsoft Mechanics for the latest tech updates, and thanks for watching.

New agentic platform in Dynamics 365 for Sales and Service

Zachary-Cavanell — Tue, 14 Jul 2026 15:58:54 GMT

Ask a question and pull a grounded answer straight from your CRM and your calendar. Hand a prompt to Copilot Cowork and walk away with updated records, a finished presentation, and a drafted email, ready before your next meeting. Auto-fill a case description as you work, and walk into every quality review already scored against your team’s framework.

Eric Boocock, Dynamics 365 Principal Program Manager, shares how these agents move with you from first prospect touch to case resolution, right inside the apps you work in every day. Along the way, he explains the mechanics of how everything works and your options to customize the experience with your own skills and instructions.

Flag risks. Surface next steps.

The Sales Qualification and Sales Opportunity Agents in Dynamics 365 turn raw leads and active deals into ready-to-run action plans. See how it works.

Skip manual case notes and manual quality reviews.

Dynamics 365 Customer Service agents auto-fill case fields and score every interaction against your framework, instantly. Check it out.

One prompt. Full QBR prep.

Copilot Cowork surfaces deals at risk, updates CRM, builds the PowerPoint, and drafts the briefing email before your next meeting. Start here.

QUICK LINKS:

00:00 — Agentic platform in Dynamics 365

01:03 — Sales Qualification & Opportunity Agents

01:44 — Case Management & Quality Evaluation Agents

02:25 — Sales Agent in action

04:30 — Copilot Cowork

05:44 — Automate repeated tasks

07:33 — Power behind agentic platform

08:50 — Custom skills via Power Apps + Dataverse

09:57 — Wrap up

Link References

Get started at https://aka.ms/AgenticCXPlatform

Unfamiliar with Microsoft Mechanics?

As Microsoft’s official video series for IT, you can watch and share valuable content and demos of current and upcoming tech from the people who build it at Microsoft.

Subscribe to our YouTube: https://www.youtube.com/c/MicrosoftMechanicsSeries
Talk with other IT Pros, join us on the Microsoft Tech Community: https://techcommunity.microsoft.com/t5/microsoft-mechanics-blog/bg-p/MicrosoftMechanicsBlog
Watch or listen from anywhere, subscribe to our podcast: https://microsoftmechanics.libsyn.com/podcast

Keep getting this insider knowledge, join us on social:

Follow us on Twitter: https://twitter.com/MSFTMechanics
Share knowledge on LinkedIn: https://www.linkedin.com/company/microsoft-mechanics/
Enjoy us on Instagram: https://www.instagram.com/msftmechanics/
Loosen up with us on TikTok: https://www.tiktok.com/@msftmechanics

Video Transcript:

-CRM is no longer a single app, it’s a context layer, and AI agents are weaving it into every workflow and into every app that your sales and service teams touch. So how do you infuse the right context and role-specific customer intelligence across those surfaces to streamline human and agent tasks that use AI? Well, that’s what the agentic platform in Dynamics 365 solves for. It gives you pre-built, role-specific agents for sales and customer service to generate deep and persistent insights. That same underlying context carries forward in your flow of work as you use agents with Microsoft 365. For example, as you prep for upcoming meetings, together, with Copilot Cowork’s advanced reasoning, these agents don’t just surface insights, they interact directly with your CRM backend and produce presentable materials. And for task automation, you can use autonomous agents in Microsoft 365 to work 24/7 on your behalf.

-Let’s make this real, starting with a tour of the sales and service agents in Dynamics 365 available to work alongside you. First, for sales, the Sales Qualification Agent can take a new lead, conduct external research on the company, combine it with what’s already in your CRM, and hand you, as a seller, a qualified summary with recommended next steps. In parallel, the Sales Opportunity Agent can work on active deals, researching the account, while also surfacing buying signals and risks in the process, along with deeper insights on stakeholders, competitors, and more, then recommending the next-step actions to advance the deal.

-Next, on the customer service side of things, the Customer Intent Agent uses generative AI to discover the intent behind incoming conversations, in this case, an issue about travel insurance coverage. As a service rep, it helps you to quickly understand customer needs and guide you to a resolution with automatic response suggestions. The case management agent then automates case lifecycle, like you’re seeing here with the description field auto-filled, so you don’t need to do it manually. And the Quality Evaluation Agent automatically analyzes customer interactions against your scoring framework, generating insights to improve service quality, consistency, and coverage. These agents are grounded in business data. In fact, whether you’re in Dynamics 365 or Microsoft 365, you’re working off the same data right from the apps you already use, including mobile.

-Let me show you how this comes to life with the Sales Agent in Microsoft 365. I have the Sales Agent open. And without even sending a prompt, I see my upcoming and past meetings, each surfaced with AI-generated highlights. Each highlight calls out the key themes to quickly get up to speed, plus tabs for the meeting overview, company overview, external attendees, and talking points, all grounded in CRM and past interactions. And if I need more specific information, I can Ask Sales directly for account summaries, relationship insights, customer sentiment, and more. And when I run any of these, I get a grounded answer almost instantly. And by the way, there’s also an equivalent service agent in Microsoft 365 Copilot. I’ll continue from the point of view of the seller, navigating a complex contract renewal, where you can use agents in line as you work in your office apps.

-I’ll start from Outlook with a customer email. Rather than digging through reports, I’ll ask the agent, “What do I need to know about the Adatum renewal before our next meeting?” And in a few seconds, I get a focused brief. It finds account-related insights that I need to know before the meeting. And because Copilot is extensible, it brings in usage data from any sales application or knowledge source, plus approved content, like reference customers and success stories. It connects the CRM account and deal data with communication across emails and meetings, so that as a seller, you can catch up on what’s changed and what you need to do. And that same context follows you as you move on to other surfaces, like Dynamics 365 Sales, so you can find and resume past conversations right from CRM, all powered by Work IQ, the intelligence layer in Microsoft 365. Taking this a step further, I can use deeper reasoning and AI skills to create the documents and presentations I need for customer meetings.

-That’s where Copilot Cowork can bring sales and service disciplines together for complex, multi-step work and content creation. I have the Cowork tab open in Microsoft 365, and I’ll enter my prompt to get the latest risk and opportunity information for my quarterly business review. I’m also asking it to write back any relevant new information to CRM. “Build me a PowerPoint presentation and write an email to share with the team before we meet.” I’ll run the prompt. And Cowork reasons across sales and service together, surfacing the deals at risk and the open customer service cases that could impact the review, with the most relevant and up-to-minute context behind each. It adds the record in CRM for QBR prep. Then Cowork continues by building the PowerPoint presentation that I requested. It even drafts an email to share with my internal team before the meeting, including the briefing deck.

-Before I hit send, I open the presentation, and it’s packed with insights and next steps, all grounded with everything it just reasoned over. I’ve shown you how you can use prompts or manual triggers to have agents work on your behalf. But as I mentioned, you can also automate repeated tasks by running agents autonomously. Let me show you how to set that up. This time, I’ll start in Microsoft Teams under Apps. I want to create an autopilot agent that automatically generates customer leads for me. So I’ll search for Sales Development and choose the agent. I just need to give it a name and an email alias, so that it can work autonomously with its own identity. And I’ll confirm to kick off the creation process. That’s going to take a moment to create.

-And once it’s ready, I can work with it like a member of my team. I’ll start with a small task, then expand that out to a longer-running set of tasks. From Teams, from a one-on-one chat, I can onboard my agent. I’ll use its suggested prompt to draft an outreach email. Then I just need to give it a prospect name and details. I’ll use my name to test. And it gets to work and checks in with its progress. Now, it’s reasoning over everything, and quickly drafts up the initial outreach email. From there, I can ask the agent to refine the mail a little. Now, I can provide feedback on any part of the email, but I’ll ask it to shorten the email and include a call to action.

-Then I’ll add a company and product name to include, and it finalizes the email. Once everything looks good, I can give it a list of prospects to connect. I just need to point my agent to my spreadsheet, which contains details for multiple prospects, so that my agent can reach out to each one automatically and work through the list. And by the way, if you want to automate this even further, you could instead use CRM data ingestion, and it would run automatically as new customer records are added. And as customers respond, the agent will update me in the chat. So what’s powering the agentic platform in Dynamics 365?

-First, our intelligence layer brings together your core business data, accounts, opportunities, and interaction history, along with saved insights, like deal risk and recommended actions. A business context layer connects all of this, linking people, accounts, deals, and activities, so it’s not just raw records, but a full picture of what’s going on. It’s extensible with skills and tools that give the agents what they need to take specific actions. Work IQ then adds signals from Microsoft 365, emails, meetings, documents, and chats, so agents understand what’s being discussed and can find related materials. Interacting with this intelligence layer is the experience layer with the apps you work in day-to-day, the agents layer with pre-built and custom agents, and Dynamics 365 as a direct interface for CRM. And every interaction feeds back into the system, continuously improving data, insights, and actions. For IT and business teams, this also means more secure AI at scale. It’s grounded in shared context, and respects your data security and access policies across experiences.

-Let’s go deeper on how you can extend agentic experiences with custom skills and tools, and using the business intelligence you have sitting in connected systems or in Dataverse. In Power Apps, you can author business skills, like I’ve done here. These are scoped units of know-how that wrap Dataverse data and the logic for when to use it. You’ll see that the instructions include details for each step the agent needs to take, what I want the output format to look like, and some examples of inputs along with corresponding expected responses.

-Let me show you this skill in action using Copilot Cowork. I’ll ask it to analyze another deal at Adatum to see if they have contract pricing. As it runs, you’ll see that it chains in the custom pricing skill we just saw. And then once it completes, it surfaces a contracted pricing recommendation, which is not available in the out of-the-box product. Copilot Cowork followed all of the instructions, formatting, and examples from the skill. The skills are governed by the same Dataverse security and lifecycle using role-based access.

-So that’s how the agentic platform in Dynamics 365 brings the right context and role-specific customer intelligence into connected experiences to save you time. To get started, check out aka.ms/agenticcxplatform. Subscribe to Microsoft Mechanics for more AI updates. And thanks for watching.

Tokenomics | The new AI currency & your options explained

Zachary-Cavanell — Thu, 09 Jul 2026 15:40:39 GMT

Tokens are the currency of AI, and how you design your app determines how many you spend. Compress conversation history instead of resending it raw, cap output tokens with matching prompt instructions, and cache static context so each reuse costs a fraction of the first request. Route each prompt to the right model by complexity, or set Model Router in Microsoft Foundry to handle that automatically — balanced, quality, or cost mode.

Then optimize the whole stack. Run Agent Optimizer to test your prompt, model, and tool configurations together and surface better setups. Use Toolbox to dynamically select only the tools each request needs and cut input token overhead by 90%.

April Gittens, Microsoft Principal Cloud Advocate, joins Jeremy Chapman, Microsoft 365 Director, to share how to seize control of AI token spend through smarter app design.

Cut context window creep.

Summarize conversation history between turns and store state externally. Prompt tokens shrink from unbounded growth to a tight per-turn summary. See how it works in Microsoft.

One endpoint, three routing modes.

Model Router in Microsoft Foundry selects the right model per prompt automatically — frontier models for complex tasks, smaller models for simple ones. Try it now.

Optimize token efficiency.

Agent Optimizer in Microsoft Foundry tests prompts, models, and tools in combination and surfaces better configurations. Check it out.

QUICK LINKS:

00:00 — Tokenomics foundation

01:06 — Token cost basics

02:11 — Context Window creep

03:46 — Reduce unnecessary tokens

04:29 — Trim context costs

05:21 — Cap output tokens

06:27 — Cache for savings

07:54 — Model cost tradeoffs

09:15 — Model Router

09:42 — Toolbox in Microsoft Foundry Toolbox

11:18 — Agent Optimizer

12:44 — Other cost drivers

13:57 — Wrap up

Link References

Check out the tools in Microsoft Foundry at https://ai.azure.com

For more about managing AI costs go to https://aka.ms/FoundryTokenomics

Unfamiliar with Microsoft Mechanics?

As Microsoft’s official video series for IT, you can watch and share valuable content and demos of current and upcoming tech from the people who build it at Microsoft.

Subscribe to our YouTube: https://www.youtube.com/c/MicrosoftMechanicsSeries
Talk with other IT Pros, join us on the Microsoft Tech Community: https://techcommunity.microsoft.com/t5/microsoft-mechanics-blog/bg-p/MicrosoftMechanicsBlog
Watch or listen from anywhere, subscribe to our podcast: https://microsoftmechanics.libsyn.com/podcast

Keep getting this insider knowledge, join us on social:

Follow us on Twitter: https://twitter.com/MSFTMechanics
Share knowledge on LinkedIn: https://www.linkedin.com/company/microsoft-mechanics/
Enjoy us on Instagram: https://www.instagram.com/msftmechanics/
Loosen up with us on TikTok: https://www.tiktok.com/@msftmechanics

Video Transcript:

- Today on Microsoft Mechanics, we look at the real currency of AI — tokens. We look at what they are, and how they actually drive cost, what we call Tokenomics, the key levers you can use to control spend at scale while meeting your quality goals, along with new and existing tools in Microsoft Foundry that can help. And joining me today to walk through everything is our resident AI Tokenomics expert, April Gittens. Welcome.

- Thank you. Happy to be here.

- So let’s get into this. So as adoption for AI ramps up, this is something that developers and IT teams are feeling directly. You know, costs can really spike in ways that aren’t always obvious when you’re building or scaling. So how should we think about what actually is driving that?

- Well, it’s a combination of factors. AI costs aren’t just about how often you call a model. They’re shaped by how you build the experience. Things like the prompt length, how much context you send, and which model you choose, all add up quickly. Tokens are what you build on, but the real driver is design, and that’s how your app handles conversations, how context grows over time, and how everything’s put together. That’s what ultimately determines your cost.

- So why don’t we break this down. So tokens are the new AI currency, but what are some of the ways that they actually drive costs and what are they?

- At the most basic level, tokens are the unit of text that AI models process and bill against. A token can be a full word, part of a word, or even punctuation or white space. Now depending on your choice of model and the tokenizers they use, there can be nuances in how tokens are defined. So for example, OpenAI uses tiktoken for their models. I’ll show you an example with GPT-5.4 mini model. I have a prompt here and that’s ready to go. And when the response completes, you’ll see the tokens consumed. This is going to be broken down by the input tokens, so that’s everything you send, including the instructions, and the output tokens, and that’s everything the model generates and its response. And here’s the thing, input tokens and output tokens are priced differently. These are charged per million, with output tokens typically costing three to five times more because generating text requires more compute than reading it. A single interaction therefore incurs costs based on the total tokens processed, not just what the user explicitly types.

- So all that sounds pretty straightforward, but costs can get unpredictable pretty fast. So what are some of the most common gotchas that will inflate your cost?

- So I’ll start with the first one. It’s what I like to call the context window creep. Language models are stateless. That means they have no memory of prior exchanges. So for conversation continuity, you have to resend the entire conversation history with every new request. So without the constraints, with each prompt, you’re sending more than you think. First, there’s a system prompt to define the assistant’s behavior, and with each turn, the full conversation history is essential that the model can remember the context. Let’s go ahead and try this out. I’ll ask, what is the capital of France? And it’ll respond with Paris. But notice in the next turn with and Italy, we don’t have to repeat that we’re asking about capitals. Because the full conversation is sent each time, we can just say the country name, or what about California using a state name instead, and the model understands the context. So you might be wondering, “Well, how does this equate the cost?” Here in the logs, if you look at turn 1, the prompt tokens consume were 34. And even though the second request is shorter, the prompt token count grows to 52 because we’re resending the system prompt in full conversation history each time. But by turn 3, we’re sending all prior exchanges along with the latest message, and that’s pushing the input up to 71 tokens. Also, tool outputs or data received from retrieved documents during the grounding process and even hidden metadata, these are all counted as input tokens. And so if you’re not careful, they can dominate your total spend despite input tokens being cheaper.

- So then how would you keep your prompts, your system prompts, and your conversation history from escalating your costs?

- So there’s a few ways that you can plan to reduce unnecessary tokens. First, for system prompts, you want to keep them concise and be careful not to double-up on the instruction set that’s already a part of the model. An easy way to check is to ask in Foundry. So here I have GPT-4o model deployed, and I’ll ask, “Tell me about base model instructions you have so that I can avoid adding to my system prompt. Write and format your responses like a system prompt.” A lot of instructions you’re seeing here are roughly what gets included in a lot of people’s system prompts. And if we run these through a token calculator, this is roughly 300 tokens that I would potentially add to every single prompt turn. And depending on the scale of your app, you could be burning thousands of dollars per billing cycle. Summarizing and deduping that history as the conversation grows is an important strategy. Instead of passing the full, raw transcript every time, we can condense it into a shorter representation that still preserves the key context. I’ll run a few prompts about beaches that are dog friendly in this example. You’ll see that here at turn 3, we’re passing in a summary of the prior two conversation pairs rather than the full input and output of those prior turns. And we’re now just consuming 118 tokens, which is significantly less. Next, instead of sending the full conversation history every time, you can store state externally and only retrieve what’s needed. Here we’re using a PostgreSQL database, but you can use whatever storage fits your architecture. These tactics can directly reduce cost per call and mitigate context window creep.

- And related to that, most teams are going to spend a lot of focus on shrinking prompts, but might overlook the long responses that can also dominate costs.

- Right. These can be longer than expected, especially if you haven’t got explicit constraints worked in. Let me demonstrate this for you. I’m back here in the Foundry Playground and using the GPT-5.4 mini model. Here in the parameters, I’ll set the max completion tokens limit to 200. I’ll also add instructions to match this restriction. I’ll now run a comparison. On the left side, the restrictions and instruction are set, and on the right, it’s unrestricted. I’ll use the same prompt and the left side completes immediately. The right side generates a long response, which is still working on. And if you look at tokens consumed, it’s 93 on the restricted side and 675 on the unrestricted. So there’s quite a positive difference in terms of token savings. The key here was the match of token restrictions with the prompt instructions, because if I run the same prompt on a restricted side without those instructions, it stops mid-sentence, and that’s a bad user experience. Also, this is where evaluation and testing is important for setting the right limits.

- Now another technique that you can use is to save on tokens with caching. That’s because many models price cache tokens differently. You may pay more upfront to write to cache, but reuse a cache hit is much cheaper since the model doesn’t need to recompute it. So which cases then make sense for using cache?

- Well, it’s all about the efficiency of reuse, where you know that context will be used repeatedly. That way you’re reducing repetitive computation. You can add static prefixes in your code for what makes sense to cache, like system prompts, tool definitions, relevant RAG documents retrieved earlier on in the session. This is repeatable context for the session that doesn’t need to be resent with every turn. In each content block within the code, the cache control flag is set to ephemeral, and it tells the API to cache those token server side. The first request pays full price to write to cache. However, the follow-up requests that send the same prefix has a cache hit and pays roughly 10% of the normal input token costs. That said, the main downside is that the cache context needs to match perfectly for it to be a cache hit. Also, latency can go up as the chat history grows. So you need to factor this into your evaluations. You can also do semantic caching. As you can see in this code example, this can work well for things like frequently asked questions. Even for true cache hits, keep in mind, there’s still a cause to store the data somewhere. So you are trading compute savings for storage, which is almost always cheaper.

- So how does all this come into play then with the model that you select for your app or your workload?

- Well, as a rule of thumb, model choice is probably one of your biggest levers for reducing costs. Higher-performing models can cause several multiples more per token than smaller models, even with the same provider. So back here in Microsoft Foundry, you can compare models side-by-side to see how each stacks up for quality, safety, estimated costs, and throughput. In this case, I have GPT-5.4 on the left and GPT-5.4 mini on the right. And you can see the trade off between quality, which is coming in at .81 out of 1 for the larger model and .67 for mini. Mini’s cost is at $45.81 per million token, and it’s 72% less than the larger model. That said, one thing to keep in mind, cheaper models sometimes require a few retries to get what you want. So the lowest per token price is not always the lowest total cost. And this is where evaluation really matters, not just for the cost, but for optimizing outputs and your user experiences.

- So how do you find the right balance then between performance and cost and quality?

- So this is where picking the best model for the task comes in. The leaderboard in Microsoft Foundry, it’s a good place to start. What you’re really aiming for is efficiency, getting the same outcome with fewer tokens. It helps you see the trade-offs, balancing quality versus cost, and latency versus complexity. And if you’re not sure which model to use, there is another option in Microsoft Foundry that can also help you make the decision. It’s called the model-router and it’s available in the model catalog. It selects the most suitable model for each prompt based on its complexity. For example, complex tasks will go to the frontier models and simple tasks will go to smaller models. It’s just one endpoint and there’s three routing modes. There’s balance, quality, and cost, where each optimizes for those outcomes.

- That said, you might also need to give models access to tools, like APIs, data retrieval or functions, or even MCP servers, to extend what they can do. So what impact does that then have on token consumption?

- So when you give a model access to tools, you have to describe those tools in the prompt every time the model runs. All of that gets sent as input tokens with every request. Even if the prompt response only requires one tool, you still pay for all of them. And this is where the toolbox in Microsoft Foundry helps. Here at Microsoft Foundry, I’ve created three different toolboxes with different sets of tools. In fact, here’s an example of a toolbox. It has 30 tools and three Azure functions. Instead of sending every tool definition on each request, toolbox works like a router that dynamically selects the best tool for the job, reducing token inputs while improving accuracy. I’ll show you this in action. So back here in the Foundry Playground, I’m going to compare two agents. The one on the left, agent A, it’s not using toolbox. The one on the right, agent B, has toolbox configured. So I’ll run an identical prompt, “Show me our product catalog,” in both, starting on the left, and then I’ll use the same one here on the right. Both agents return nearly identical responses. Now if I move into the agent run details for both, we can see the impact of using the toolbox. agent A without it consumed almost 4,700 tokens, and agent B, using the toolbox, only used 467 tokens.

- That’s a massive 90% reduction for input tokens without any quality trade-off. So far we’ve looked at prompts, model choices, and tools. Each one of those helps. But there’s no one size fits all solution. It really just depends on your specific use case.

- And that’s why evaluations matter. They show you what actually works. And this is where another tool called agent-optimizer can help. It tests your prompts, models, and tools together to find better configurations. From a cost perspective, by approving output quality, it can let you use a smaller, cheaper model while achieving similar results. Also, you can optimize for specific goals, like token efficiency, by using your own evaluators to guide it. Once you’ve set up evaluations in Microsoft Foundry for your agents, agent-optimizer will look at what you have in place and optimize it for each across the evaluation dimensions you’ve defined. From VS Code, using the terminal, you can run this through a few different iterations using azd ai agent optimize. It looks at your prompts, tools, and model choices, that’ll run iterations, and identifies better configurations automatically, creating new candidate bills that you can compare against your existing configurations. The process takes a moment to complete. So we’re going to jump ahead to the results. And you can actually see here that it found a candidate that was able to move our previous agent’s 70% score to a 90% pass rate. And it even builds a new agent version for you to test its optimizations before you put it into production.

- And that’s going to boil down to fewer iterations and also fewer tokens consumed in the long run. So today we’ve covered the basics of tokenomics. We’ve also just scratched the surface here because there’s a lot more things that impact costs.

- Yes, but don’t forget that you have to treat costs holistically. Tokens are just one piece of your overall AI cost picture. How much data you send and how efficiently you process it are huge overall cost drivers. Quality data retrieval also really matters to avoid less relevant input context, unnecessary iterations, and in turn, lower quality outputs. That’s where Microsoft Foundry IQ helps you organize and ground multiple enterprise knowledge sources for AI. It’s a single endpoint for developers. And when a query comes in as part of your information retrieval, it uses a small language model, it runs a planning step, deconstructs a query, and routes different parts of the query to the corresponding knowledge source. Once it’s complete, it returns the results to the agent as context. Additionally, infrastructure efficiency for Azure resources that don’t use tokens is also important, including the containers’ infrastructure, VMs, databases, storage accounts, and networking, it all adds up.

- So at the end of the day, the tokens might be something that you’re build on, but it’s how you design your app that really determines your costs. And if you focus on that, you can scale AI much more predictably. So for anybody who’s watching right now, what do you recommend as next steps?

- So to learn more, check out the tools in Microsoft Foundry at ai.azure.com. And for more about managing AI cost, go to aka.ms/FoundryTokenomics.

- Thanks so much for joining us today, April, explaining everything about tokenomics and your options. Keep watching Microsoft Mechanics for the latest updates. We’ll see you again soon.

Deploy Windows updates to counter AI-discovered threats

Zachary-Cavanell — Wed, 08 Jul 2026 13:15:00 GMT

For the devices that you manage where you can afford to tighten deployment timelines, we’ll explain updated recommendations and show you how to speed up patching.

It starts with assessing your risk exposure for unpatched devices using the new Autopatch report in Microsoft Intune, then tightening deferral policies on the devices where it makes sense, using Hotpatch to activate protection on install — without requiring reboots. Windows Autopatch automates your update deployments using rings to progressively apply updates to the device groups that you help define, including updates for Windows, Microsoft 365 Apps and the Edge browser. And to keep internal resources protected, you can enforce access controls using Conditional Access to block non-compliant devices.

Jeremy Chapman, Microsoft 365 Director, shares what’s changed along with the approaches you can take to help counter the growing number of AI-discovered vulnerabilities and stay protected.

Move AI vulnerabilities from discovery to exploit in hours.

For Windows devices in your estate where you can tighten deployment timelines, Microsoft’s updated patching recommendations show exactly where to set the bar. See how it works.

Fewer reboots. Immediate protection.

Hotpatch in Microsoft Intune applies security fixes the moment they install, no restart required. Check it out.

Configure once.

Ring-based Windows Autopatch policies paired with Microsoft 365 Apps on Monthly Enterprise Channel automate your full patching pipeline. See it here.

QUICK LINKS:

00:00 — AI and Windows patch management

01:13 — Updated patching deferral thresholds

01:46 — Hotpatch on by default

02:05 — Windows Autopatch report

02:30 — Ring-based deployment + M365 Apps servicing profile

02:50 — Conditional Access for non-compliant devices

03:16 — Wrap up

Link References

For what you can do beyond patching, go to https://aka.ms/securenow

Unfamiliar with Microsoft Mechanics?

As Microsoft’s official video series for IT, you can watch and share valuable content and demos of current and upcoming tech from the people who build it at Microsoft.

Subscribe to our YouTube: https://www.youtube.com/c/MicrosoftMechanicsSeries
Talk with other IT Pros, join us on the Microsoft Tech Community: https://techcommunity.microsoft.com/t5/microsoft-mechanics-blog/bg-p/MicrosoftMechanicsBlog
Watch or listen from anywhere, subscribe to our podcast: https://microsoftmechanics.libsyn.com/podcast

Keep getting this insider knowledge, join us on social:

Follow us on Twitter: https://twitter.com/MSFTMechanics
Share knowledge on LinkedIn: https://www.linkedin.com/company/microsoft-mechanics/
Enjoy us on Instagram: https://www.instagram.com/msftmechanics/
Loosen up with us on TikTok: https://www.tiktok.com/@msftmechanics

Video Transcript:

-Intentionally delaying security patches might be a common practice, but it shouldn’t be, especially now. There’s been a significant increase in security updates across the industry. For Microsoft specifically, total addressed vulnerabilities have been on the rise since April this year with 206 in June, and this is only set to increase. The risk is real.

-Ahead of May’s Patch Tuesday, Microsoft’s own MDASH multi-model agentic scanning harness, for example, found 16 new vulnerabilities across the Windows networking authentication stack, including four critical remote execution code flaws.

-And this is on par with the rest of the industry with AI speeding up how quickly software vulnerabilities are found and exploited, often from weeks to hours, including zero days. And if you’re in IT, this means rethinking your organization’s risk, security posture and response, and ultimately getting your devices patched with the latest security updates as soon as possible.

-If you’re not delivering critical quality updates with security fixes until a couple of weeks after they’ve been issued, that’s ample time for attackers using AI to find and exploit known security gaps. To address this, we’ve updated our recommendations for deploying Windows updates to less than three days as the deferral period for quality updates, setting deadlines for those updates to zero or one day, and the update grace period to a maximum of two days.

-So, if you’re delivering updates using policy controls, these are all configurable via Windows Autopatch and Microsoft Intune. And you can put equivalent time-bound policies in place with other Windows software update tooling options like Microsoft Configuration Manager and Windows Server Update Services.

-And back in Intune, using Hotpatch updates, which are now on by default, once the update is installed, protection takes effect immediately without waiting for a reboot to reduce exposure and minimize disruption.

-So, even though you’re pushing out updates faster, it still means fewer reboots. In fact, let’s walk through the process you’d take to limit the risks associated with your out-of-date Windows clients, your browsers, including Edge, and Microsoft 365 Apps.

-First, it starts with asking the question, “How bad is our exposure?” Here, the Windows Autopatch report helps you assess where your Windows desktop infrastructure stands with a baseline of which devices are up to date and which are missing updates.

-Next, how can you set and forget security update policies? That way, you’re automating current and future update deployment. To do that, you can configure Windows Autopatch within Microsoft Intune for ring-based deployment, as well as set Microsoft 365 Apps servicing profiles to use the Monthly Enterprise Channel.

-Then, how do you make sure non-compliant or unsafe devices don’t have access? Using Conditional Access policies, you can block access from non-compliant devices to ensure only trusted devices can access internal resources.

-And for what you can do beyond patching, go to aka.ms/securenow to see a full list of actions you can take to limit your exposure to AI-accelerated threats. Following these approaches will help reduce your risk and improve your security posture. Thanks for watching.

Zero Trust security for AI agents

Zachary-Cavanell — Tue, 07 Jul 2026 16:25:49 GMT

Extend Conditional Access in Microsoft Entra to evaluate every agent authorization request in real time against the same risk signals as human users. Assign each agent its own managed identity with Entra Agent ID and scope permissions with Access Packages. Govern your MCP catalog as a software supply chain — unapproved tools don’t run, and approved servers lock behind Azure API Management.

Log every agent tool call, API access, and data lookup into Microsoft Sentinel for continuous anomaly detection. Purview Insider Risk Management auto-assigns risk levels so you can investigate fast or revoke access entirely. DLP and sensitivity labels in Microsoft Purview restrict what agents can reach and auto-inherit to everything they generate, and Data Access Governance maps exactly what each agent can access before a prompt fires.

Jeremy Chapman, Microsoft 365 Director, shares how to put these controls into practice across every managed, self-hosted, and shadow agent in your estate.

Agent identities. Real-time risk evaluation.

Conditional Access in Microsoft Entra evaluates every agent authorization request and enforces policy before agents connect. See how.

Every tool call. Every API hit. Every data lookup.

Microsoft Sentinel captures each one. Purview Insider Risk Management auto-assigns risk scores the moment anomalies surface. Start here.

Govern your MCP catalog like a software supply chain.

Block unapproved tools by default and scope approved MCP servers per agent behind Azure API Management. Check it out.

QUICK LINKS:

00:00 — How AI changes Zero Trust

01:20 — Zero Trust principles

02:27 — How to apply Zero Trust principles

03:40 — Conditional Access for Agent Identities

04:59 — Entra Agent ID + Access Packages

06:07 — Runtime Observability

06:58 — DLP, Sensitivity Labels + Data Access Governance

07:47 — MCP catalog

08:36 — AI apps & experiences

09:24 — Wrap up

Link References

Watch the rest of this series at https://aka.ms/ZTMechanics

For additional resources, check out https://aka.ms/GoZeroTrust

Unfamiliar with Microsoft Mechanics?

As Microsoft’s official video series for IT, you can watch and share valuable content and demos of current and upcoming tech from the people who build it at Microsoft.

Subscribe to our YouTube: https://www.youtube.com/c/MicrosoftMechanicsSeries
Talk with other IT Pros, join us on the Microsoft Tech Community: https://techcommunity.microsoft.com/t5/microsoft-mechanics-blog/bg-p/MicrosoftMechanicsBlog
Watch or listen from anywhere, subscribe to our podcast: https://microsoftmechanics.libsyn.com/podcast

Keep getting this insider knowledge, join us on social:

Follow us on Twitter: https://twitter.com/MSFTMechanics
Share knowledge on LinkedIn: https://www.linkedin.com/company/microsoft-mechanics/
Enjoy us on Instagram: https://www.instagram.com/msftmechanics/
Loosen up with us on TikTok: https://www.tiktok.com/@msftmechanics

Video Transcript:

-AI changes the Zero Trust and cybersecurity landscape. It’s reshaping how vulnerabilities in your environment are discovered and how they’re exploited at machine speed. And the question is whether your defenses can keep up. Now, as we’ve seen, new models are optimized to discover security gaps and zero days that have existed for decades undetected, finding exponentially more issues than humans can review in time before public models accessible via bad actors find the same exploits.

-And that’s why Zero Trust is more important than ever to stop malicious access attempts as early as possible. The approach needs to be layered across identities, endpoints, your entire network layer, data, AI resources, and your apps and infrastructure because each introduce unique risks and act as a potential entry point. At every layer, real-time policy enforcement and protections are essential to ensure that every identity, every agent, and every endpoint that connects to your resources is thoroughly assessed and verified before gaining access to requested resources.

-Today we’ll focus on the access controls and additional layers important to AI and how to apply Zero Trust at every step. Zero Trust principles themselves haven’t changed, but with AI they have to be applied in new ways. First, verify explicitly means always confirm who in terms of a person or device or what in case of AI or other processes is requesting access to your environment, assessing every app being used, deployed or developed in your environment, and giving every agentic actor its own discrete identity separate from the user who invoked it and separate from the workload it runs on.

-Next enforce least privilege access now means making sure that AI can only reach the data it needs for the purpose it was authorized for. And it means agents themselves should only have the permissions required to complete the task in front of them, nothing more. And assume breach takes on a new meaning because you now need to assume that any prompt can carry malicious intent. Any response can leak sensitive data and any AI component, whether it’s an SDK, an MCP server connection or an agent itself can have vulnerabilities waiting to be exploited.

-So let’s walk through how to apply these as AI access controls. The biggest risk at the access layer is also the most familiar one, your human users and the access tokens they hold. People are still security’s weakest link. And as AI accelerates, unknown or unmanaged agents, especially those running as local AI, impersonating human users now represent some of the greatest risk. That’s because AI just needs a stolen credential an overpermissioned account or a compromised session to get in, it doesn’t need to break encryption or find a brand new zero day.

-AI can now autonomously discover weaknesses, can chain multiple lower severity issues and package it into a working end-to-end exploit all in a fraction of the time it would take a human attacker. And alongside your human users, there’s also a new class of identity requesting access to resources, AI agent identities, where unlike a person, it works at machine speed and around the clock. And while it doesn’t fall for phishing or forget its password, it can be hijacked through prompt injection or by being handed a malicious tool.

-And if it has broad standing access, a single misconfiguration can open the door to a major breach that could be executed in just seconds, which is why the starting point for Zero Trust with AI and agents is identity itself with identity and access controls, where Conditional Access in Microsoft Entra evaluates every request in real time against signals like user risk, sign in risk, device health and location. And then it pairs that with phishing resistant authentication like passkeys so that only verified users can reach the apps and AI experiences that they’re authorized to use. And Conditional Access can also evaluate agent risk in real time for every authorization request that the agent makes against a resource. AI experiences amplify whatever access a user already has.

-For AI, Microsoft Purview’s Data Security Posture Management gives you visibility into how users are interacting with data and AI so that you can spot risky patterns like oversharing or anomalous prompts early and increase your security posture before they become incidents. Using Microsoft Execution Containers, Windows can identify local AI agents and require them to run within the container using their own Agent IDs, which gives you control over them using Conditional Access policies. So at the identity and access management layer, agents need the same Zero Trust treatment as people, but adapted to how they work.

-Now, this leads to inventory because you can’t protect what you can’t see. It means that to gain access and become a known object, every agent must have a governed identity. No more borrowed credentials where agents can run under the user’s token. We’re also using Conditional Access policies. Everything unmanaged and unknown should be blocked by default. Now, the first step is discovering every agent in your estate using Agent 365, whether it’s managed or self-hosted or unmanaged shadow agents, then reconciling them with your directory and access controls.

-Entra Agent ID gives each agent its own unique manageable identities so that you can apply the same visibility, governance and use Conditional Access policies like you do for human users, but now for non-human actors too, to tightly control exactly what agents can access and under which conditions. And you can scope resource access individually for each agent. Access Packages as part of Microsoft Entra ID Governance with human sponsor approval let you grant just-enough-access for just-enough-time that expire when work is done. But identity is only the first checkpoint. Once an agent is inside your perimeter, you need to see what it’s actually doing in real time and that’s for runtime observability comes in.

-So for that, using sign-in and audit logs, you can see every tool call, every API access attempt and every data lookup and every request that an agent makes. It should also be logged against Microsoft Sentinel as your SIEM and continuously evaluated against anomaly detection so that it’s seamlessly integrated with your alerting incident management and investigation controls. And if an agent can’t be observed, well, it can’t be trusted. Insider Risk Management in Microsoft Purview now extends to agents automatically assigning risk levels based on their data activities. So you can prioritize investigations, apply targeted controls or revoke access entirely when something looks wrong. Then there’s the data and tools behind every agent, files that the agent grounds on, the backends it queries, the MCPs it can call, and the models it’s wired to, they’re all reachable and they all need a control with a name on it.

-Let’s start with data because that’s ultimately what the agent is after. DLP and sensitivity labels can restrict AI access even when a user has permission to open a document directly. And if labeled content is used, the label is also automatically inherited by anything the agent generates from it. Data access governance shows you exactly which sites, items and sharing links every agent can reach, so you can tighten access at the source before a single prompt is sent. Policy protections also cover your structured data backends, including Fabric, OneLake and others. Moving on to the tools that an AI agent can call, here you should treat the MCP catalog like any third party software supply chain, where unapproved tools don’t run and approved tools run only for the agents that you’ve assigned them to.

-In fact, every approved MCP server created by your organization can be protected behind Azure API Management. Likewise, AI agents built in Microsoft Foundry need guardrails to block risky behavior, including jailbreak attempts, prompt injection, and prevent protected material from being processed. Agents have a deep tool belt, and if you only close one door, they’ll quickly find another way to reach files, systems of record or sensitive data. Controls should be continuous at runtime across identity, data as well as the underlying tools and models.

-And that brings us to the AI apps and experiences your users and agents are actually trying to reach and the related controls. Microsoft Defender for Cloud Apps gives you visibility into every AI app and use with risk-based controls to govern app behavior and data protection policies that prevent misuse and exfiltration. Microsoft Edge also has controls to prevent users signed into their work accounts from using consumer grade Shadow AI apps. Also for local AI, Microsoft Intune and Microsoft Defender provide agent discovery signals to detect unsanctioned local agents. You can see where these are being used on managed devices in your environment. And an Intune security baseline allows you to restrict common execution paths that local agents like OpenClaw may use.

-AI doesn’t just create new risks, it amplifies existing ones, stale permissions, overshared data, ungoverned apps, and weak authentication. It exposes and exploits those gaps faster than any human attacker, but the same works in reverse. Zero Trust controls, strong identity, least privilege, real-time policy, and runtime observability can also operate at machine speed to reduce risk. Agent 365 unifies these AI controls across Microsoft Entra, Purview, Intune and Defender, while letting each domain expert work within their tool of choice. Whether that’s identity and access management, data security and compliance, endpoint management for local AI or security operations for incident and threat management. In the AI era, the principles remain the same. Verify explicitly, enforce least privilege and assume breach across every agent, user and app.

-For additional resources, free workshops and hands-on implementation guidance with experts, check out aka.ms/GoZeroTrust. Subscribe to Microsoft Mechanics if you haven’t already. Thanks for watching.

Secure containers from code to runtime | Microsoft Defender

Zachary-Cavanell — Mon, 29 Jun 2026 16:19:54 GMT

Correlate cross-cloud attacks into a single incident, catch runtime threats that image scanning misses, and block vulnerable images before they reach production.

Investigate container hijacking, isolate compromised pods with Security Copilot-guided remediation, and close the loop from SOC to dev by pushing CVE fixes to GitHub and syncing resolution back to Defender.

Matt McSpirit, Microsoft Azure expert, shares how to detect, investigate, and remediate container threats in one connected workflow.

Expose container hijacking at runtime.

Binary drift detection flags the moment a container runs anything outside its original image. Try it now.

Detection to containment in one flow.

Security Copilot in Defender generates your incident report, classifies the attack, and surfaces pod isolation as a guided remediation step. Check it out.

Close the loop from SOC to dev.

Create GitHub issues for vulnerable container dependencies, trigger Copilot’s fix as a Pull Request, and bring “resolved” status back to Defender the moment it merges. See how it works.

QUICK LINKS:

00:00 — Secure containers in Microsoft Defender

01:02 — Cross-cloud incident

03:07- Runtime detection

04:10 — Investigate and build context

04:49 — Security Copilot incident report & containment

06:03 — Prevention

07:34 — Recommendations and take action

09:04 — Wrap up

Link References

Get started at https://aka.ms/DefenderCloudSecurity

Unfamiliar with Microsoft Mechanics?

As Microsoft’s official video series for IT, you can watch and share valuable content and demos of current and upcoming tech from the people who build it at Microsoft.

Subscribe to our YouTube: https://www.youtube.com/c/MicrosoftMechanicsSeries
Talk with other IT Pros, join us on the Microsoft Tech Community: https://techcommunity.microsoft.com/t5/microsoft-mechanics-blog/bg-p/MicrosoftMechanicsBlog
Watch or listen from anywhere, subscribe to our podcast: https://microsoftmechanics.libsyn.com/podcast

Keep getting this insider knowledge, join us on social:

Follow us on Twitter: https://twitter.com/MSFTMechanics
Share knowledge on LinkedIn: https://www.linkedin.com/company/microsoft-mechanics/
Enjoy us on Instagram: https://www.instagram.com/msftmechanics/
Loosen up with us on TikTok: https://www.tiktok.com/@msftmechanics

Video Transcript:

-Containers are the foundation for how modern business critical apps are built, running across Kubernetes environments and multiple clouds. These are high value targets for attackers, who are now using AI to accelerate ways to find and exploit vulnerabilities faster than humanly possible, from code to runtime. And it’s hard to respond effectively when security signals and responsibilities are fragmented across different teams and tools. The challenge isn’t just finding security issues, it’s understanding how they connect across the lifecycle from development to production.

-So, rather than treating supply chain and runtime as separate problems, Microsoft Defender for Cloud brings them together into a single, unified model to catch issues early in code by identifying vulnerabilities and misconfigurations, prioritizing risk across clusters, workloads, and configurations, and detecting and responding to threats in your running containers in near real time, all while tracing them back to the source to put the right mitigations in place. So let me walk you through a multi-stage attack across a containerized environment to show this in action from the perspective of a SOC analyst. I’m in Microsoft Defender in the incidents view, filtered to container related incidents, and I can see four related to containers.

-Let’s start with this one: a multi-stage incident involving multiple users. And notice this is already correlated into a single incident, not multiple alerts. You can see it’s flagged as high impact, with a critical asset label, and the crown icon in the incident graph showing asset criticality. On the left, is the attack story with alerts listed in chronological order, color-coded by severity. If we go back to the incident graph, container resources are in black, and related identities and services are in white. This is runtime threat detection correlated across layers.

-In this case, Defender has detected 19 alerts for this incident in near-real time and stitched them into a single timeline. So, let’s walk through the attack. Here we can see the initial access signal was from a Kubernetes API request from a proxy IP address. Identity compromise and escalation then occurred with credentials accessed from a service principal. And finally, Defender for Cloud’s cross-cloud correlation surfaces lateral movement spanning environments, revealing a brute-force attack originating from an exposed Azure Kubernetes cluster targeting an AWS Relational Database service resource.

-Back in the graph, you’ll notice a blue icon, this indicates there are related attack paths. And if we ungroup similar nodes, we see a user indicated by the blue icon, and we can pivot directly into the attack path view. Here’s where it gets interesting. This is where we connect runtime activity back to security posture and exposure. It’s concluded that the container is internet-exposed with high-severity vulnerabilities, and it’s using a managed identity to access a protected storage account. We’ll come back to this in a moment to see if we can fix the root cause. So, we can see this wasn’t just an isolated runtime event; there was a clear path from exposure to exploitation.

-So let’s move on to the second incident in our queue. This is another multi-stage attack. This time focused on initial access and discovery across multiple endpoints. In the Incident Graph, we can see a number of containers were accessed. Then in the attack story, we can see they were hijacked to be used as Cryptocoin miners. Now, containers should be immutable, only running what was in the original image. But this alert shows the initial binary drift. This signals to Defender that the container is executing something it was never built to run. And if we review the activities for this alert, we can see a suspicious parent process, and a shim file being used to execute it. And if we move to the right in evidence, we can see all the details for the process, file, pod and cluster. This is where runtime detection becomes critical, because this activity isn’t visible through image scanning or posture alone.

-From here, we can investigate and build full context around the attack. For that, let’s drill into our Kubernetes cluster and start hunting to take a look at the processes run, across both control plane and data plane signals. There are tables that log these events for querying, CloudProcessEvents for runtime activity and CloudAuditEvents for control plane actions. Let’s run a query in the audit events table to search for the creation of a cluster-admin role binding. This would grant full administrative access to the cluster. Here, we can see the role binding and associated subject. It confirms our assumption that the privilege escalation did happen. Next, we can leverage Security Copilot to transition from investigation to response using guided recommendations informed by the attack insights uncovered. Here, Copilot has already generated an incident report.

-At the top, we have a summary of the attack from correlated signals. If we expand it, under Credential Access, we see compromised identity activity. Under Discovery, there are network scanning tools. Under Execution, we see confirmation that the container was modified to run crypto mining processes. And below that, the Triage section then lets you classify the incident as true positive, informational, or false positive with corresponding subcategories. I’ll choose a True Positive Multi-stage attack. And Copilot also suggests two remediation actions: terminate the pod to stop activity or isolate the pod to contain the threat. So let’s follow that guidance and isolate the pod. So I’ll close Copilot and return to our Incident graph, then ungroup similar nodes again. Now selecting the Pod, under Actions, I can isolate the Pod. I’ll add a reason. And then I just need to confirm. And just like that, we’ve moved from detection to investigation and containment in a single flow.

-So far, we’ve focused on detecting, responding to active threats. But security doesn’t start at runtime. And this is where Defender for Cloud helps your DevOps teams harden your environment to prevent issues from reaching production in the first place. Using policies, you can put rules in place to prevent containers with issues from being deployed. So for that, in the Azure portal in Defender for Cloud, under Environment Settings, we’ll head over to our Security Rules.

-Here, we’ve already created a handful of rules to deny or audit activities. For example, if I take a look at this one to block vulnerable deployments of AI applications, this rule is configured to automatically deny deployment of any image violating the policy. It’s scoped specifically to the namespace of our AI applications. In the Configurations tab, we can see that this rule is set to trigger when a container image contains a high or critical severity vulnerability, with any count higher than zero. With our policy in place, let’s test it out by attempting to deploy a container image that contains a few high-severity vulnerabilities. This is exactly what happens with supply chain attacks. For that, from Cloud Shell, I’ll run an AKS command first to get my credentials.

-Now I can execute my command. I’ll paste in this Kube Control command to run an image, including its location and namespace details. And immediately, we can see that the run was denied, stating that the image contains 415 CVEs, and we allowed zero in our policy. So it’s blocked. What’s more, Defender for Cloud continuously scans what’s in your registries and running environments in near real time, surfacing the risks that matter and turning them into clear, actionable fixes. Next over in Recommendations, we can see findings identified by Defender for Cloud with several critical risks highlighted, related to the same incident that we saw earlier in the Defender portal. And these are its recommendations.

-Let’s look at this one to update busybox. Looks like this version has 13 known vulnerabilities. And digging into the Remediation Insights tab, we can see more details across the development phases. The Take Action button tells us to assign an owner and to create a GitHub issue. I can create the GitHub issue from here. And if I head over to what our dev team would see in GitHub, you can see the details for the ticket, with deployment info, matching CVEs for this version, and below there, there are the remediation guidelines to mitigate the issue. From there, we can assign the issue to GitHub Copilot, and the GitHub Copilot Coding Agent will generate a draft Pull request fixing the CVEs for review. Once the pull request is actioned and complete and the version is updated, we can see that the CVEs were resolved. And finally as a developer, we can merge the pull request to get our app back into a healthy state. I’m going to return back to Microsoft Defender and our app recommendation, clicking on the GitHub issues shows that everything was resolved, and it sent the updated status back to Defender where your SOC lives.

-So, that’s a hands-on look at how Microsoft Defender helps secure your container environments end to end. It doesn’t just detect security issues, it helps you to respond faster by connecting security signals across the entire lifecycle, from development through production. To learn more or get started, visit aka.ms/DefenderCloudSecurity. Be sure to subscribe to Microsoft Mechanics for the latest tech updates. And thanks for watching.

Find and fix app issues - Azure Copilot Observability Agent

Zachary-Cavanell — Mon, 29 Jun 2026 06:30:00 GMT

The Azure Copilot Observability Agent autonomously investigates incidents, correlates signals across logs, metrics, alerts, application health, and ML anomalies, then surfaces root cause with charts and recommended next steps.

Extend coverage to your AI agents in Microsoft Foundry, track Gen AI errors and token consumption with trace-level detail, and write plain-language instructions to tune autonomous behavior to match your team’s workflow.

Matt McSpirit, Microsoft Azure expert, shares how to take full control of incident response at scale.

Any alert, full stack.

The Azure Copilot Observability Agent correlates OpenTelemetry & native Azure signals end-to-end. Trace any issue to deep failure analysis across every tier. Check it out.

Logs. Metrics. Alerts. ML anomalies.

The Azure Copilot Observability Agent correlates them all, surfaces root cause, and recommends mitigation steps automatically. See it here.

Tune the Azure Copilot Observability Agent to match your team’s workflow.

Write natural-language instructions to set alert groupings, escalation rules, and issue priorities. See how.

QUICK LINKS:

00:00 — Azure Copilot Observability Agent

00:43 — How to use it as you work

01:33 — Unified Full-Stack Telemetry

02:39 — Root Cause Investigation

04:12 — Investigate further

04:55 — Re-run the investigation

05:36 — Autonomous Alert Correlation & Triage

07:13 — Natural Language Agent Customization

07:34 — Wrap up

Link References

Get started at https://aka.ms/ObservabilityAgent

Unfamiliar with Microsoft Mechanics?

As Microsoft’s official video series for IT, you can watch and share valuable content and demos of current and upcoming tech from the people who build it at Microsoft.

Subscribe to our YouTube: https://www.youtube.com/c/MicrosoftMechanicsSeries
Talk with other IT Pros, join us on the Microsoft Tech Community: https://techcommunity.microsoft.com/t5/microsoft-mechanics-blog/bg-p/MicrosoftMechanicsBlog
Watch or listen from anywhere, subscribe to our podcast: https://microsoftmechanics.libsyn.com/podcast

Keep getting this insider knowledge, join us on social:

Follow us on Twitter: https://twitter.com/MSFTMechanics
Share knowledge on LinkedIn: https://www.linkedin.com/company/microsoft-mechanics/
Enjoy us on Instagram: https://www.instagram.com/msftmechanics/
Loosen up with us on TikTok: https://www.tiktok.com/@msftmechanics

Video Transcript:

-When you run compute services at scale, issues are bound to happen. The real question is how quickly you can understand and fix them. This is where AI can cut through the noise, bringing you the right signals so that you can start your day with critical issues already investigated. Azure Copilot Observability Agent, powered by Azure Monitor, can run autonomously with knowledge of your environment, application topology, its dependencies and typical patterns. It monitors alerts streaming into Azure Monitor, triaging and correlating related alerts into issues requiring your attention so that you experience less alert fatigue and noise. The agent investigates critical issues to determine the root cause, and then recommends mitigation steps. Let me walk you through how you can use the Observability Agent to your advantage as you work.

-Using Azure Monitor, I can observe my app, across tiers. The App map shows me the topological view of my app. It’s a multi-tier app with a modern micro-service backend, hosted on Kubernetes, with a SQL database, Redis cache and more. The app also has an agent built in Microsoft Foundry, and with the new Foundry capabilities, I can also observe how it is performing from operational metrics, including Agent Runs, Gen AI Errors, Tool Calls, underlying Models, and Token Consumption. And scrolling up, we can even view traces with Gen AI errors and can see a list of traces. I’ll look at this one with 93 items. And if I click in, I can see a trace view of all the agent’s activities with direct integration into our existing backend APIs through an MCP server. This is where Azure Monitor and unified logging is foundational to connecting the dots for a more complete view of the health of your service. It unifies telemetry in real time across the stack using OpenTelemetry as well as native integrations with Azure Services and normalizes those signals into a consistent schema.

-And because everything shares the same data foundation, it’s easy for either you or the Observability Agent to move instantly from insights, such as failed requests to more details across different failure categories, which can be drilled into and queried further without having to stitch anything together. So, this way even though there are several teams involved across app and infrastructure managing my app, everyone shares a common operational view to keep it operating smoothly.

-In fact, let’s go back into Azure Monitor to see how my app is doing, specifically my agent. This time I’ll start in our agent alerts view. It looks like my agent is experiencing some errors I’ll choose this alert, to view additional details and this is where you can invoke the Observability Agent using the investigate button. Importantly, once you have Azure Monitor running in your environment, there is no setup needed.

-So, now I have the agent open. Let’s start the investigation. Now, when invoked for the first time, the Observability Agent will learn about your app, its topology, patterns, baselines, and more. In this case, the agent already has deep knowledge of my app so it launches directly into an investigation. It’s able to correlate and reason across signals spanning the full application stack, logs, metrics, alerts, application health, and ML-detected anomalies, to pinpoint the root cause of the incident. It plans, executes, backtracks, runs multiple queries and validates or disproves hypotheses, just like a human expert would. After completing the investigation, Observability Agent produces a detailed report with its findings. Now in this case, it’s discovered failures when the agent hit the MCP product catalog where the backend telemetry shows the underlying failure was a SQL execution time out. We can see a consistent time out pattern with 117 failed SQL dependency calls. It’s ruled out any issues with the Redis cache. And has determined that there was NO SQL outage.

-Instead, SQL metrics show a small saturation window at the incident start which dropped after the initial spike which would have led to connection failure. And it also charts its findings visually with search failures, latency spikes, failures by dependency and CPU and DTU spikes. And back on the left we see it’s recommending what can be done next, including how to improve querying and code, as well as monitoring.

-Now at this point, you can either start a new investigation or build off the Observability Agent’s findings. I want to investigate further. There are a few things that cause spikes like this so I’m going to clarify if our SQL server saw a spike in traffic leading to timeouts. The Observability Agent responds quickly and notes stable to moderate SQL volume with many of the details we saw earlier. This time though, it’s found the root cause. It appears that an expensive query consumed significant SQL CPU resources. I am also concerned about token usage during the incident so I’ll ask the Observability Agent to check for anomalies. And after it’s done its analysis, the agent rules out my hypothesis there too.

-So, it’s easy to collaborate with the Observability Agent, in the context of the incident. You can even ask the agent to re-run the entire investigation with additional instructions if you need to. Next, I want to create an issue that captures the progress of the investigation I’ll keep all the details and agree to share the agent chat around this issue so that it can be viewed by others on my team, which lets you hand off the issue to a colleague without losing context. The issue will retain the history of the incident, so no one has to start from scratch. In fact, this becomes a shared case file for the investigation.

-So, I just walked you through a manual flow for how you can use the new Observability Agent as you work. Next, let me show you how you can get the Observability Agent to work alongside you autonomously on your behalf with a new capability in public preview. Either from the marketplace or Azure Monitor, you can create a new Observability Agent resource.

-First, you start by giving it name, selecting the region, and your Azure Monitor workspace. Next, you’ll point it at your Application Insights resource. We’ll use our “ct-agent” from before. And then you can configure whether you want the agent instance to run autonomously on auto-created issues to provide root cause analysis and next steps. From there, I just review and confirm. The Observability Agent will then learn about your application to establish deep expertise and knowledge of your environment and preserve it in the agent instance. And if an alert arrives, the agent creates an issue automatically and correlates any additional related alerts into that same issue, before launching an investigation.

-Now once an investigation is underway, the Observability Agent notifies you, for example, via email, with background on the detected issue. And from there, you can review the overview and look at the associated alerts. As you can see, in our case, the Observability Agent was able to use deep, agentic reasoning to correlate separate alerts both for the agent in this application and for the backend APIs invoked independently and then bring them together into a single, unified view. This significantly reduces alert noise.

-Now this correlation is also important for issue triage. Because individually, these alerts might have lower severity, but when correlated, they increase the overall severity of the issue. And clicking into the Observability Agent tab we can see that the investigation is complete. This is a comprehensive report like we saw earlier with its analysis, corresponding chart visualizations, and recommendations on what to do next. Now as you set up agents, you can also customize them with your own instructions to prioritize what’s important. So, if we go back to where you create a new agent instance, here’s where you would add specific instructions, written in natural language. For example, you can tell an agent to group certain alerts, and prioritize the ones that should always trigger an issue so that its autonomous behavior matches how your team operates.

-So that’s the power of Azure Monitor with the Azure Copilot Observability Agent which together turn alerts into fully investigated issues with clear, actionable insights. By correlating signals across your entire stack, it helps you move from detection, to root cause, to action-faster, and without losing context. The result: less time triaging, faster resolution, and more resilient systems at scale. To learn more, visit aka.ms/ObservabilityAgent. Keep watching Microsoft Mechanics for the latest tech updates and thanks for watching.

New Security Controls in Edge for Business

Zachary-Cavanell — Fri, 26 Jun 2026 20:00:47 GMT

Extend Conditional Access, Purview DLP, and Defender controls into every session, across managed and unmanaged devices.

Block sensitive data from reaching unsanctioned AI services, lock contractors into your data boundary on devices you don’t manage, and control clipboard and screenshot actions by location. Manage extensions by permission type from the Microsoft 365 admin center and shut down scareware before users respond.

Jeremy Chapman, Microsoft 365 Director, shares how to deploy these controls using the security stack you already have.

Contractors access your SharePoint.

Saves redirect to your OneDrive. Edge for Business enforces your data protection policies on unmanaged devices through Intune App Protection Policies — no dedicated device required. Check it out.

Your clipboard, with a corporate boundary.

Copy from work, paste in work. Edge for Business blocks paste into unapproved apps automatically. Try it here.

Help shut down threats.

Edge for Business uses on-device AI and computer vision to detect and block fake support scam pages in real time. See how it works.

QUICK LINKS:

00:00 — Security built into the browser

01:30 — Shadow AI Data Blocking

03:03 — Contractor Work Profiles

04:22 — Configuration

05:16 — Advanced DLP & Clipboard Controls

06:29 — How to set it up

07:07 — Extension Management

09:20 — Protect from threats

10:13 — Wrap up

Link References

To get started, check out https://aka.ms/EdgeforBusiness

Unfamiliar with Microsoft Mechanics?

As Microsoft’s official video series for IT, you can watch and share valuable content and demos of current and upcoming tech from the people who build it at Microsoft.

Subscribe to our YouTube: https://www.youtube.com/c/MicrosoftMechanicsSeries
Talk with other IT Pros, join us on the Microsoft Tech Community: https://techcommunity.microsoft.com/t5/microsoft-mechanics-blog/bg-p/MicrosoftMechanicsBlog
Watch or listen from anywhere, subscribe to our podcast: https://microsoftmechanics.libsyn.com/podcast

Keep getting this insider knowledge, join us on social:

Follow us on Twitter: https://twitter.com/MSFTMechanics
Share knowledge on LinkedIn: https://www.linkedin.com/company/microsoft-mechanics/
Enjoy us on Instagram: https://www.instagram.com/msftmechanics/
Loosen up with us on TikTok: https://www.tiktok.com/@msftmechanics

Video Transcript:

-They say the most secure device is the one that isn’t connected, but in reality, more than half of the work we do happens in one app, the browser. It’s always connected, always in use, and it’s constantly exposed to threat activity. It’s the one place where identity, data, and apps come together, and it’s also where security has to be enforced. Microsoft Edge for Business applies security controls directly inside the browser, where the activity is happening. Threat signals are evaluated in real time during the session, without routing traffic through external proxies. And controls are enforced, powered through native integration with the Microsoft security stack with identity and access management in Microsoft Entra, data security controls in Purview, and threat detection and response in Defender.

-In fact, just as you manage users and applications today, Edge allows browser sessions to be governed on a managed device and by using a work profile also on unmanaged devices. A work profile provides a separate browser space linked to the user’s work account in Microsoft Entra to keep company data isolated from personal browsing.

-When a user is signed into their work profile your existing security policies such as access controls through Conditional Access, data security, with Data Loss Prevention controls and extension restrictions, can be enforced. This lets you establish clear boundaries for what’s allowed and what isn’t, without disrupting how people work. Let me make this real, by showing you how policies are applied in practice across five common everyday scenarios, starting with Shadow AI apps and services and preventing company data leakage. Here, I’m an employee on my managed device using the consumer AI service, DeepSeek.

-In this case, our company has already flagged it as an unsanctioned AI app and blocks it from being used with sensitive work information. So, I’ll type in a prompt that includes details about an acquisition that Contoso is planning. This is classified as confidential information, and tied to existing DLP policies in Microsoft Purview So, when I hit submit, the prompt is blocked in real time, with a clear explanation for why. The sensitive data never leaves the browser and is never sent to DeepSeek. And the user is guided to use trusted AI, in this case Copilot, for our organization.

-Importantly, these same protections would also apply across all Edge profiles on my managed device whether work, personal or guest profiles. In fact, let me show you how this was set up using policies. This uses a Microsoft Purview Data Loss Prevention Policy to protect Inline web traffic. This is a pay-as-you-go licensed option, which is scoped to managed cloud apps and it can be targeted using adaptive app scopes for all unmanaged AI apps. And its enforcement is set to Edge for Business, as you can see here. The rest is configured like any other Purview DLP policy that you’re already using. Next, let me show you how Edge work profiles create a secure boundary for temporary or contract workers to securely access company data without exposing it to their personal environment. Using Work Profiles in Edge, you can enforce policies that require contractors to sign-in to an account in your company’s Microsoft Entra directory to access internal information.

-Here, I’m logged into Microsoft Edge as a contractor at Woodgrove working temporarily for Contoso. I have an acquisition document open in Word online, which is stored in a Contoso SharePoint site. Importantly, I’m using my Work Profile with an Entra ID account that Contoso provisioned for me on my corporate device, which is managed by my employer, Woodgrove.

-Let’s see what happens if I try to download a local copy of this file containing sensitive information. And you can see it redirects the save to a Contoso-managed OneDrive location, so it never leaves Contoso’s information protection boundary. Even when the device is controlled by another organization, Edge for Business still enforces Contoso’s data protection policies through the work profile. So, as a contractor, I get the access I need, and my contracting company stays in control without the added cost and complexity of giving me a dedicated device or virtual machine. Now let me show you how this was configured using policy. It starts with giving contract workers an account in your directory so that you can apply management policies to them, along with a eligible Microsoft 365 license, including Business Premium or E3.

-From there, in Microsoft Intune, you’ll use an App Protection Policy, like this one I’ve started. In Properties, we can see that it’s applied to Microsoft Edge. And when I open Data Protection, there are controls to receive and send data, as well as controls to prevent cut/copy/paste from or to external accounts, docs, locations and apps. These ensure that those activities stay within your work profile boundary. In the same policy, you can also allow or block printing org data. Once you’ve done that, your policies are contained within that profile even if you don’t manage their device. Let’s move onto our next scenario, Advanced DLP. If you’re using information protection policies in Microsoft Purview, those protections natively work in the Edge browser to protect your sensitive data without requiring any add-ons or extensions.

-For example, if I try to capture a screenshot from a protected spreadsheet, the action is blocked. And any actions you’ve restricted by policy, like printing or downloading local copies, those are also enforced directly in the browser. And since not every protection is one size fits all, there are granular controls that permit working with sensitive information in trusted locations, but block it in untrusted locations.

-Here, I’m working on a Power BI dashboard with sensitive information and I’ll copy that to my clipboard. Now if I move to a trusted location within my security boundary, like this Word Online document stored on our SharePoint site, I am allowed to paste the information from my clipboard into the doc. That said though, for any location outside of our company security boundary like this personal messaging app, I’m blocked from pasting sensitive information with a clear message telling me why. Now these protections extend to Microsoft Edge running across device platforms. Let me show you how this was set up as an admin.

-First, in Microsoft Defender Settings under Cloud apps and Conditional Access App control, you can enable Edge for Business protection. And to ensure that the data security policies you set are enforced, the Enforce usage of Edge for Business makes it the browser required to access company resources. In Microsoft Entra, you’ll configure a Conditional Access policy to grant access only when an App Protection Policy is in place.

-Then, in Microsoft Purview, you can use Data Loss Prevention policies with Edge for Business protections in scope. And building on those in-browser controls, let’s take a look at how you can manage extensions and control what’s allowed to run on users’ devices. In fact, extensions are one of the biggest security and data risk surfaces in the browser. They have deep access to browser data, and without control, they can become a direct path for sensitive information to leave your organization. When a user in your organization on a managed or unmanaged device using a work profile attempts to install an unallowed extension, they are blocked.

-Optionally, you can allow users to request exceptions to the block, in this case, a tenant administrator needs to approve the request. In fact, let’s take a look at the Edge for Business management options. From the Microsoft 365 admin center, under Settings you’ll find new management controls for Edge for Business. This is where you can monitor extensions and you’ll see that the one request our user just made is already in my queue.

-Below that, you’ll find security insights to ensure that your users’ Edge browsers are up-to-date. And moving over to the Configuration Policies tab, you can manage browser settings for users in your organization, including policies for extensions. In fact, I’ll click into this policy that I’ve created and then going into its settings, you’ll see that these policies apply across operating system platforms. And in Extensions, you can allow or block extensions, hosted apps, themes and scripts, decide whether users are allowed to install external extensions, not from the Edge add-ons store. Under that are defined locations where users can install external extensions from, and then permissions and URLs you can block interactions with defined URLs and explicitly allow extensions to interact with other host URLs.

-Then for blocked extensions, you can permit users to make requests for the extensions you block, like we saw before with our user. And specifically, you can block extensions based on the types of permissions they request, like clipboard access, desktop capture, scripting and system memory. Finally, there are also options to explicitly allow managed extensions from the Edge add-on store, as well as sidebar apps, or external extensions using their their Extension ID, Name and Description from the Chrome web store.

-Now, extensions are one way that risk can enter the browser, but they’re not the only way. Threats can also come directly from the web itself. So let’s switch from controlling what runs in the browser to protecting users from what they encounter online, like scams and scareware. These full-screen takeover pages are designed to pressure users into calling fake support or handing over control of their device. In a corporate setting, that creates a real risk of data exposure and unauthorized access. Now unlike site reputation-based detection, Edge helps mitigate this in real time with AI-powered on-device protection, it uses on-device computer vision for screen content to automatically block scareware, removing the burden from the user. This capability is policy configurable and enabled by default on systems with more than 2GB of RAM and four four CPU cores.

-So that’s how Microsoft Edge for Business keeps your users and data secure, enforcing your existing security controls directly in the browser, where identity, apps, and data come together. To learn more and get started, check out aka.ms/EdgeforBusiness And keep watching Microsoft Mechanics for the latest deep dives and updates. Thanks for watching!

Build Agent Architecture using AI Landing Zones

Zachary-Cavanell — Thu, 25 Jun 2026 16:02:25 GMT

Establish a shared Governance Hub to centralize model access, MCP catalogs, and policy enforcement, then give every agent a traceable identity, runtime protection, and data governance through Agent 365. Layer in Microsoft Fabric’s Ontologies so your agents reason over real business context, not just raw data. Choose your runtime — no-code, hosted container, or custom — and deploy a production-grade environment in minutes using the AI Landing Zone accelerator.

Matt McSpirit, Microsoft Azure Expert, joins Jeremy Chapman, Microsoft 365 Director, to share how to architect, govern, and scale a full agent mesh across the Microsoft stack.

One model gateway governs all AI traffic.

Azure API Management enforces policies, caps workload quotas, & attributes costs per team. Pair it with Azure API Center for a full MCP catalog. Check it out.

Improve AI output quality across every query.

Fabric IQ in Microsoft Fabric treats knowledge models as shared, governed assets. Ontologies give agents an explicit map of your business entities, processes, and relationships. Get started.

No-code, hosted, or custom container.

Pick the runtime that fits your agent. Foundry & Copilot Studio handle orchestration, telemetry, and identity. External runtimes like AKS or EKS plug in through the governance hub. See it in action.

QUICK LINKS:

00:00 — Build secure AI agents

01:07 — Accelerate development, reduce risks

02:51 — Model Gateway + MCP Gateway

03:24 — Agent 365 Unified Control Plane

03:56 — Azure Policy + Azure Monitor

04:27 — Intelligent data platform

05:37 — OneLake in Microsoft Fabric

06:39 — Microsoft Purview data governance

07:13 — Fabric IQ with Ontologies

07:51 — Landing Zones

09:23 — Three Hosting Runtimes

11:06 — AI Landing Zone Accelerator

13:16 — Scalability

14:16 — Wrap up

Link References

Check out https://aka.ms/AIArchitecture

Unfamiliar with Microsoft Mechanics?

As Microsoft’s official video series for IT, you can watch and share valuable content and demos of current and upcoming tech from the people who build it at Microsoft.

Subscribe to our YouTube: https://www.youtube.com/c/MicrosoftMechanicsSeries
Talk with other IT Pros, join us on the Microsoft Tech Community: https://techcommunity.microsoft.com/t5/microsoft-mechanics-blog/bg-p/MicrosoftMechanicsBlog
Watch or listen from anywhere, subscribe to our podcast: https://microsoftmechanics.libsyn.com/podcast

Keep getting this insider knowledge, join us on social:

Follow us on Twitter: https://twitter.com/MSFTMechanics
Share knowledge on LinkedIn: https://www.linkedin.com/company/microsoft-mechanics/
Enjoy us on Instagram: https://www.instagram.com/msftmechanics/
Loosen up with us on TikTok: https://www.tiktok.com/@msftmechanics

Video Transcript:

- How do you design an enterprise-ready AI agent architecture that scales fast without bypassing security and control? It’s possible, and it doesn’t need to slow down your developers. In fact, in the next few minutes, we’ll show you how you can implement this architecture across the Microsoft stack and demonstrate what you can do right now to get started. And to explain the mechanics behind it, I’m joined once again by Azure expert, Matt McSpirit. Welcome back!

- It’s great to be back!

- So, there’s a lot of agent development going on right now, a lot of development, and the raw speed of that can mean that people aren’t always optimizing for scale or re-usability or potential security risks. It’s a bit like the wild, wild west out there.

- That’s right, and that’s part of what makes it so exciting right now. But it also creates some real challenges. You’ve got teams building agents in silos, often without a shared approach or standards. On top of that, there’s frequently direct, ungoverned access to models and data, which raises concerns. And when you layer in inconsistent identity management and limited auditability, it becomes harder to scale things responsibly or maintain control as all of this grows.

- Okay, so what can be put in place then to accelerate agent development, but also reduce our risks so we can get kind of a win-win?

- Well, you’re setting a high bar! And it’s totally possible. One of the best things you can do to unlock developers and agent coding is to establish a catalog of shared services and resources, which exists in two parts. The first provides a shared platform that centralizes AI model registries, knowledge sources, such as MCP servers, APIs, and agents, making them easy to discover and use, along with shared identity and access management, policy engines, and reporting for consistency and observability. We call this the governance hub, and it’s directly tied to Agent 365 and architecturally part of what we call the Platform Landing Zone. The second part, which we call the Intelligent Data Platform, consists of the shared data components themselves, including core operational data as well as the underlying data that agents connect to via MCP Servers and APIs. These are managed data sources spanning structured and unstructured data, where each can be leveraged as tools for agents. Then you have a third component, the Application Plane with defined AI Landing Zones, which are specific to individual agents or sets of agents with similar requirements and policy controls. They’re important because not all AI apps and agents should have the same resources or controls applied to them. Now, together, it’s an enterprise-wide pattern for how agents discover and invoke models, tools, data, and other agents. And at the same time, this allows teams to run decentralized and to choose the runtime that best fits their agent. And for peace of mind, everything is wrapped in a common set of reporting with shared policy and access controls.

- Okay, so why don’t we make this real for everyone who’s watching right now and go through all of these components and their corresponding architecture?

- Yeah, sounds good. Let’s start with the shared governance hub, which as mentioned, is made up of a few components. First, the AI gateway in Azure API Management enforces policies and routes AI traffic, and enables transparent per‑workload cost attribution. Next, the MCP gateway provides a central catalog of MCP Server data, enabling agent access to knowledge sources using the Model Context Protocol while managing inventory and access permissions. The governance hub also includes Agent 365 as the unified control plane for agents, which itself contains agent management as part of the Microsoft 365 admin center. Then Microsoft Entra enforces strong identity with least privilege access and clear ownership for agents. Microsoft Defender adds runtime protection and deep observability with end-to-end activity tracing and detection. And finally, Microsoft Purview enforces data protection and posture by monitoring how agents interact with sensitive information. Finally at the platform level, you’ll use services like Azure Policy to manage any resources running in Azure directly, or via Azure Arc for anything outside of the Microsoft cloud, including on-premises or in other cloud platforms. Then Azure Monitor for unified reporting of infrastructure, application and agent services, along with the resources or tokens consumed.

- So, the governance hub then is like a central set of shared enabling services and plumbing that you connect to and view and control agents with and all the related activities. And it really glues everything together, but it doesn’t include the agent frontend, the logic, the backend, so where do those parts come in?

- So, those all come next. Moving on to the Intelligent Data Platform, this provides the managed data for agents to reason over. This is valuable, unique information to the business. For agents to work well, connected data needs to be trusted and clearly understood. And the platform comprises grounding sources optimized for agent reasoning, with several options depending on the nature of what agents are designed to do. For example, the Work IQ API provides the context for how you work, with connections to your email, calendar, previous meetings, Teams chat, files, and more. Foundry IQ then lets you combine multiple knowledge sources for your agents, where everything from structured data sources in databases, to unstructured data in your cloud stores, even images, can be retrieved by agentic processes. And Fabric IQ can then be used to add context over your connected business operations, like sales data, customer records, logistics, and more. You can combine the output of all of these IQs to generate richer, more relevant responses.

- Right, and speaking of Microsoft Fabric, it really forms the foundation for operational data in the Intelligent Data Platform, along with things like governance and security, so why don’t we spend some time then to explain all of this further? Why don’t we start with the data lake and how we can manage underlying operational data?

- Sure, this is where OneLake in Microsoft Fabric plays an important role. As a unified enterprise data lake, it brings in all operational data across multiple sources. Database mirroring continuously replicates data from on-premises and cloud databases. And shortcuts enable virtual access to external platforms like Databricks, Snowflake, and major cloud object stores without data movement, allowing it to be queried as a single unified data source. For batch and data streaming ingestion of continuous data feeds, Fabric Pipelines and Real-Time Intelligence can be leveraged by your agents. Everything in Microsoft Fabric is stored as Delta files, allowing them to be queried with SQL or Spark. And all access is secured through Microsoft Entra down to row and column level.

- Okay, so as agents scale and start acting on business information autonomously, controls over that data are really important to prevent sensitive data from getting into the wrong hands.

- They are, and this is where ideally your data should be organized as domain-owned products with clear ownership, data quality controls, and observable policies, so this is where Microsoft Purview can help. It’s got built-in data governance capabilities across the lifecycle from discovery and cataloging to automated classification, end-to-end lineage, policy-based access controls, and auditing. And if your operational data is running on Fabric, the context for agents gets better. Most sources and even the best MCP Servers do not encode business meaning, process, relationships, and priority. And that’s where Fabric IQ comes in to treat knowledge models as shared, governed assets, explicitly representing business entities, relationships, and metrics in a machine-readable form to improve AI output quality and relevance. It uses Ontologies to represent operational models by defining business entities and the relationships that connect them. These give agents an explicit, machine-readable representation of business analytics. And all of this ensures that your agents have consistency, control, and traceability.

- Okay, so now with our data and control backends in place for secured access to business context, why don’t we move on to agent-specific controls?

- Yeah, and that’s where AI Application Landing Zones come in. We did a whole Mechanics show on this a while back, and they can be used for individual or multiple agents with similar policy requirements. Each landing zone is a spoke subscription boundary that hosts per-workload resources under the ownership of an AI project team. It’s a best practice for apps, and this translates to agents as well. So, here, each project team is responsible for solution delivery and operations within the boundary of the application landing zone. And these still leverage the shared set of resources as part of the platform landing zone, including identity and security controls. This separation matches how enterprises actually structure their teams and operate, where the central team enforces baseline controls, while project teams build and run workloads. Each landing zone itself is a standardized foundation, with its own private networking configuration, AI-specific resources, monitoring and telemetry, along with application services including containers. Everything is managed using Azure Resource Groups, so there are clear RBAC boundaries. And each landing zone is integrated with the governance hub and the intelligent data plane. This way, you have the structure for developers to deploy production-ready agent solutions without violating corporate policies or provisioning new foundational infrastructure for every project.

- That said, there are always seems to be new ways to build agents these days, so how does the Application Plane then support development?

- Well, enterprise scenarios have different trade-offs. This balances convenience, control, extensibility, and operational responsibility, so we support three hosting formats as runtimes. First, there’s no-code and low-code agents implemented as prompt agents and workflows within Microsoft Copilot Studio and in Microsoft Foundry Agent Service. You’d use managed services in the platform for orchestration, evaluation, and telemetry, each leveraging MCP tools, knowledge grounding, and project-scoped observability. Then you have hosted container agents running in Microsoft Foundry. These are built-in code. And they benefit from core capabilities like conversation history storage and identity and access control, private connectivity, along with agent and fleet-level telemetry and tracing. And when interacted with, they operate under project-level orchestration and centrally applied governance, ensuring policies and guardrails, such as content filtering, prompt injection protection, and copyright safeguards, are consistently enforced. Then, finally, there are custom container-hosted agents, which run externally, outside of Foundry, in places like Azure Container Apps, Azure Kubernetes Service, or non-Azure environments, like EKS. All three still consume hub-mediated models and tools and use identity patterns to avoid unmanaged distribution, while sending telemetry for end-to-end observability. A key part of this is that model and tool access is mediated by the governance hub so that they can use template-driven patterns instead of unique embedded endpoints and credentials for each agent.

- So, we’ve shown these before for apps. Is there an accelerator then to deploy AI Landing Zones?

- Yeah, the landing zone accelerator provides infrastructure-as-code templates and continuous delivery pipelines. It’s a production-grade reference architecture, and I’ll show you where to find it and how to set one up. First, you can find the AI Landing Zones page on GitHub using aka.ms/AILandingZone. This site contains all of our documentation. Below, you’ll see the Reference Architectures and the automated Extensible Implementations to get the underlying services up and running. You can deploy these using the Azure CLI, Terraform, or using the portal method, so I’ll choose the Azure Portal option so I can show you what gets deployed. You’ll start with the normal project and instance details. so here, you can choose if you want Platform Landing Zone Integration. I’ve chosen no in this case. Next, you’ll see all of the selectable AI services, data backend, Key Vault, and storage. Then the application services, including container infrastructure. Followed by the DevOps configuration with jumpbox options. Next is ensuring that monitoring is configured with Log Analytics and App Insights. Everything uses OpenTelemetry signals and standardized telemetry pipelines so that traces and metrics can be correlated across your agent activities. Then there are all of your network configurations, with firewall and virtual network settings. These are configured with defined private networking posture with virtual networks, private endpoints, network security groups, and private DNS to eliminate public ingress paths between agents, gateways, telemetry, and managed retrieval stores for data. Of course, you’ll want to add the right tagging for this specific project. And after the service runs a quick validation check, you can Create all of the selected resources. And since we’re creating dozens of new resources and more than a hundred deployments counting the dependencies and configurations, this will run several minutes, so we’ll jump ahead to the results. And in the corresponding resource group, you can see all of the resources deployed, networking, Foundry AI, container apps, Cosmos DB instance, monitoring, storage, and our jump VMs. Everything deployed uses managed agent identities as the default mechanism for service-to-service access, avoiding any credential distribution.

- Okay, so now we’ve got everything configured and deployed, so how would all this scale over time?

- Yeah, this is really important as agents proliferate so you can manage them. The first thing is unique agent identities, which ensures that every agent has clear ownership, permissions, and lifecycle status, so actions can be attributed even in autonomous execution. Next are your shared policy baselines and guardrails, where for example, you enforce authentication, authorization, data access, as well as content safety controls so that they’re consistent across the different agent runtimes. Then you have consistent and defined observability, where your organization can trace interactions for each agent, along with the tools and data they use, as well as correlate failures and attribute costs and risks to each agent via monitoring. It also helps to create agent templates for developers, just like you would for applications, so they can reuse what works instead of reinventing the wheel. And with that in place, you can speed up deployments while still maintaining the right controls and visibility across your agents.

- Now we’ve got our architecture, and for anyone who’s watching right now, looking to learn more and get started, what do you recommend?

- Well, first, you don’t have to wait. You can get started today by expanding your governance hub and pulling together your registry of data products, MCPs, APIs, models, and agents. Also, make sure that you have the right shared resources and policies at the platform level, and start building! Check out aka.ms/AIArchitecture for more information.

- Thanks, Matt, for joining us today and showing how you can build an agent mesh out in your organization. Of course, keep checking back to Microsoft Mechanics for the latest updates, subscribe if you haven’t already, and thanks for watching.

Rayfin | Go from prompt to production backend

Zachary-Cavanell — Tue, 23 Jun 2026 16:06:02 GMT

Describe the app you want using Rayfin’s open-source SDK with GitHub Copilot, and generate your full backend in code — schemas, relationships, and access policies included. Deploy to Microsoft Fabric with a single CLI command and immediately inherit enterprise data security, identity controls, and audit compliance already in place across your data estate.

Connect your app’s live operational data to years of historical records in Fabric from the moment you deploy, no pipelines, no data movement. Query across both datasets using a Fabric data agent you spin up directly on your app’s data.

Will Thompson, Microsoft Fabric Principal Product Manager, shares how to take an app from idea to governed production deployment in a single session.

Describe the app you want.

Rayfin and GitHub Copilot generate your full backend in code- schemas, relationships, and access policies. No manual wiring. See how it works.

One CLI command.

Fully managed SQL database, APIs, and static hosting in Microsoft Fabric. Rayfin handles provisioning automatically. Take a look.

Spend less time configuring. Spend more time creating.

Get managed backend services, authentication and authorization, data APIs, built-in analytics, and AI-ready architecture with Rayfin. Check it out.

QUICK LINKS:

00:00 — Simplify backend complexity

01:20 — Home delivery service app

01:48 — Data analysis app

02:26 — See the build experience

03:08 — Copilot Generates Full Backend

03:47 — Authorization defined alongside schema

05:06 — One CLI Command Deploys to Fabric

05:21 — Create analytics app & add pages

06:31 — App Data Connects to Fabric Data Estate

06:55 — Conversational Data Agent on App Data

08:13 — Wrap up

Link References

Get started at https://aka.ms/rayfin

Unfamiliar with Microsoft Mechanics?

As Microsoft’s official video series for IT, you can watch and share valuable content and demos of current and upcoming tech from the people who build it at Microsoft.

Subscribe to our YouTube: https://www.youtube.com/c/MicrosoftMechanicsSeries
Talk with other IT Pros, join us on the Microsoft Tech Community: https://techcommunity.microsoft.com/t5/microsoft-mechanics-blog/bg-p/MicrosoftMechanicsBlog
Watch or listen from anywhere, subscribe to our podcast: https://microsoftmechanics.libsyn.com/podcast

Keep getting this insider knowledge, join us on social:

Follow us on Twitter: https://twitter.com/MSFTMechanics
Share knowledge on LinkedIn: https://www.linkedin.com/company/microsoft-mechanics/
Enjoy us on Instagram: https://www.instagram.com/msftmechanics/
Loosen up with us on TikTok: https://www.tiktok.com/@msftmechanics

Video Transcript:

-What if building a real, production-ready enterprise app didn’t take months, but just a few hours? Today, AI can generate app logic and front ends almost instantly. And while everything works great with test data, the moment you try to connect that app to real enterprise data, everything slows down. Because now you have to wire up a database with access control, set up authentication, configure backend services, and make sure everything is secure and scalable. Your quick app turns into a complex backend project with multiple failure points, and that’s where Rayfin comes in. It’s designed to simplify backend definition in code and elevate the developer experience. Our open-source SDK and CLI grounds your agentic coding tools so that when you describe the app that you want to build, it can automatically define your app’s backend in code, including your data schemas, relationships, and access policies.

-And then with a single CLI command, you deploy to our unified data and analytics platform, Microsoft Fabric. This spins up a fully managed backend with a SQL database with familiar billing and sharing models, as well as static hosting. APIs are generated automatically to ensure your app can communicate securely to data and services and Fabric’s identity and data security layer ensures that when your app accesses or queries data, it respects existing policies in place across your data estate.

-To show how this works in action, I’ll start by showing two apps I built with Rayfin and then walk you through how I created them. My first app is a mobile home delivery service app for a home improvement retailer, with all orders delivered directly to customers’ doors. Drivers must be signed in to access the app, ensuring that every delivery is securely tied to an authenticated user. They can record deliveries, capture photos as proof, and even collect customer signatures to acknowledge receipt. And all this happens in real time.

-Next, as a business, we want to learn from the data captured in our delivery app. So I’ve built a second app for data analysis. Because it runs in Fabric, the operational data is already connected to our broader enterprise data estate. It has access to years of customer data in Fabric, modeled and ready to use. And by connecting that data to the live data that our delivery app captures, retail managers now have immediate insight into how the new delivery service is impacting customer satisfaction. Now these apps were built in minutes. They’re not a proof of concept. They have real auth, real data, and real governance, and they work directly with enterprise data already in Fabric.

-Let me walk you through the build experience. I’ll open a terminal and run the Rayfin create command, and this will walk me through my entire project setup. I can see that I have various templates that I can use to get started. So let’s go with the blank app template. It’s asking for a name and I’ll name it Delivery App. And you can see it’s creating the project. And under the covers, it’s installing all the necessary dependencies and adding the files I need, including the agent instructions for using the SDK and CLI. Now I can CD into my project and start the development server. Since deploying to Fabric, it prompts for a Fabric workspace name and I’m going to use Zava. And the deployment process is now in full swing with Fabric provisioning my foundational resources.

-So now with our Rayfin foundation in place, let’s build the app. Using VS code with GitHub Copilot, I can now describe the app I want and Copilot knows how to build it, including the backend. Let’s try it out, I’ll type a prompt, build a Rayfin delivery app where drivers log deliveries with photos and item conditions and customers confirm receipt. I’m also going to start the Rayfin MCP server and this will help ground Copilot in all the latest best practices for Rayfin. As Copilot is getting to work, we can see it’s using the documentation for the MCP and CLI tool to understand the specifics of Rayfin. And Copilot will run independently using the skills defined by the Rayfin template. That’s going to take a few minutes, so we’re going to jump ahead to the results.

-Here’s the app right here in code and there’s lots more to it, in fact, to understand the depth of what was created, let’s take a more detailed look. Inside the Rayfin folder, we can see our whole data schema, customers, deliveries, items, photos, drivers, and more. And if we take a look at how Copilot defined the driver entity, this is where Rayfin shines. The schema lives right in the code, which means instead of keeping the rules about your data in separate places like databases, SQL files, or configs, they’re built right into the code. So things are less likely to break and easier to keep consistent. Each field maps to a column in the database. ID name, email, and optional phone number with types and constraints built in.

-And it captures relationships too. It calls out a driver has many deliveries. But here’s the key part, the access policy sits right next to the data. This rule says a user can only ever touch their own driver record. Authorization is defined alongside the schema not bolted on later. And if we open the delivery entity, you can see some of the scale Rayfin is capable of with richer relationships, defined with drivers, customers, and items, and a smarter policy where delivery can be read by an authenticated driver or its customer. And of course I can always customize any of this by hand if I need to. So that was the build experience.

-Now let’s look at how we can deploy the app to Microsoft Fabric. I’ll ask Copilot to deploy our app and Copilot is using the Rayfin Up command to deploy everything we’ve defined straight to Fabric. And just like that, our app is deployed and available. Next, directly from Fabric, I’ll show you the steps to create our analytics app. I’ll start in the Fabric portal this time and I’ll call this app Delivery Analysis. This leverages a template that the Microsoft Power BI team built. It’s called a Data App template, and it gives our coding agent what it needs to connect to semantic models and create beautiful interactive visuals.

-So I’ll select Data App, and now I can manually follow these steps or just copy the prompt and run it in VS Code to get started scaffolding my project. I’ll move over to VS Code and paste in the prompt and the agent knows exactly how to start up my new Rayfin app. Once it’s finished, you’ll see that the delivery analysis directory has been added. Now we can also add pages to our new app using Copilot. Here I want to add an insights page. So I’ll prompt, Add a customer satisfaction page, which shows historical CSAT scores from our linked semantic model and compare it against a given driver’s delivery ratings. The important detail here, I’m pointing it straight at our Fabric semantic model, so it’s using a preexisting and trusted business model. This process will run for several minutes, creating and executing a plan and querying our semantic model for what it needs.

-To save time, I’ll jump back in near its completion. Now the app is ready and I can view it from the provided link. And we can see historical customer satisfaction data trending up since we launched the delivery service with details broken down by driver. Now, data isn’t moved between systems. Everything stays connected from the start. The backend is already connected to your enterprise data estate. And because all of your new data is now also landing in Fabric, there’s lots you can do on top of it.

-Now that our app is live and generating data, the next step is making that data actionable through conversation. So instead of building another report or connecting the data to a Fabric notebook, I’m going to go ahead and create a data agent directly on top of this app’s data. I’ll name the agent, Zava Insights Agent, and next I’ll point it at the warehouse I configured earlier. This combines my operational database and historical data as the source. And now I can ask questions against my data just like I would to an analyst.

-Let’s start with a simple question. I’ll ask, what is the average customer rating across all our deliveries? The agent understands the data model and returns the answer instantly as 4.56 out of five. But now I’ll go deeper. How does our customer satisfaction compare before and after we launch the new delivery service? It doesn’t just retrieve the data. It reasons across time and trends in the model. And we can see that it’s gone from 3.8 to 4.4 out of five since launching the new service. So instead of navigating dashboards, the business can now ask questions directly against the app and get answers grounded in the same governed data that powers the app.

-And just like any Fabric artifact, I can share the app that we created earlier with other people in my organization. So let’s grant Lynne access. They were asking about the delivery analysis and now they can explore the data themselves without waiting on reports. Rayfin helps you go from idea to production faster. By using AI to build and deploying to Fabric, your app inherits existing data security controls, permissions and audit requirements, keeping everything compliant and under control.

-To learn more, check out aka.ms/rayfin and keep watching Microsoft Mechanics for the latest tech updates and thanks for watching.

Agent 365 | Identity & Access Controls in Entra

Zachary-Cavanell — Fri, 12 Jun 2026 13:35:57 GMT

Surface agents across AWS Bedrock, Google Vertex, Databricks, and Salesforce in one registry, assign Entra Agent IDs via CLI or SDK, and enforce least-privilege access through Conditional Access policies and Agent Blueprints, all without rebuilding your existing identity infrastructure.

Lock down agent activity with sign-in logs that capture every authentication attempt, policy hit, and failure. Govern agents as first-class identities alongside your users, apps, and devices, and draw a hard line between managed and unmanaged AI in your organization.

Vince Smith, Microsoft Entra Principal Product Manager, shares how to establish full visibility, access control, and lifecycle governance for AI agents using Microsoft Entra and Agent 365.

Transform unmanaged agents into a managed agent identity.

CA policy enforcement, lifecycle controls, & full audit trail—start with Agent ID in Microsoft Entra.

One Agent blueprint. Multiple agent identities.

Use Agent blueprints in Microsoft Entra to enforce least-privilege access for agent identities at scale. Start here.

Lock down agent activity in Microsoft Entra.

Get full audit visibility into every sign-in, Conditional Access decision, and failure reason. See how it works.

QUICK LINKS:

00:00 — Visibility and control with Agent 365

01:39 — Multi-platform registry sync

02:29 — Assign Agent ID

04:14 — Agent Blueprints

05:24 — Conditional Access for agents

06:24 — Sign-in logs audit trail

07:03 — Unblock the agent

07:54 — Wrap up

Link References

Check out https://aka.ms/EntraforAgents

Unfamiliar with Microsoft Mechanics?

As Microsoft’s official video series for IT, you can watch and share valuable content and demos of current and upcoming tech from the people who build it at Microsoft.

Subscribe to our YouTube: https://www.youtube.com/c/MicrosoftMechanicsSeries
Talk with other IT Pros, join us on the Microsoft Tech Community: https://techcommunity.microsoft.com/t5/microsoft-mechanics-blog/bg-p/MicrosoftMechanicsBlog
Watch or listen from anywhere, subscribe to our podcast: https://microsoftmechanics.libsyn.com/podcast

Keep getting this insider knowledge, join us on social:

Follow us on Twitter: https://twitter.com/MSFTMechanics
Share knowledge on LinkedIn: https://www.linkedin.com/company/microsoft-mechanics/
Enjoy us on Instagram: https://www.instagram.com/msftmechanics/
Loosen up with us on TikTok: https://www.tiktok.com/@msftmechanics

Video Transcript:

-Ensuring agents don’t operate unchecked in your environment means making sure their access to data and apps, along with other agents and resources, is appropriately scoped, and no more than necessary, so they’re never overprivileged. Agent 365 gives IT and security teams a unified control plane for agent activity. They can work together using the tools they already work in every day to see which agents are in use, understand the risk, and act before issues escalate. Today, in part 3 of this Agent 365 series, we look at how, as an identity admin using Microsoft Entra, you can establish the critical foundation to prevent agents from being both overprivileged or running without the right level of visibility.

-This all starts with Agent 365, which gives you visibility into your agents, control over what they can access, and governance across the entire lifecycle. As a developer, you can use the Agent 365 CLI and SDK to create and integrate an Agent ID into your agent. This ensures your agents can be managed across their lifecycle, with continuous risk evaluation and least privileged conditional access controls in Microsoft Entra, ensuring that agents can only connect to and act on the resources they truly need, for as long as they need, no more, no less.

-Just like with your users and apps today, with Agent ID, agents become explicitly manageable and governable, including conditional access policies and access packages. And by assigning an Entra identity to your agents, you establish a clear boundary between managed and unmanaged AI, which makes it much easier to detect which agents need to be brought under control. Let’s start in the Microsoft 365 Admin Center to see this in action. As an IT admin, you can access Agent 365 controls to view your agents, find unmanaged AI in use, and configure tools and settings. I’m in the Agent 365 overview page, where I can find top-level insights and metrics, as well as common actions. In fact, the Registry sync controls let me configure these options, so let’s take a look. And you can see that we’ve already configured sync for AWS Bedrock and Google Vertex, which gives us visibility into agents running on those platforms.

-Just to show you what’s behind this and your options, I’ll click Connect a platform. And under External platforms, we can see Bedrock and Vertex here, along with Databricks Genie and Salesforce AgentForce. The respective agents will peer in the agent registry once I sync from these platforms. That said, while we were able to see the agents from those platforms running in our environment, without respective Agent IDs, we won’t have visibility into exactly what those agents are accessing. In fact, here we can see that all of our Amazon Bedrock agents are currently unmanaged. And when I click in, we can see a few details about the agent creation date and publisher, but not much else. So we know these agents exist, but again, without an Agent ID, we don’t know exactly what these agents are accessing to be able to apply the right controls for their needs.

-Practically speaking, our first step here is to work with the unmanaged agent creators to get their agents an Entra ID. This is where, as a developer creating and updating agents, we can use the agent 365 CLI and SDK to create an assign and Agent ID, which also includes an Agent Blueprint. I’ve used a simple prompt here to generate the code and enter configuration needed. The cool thing about Agent Blueprints is that permissions granted on the blueprint can be inherited by all agent IDs using that blueprint, and I’ll explain more about this in a moment. And because this is standard OAuth, it is interoperable across agent platforms. In fact, the agent we’re updating is the one I showed earlier that’s running on AWS Bedrock. And once the agent is republished to Agent 365, it’s ready for management.

-In fact, going back to the agent registry in Agent 365, viewing the details of the agent, we can move over to the right and expand this field for identity information. We can see it has an Agent ID along with a Blueprint ID, which wasn’t there when we looked at the unmanaged agent card before. And scrolling back up and opening the Security tab, I can see that the agent already has default protections applied from Microsoft Purview and Entra, including sensitive data protections and compliance evaluation as part of the Agent 365 platform. Because the agent is an object in our directory, provided we are entitled with the right management permissions, we can grant the appropriate level of access and get visibility into its details and activities.

-I’ll start by first looking at what resources the developer has configured for the agent to access. In the agent identities page, we can see our agent. Importantly, this agent now has an agent sponsor assigned. This is the person responsible for the agent, and can be the agent builder themselves or someone they designate. And viewing its access and granted permissions, we can see a list of the requested permissions the agent has configured. Notice that the grant source is inherited from the parent, which is our Agent Blueprint. A blueprint is the template for a class of agents. It holds the credentials that associated agents use for authentication. The credentials can be managed in Entra, or federated outside of Entra, or even system managed, such as with an Azure Managed Identity. It also provides a way to define identity and permissions for agents at scale.

-Here we see in this case, the agent’s permissions aren’t set directly on the agent itself. They come from its parent blueprint. The first permission for Agent365.Observability is a default to capture agent telemetry. And under that, you’ll see Microsoft Graph permissions to read groups, users, and mail. Under Developer settings in the Manifest, we can view and optionally edit the details as JSON that we saw earlier in the code.

-As an Entra admin, I can control who is able to consent to the agent’s permissions, which gives me both security and scale, but I also want defense in depth. In our organization, as a blanket control, we have conditional access policies to block access to all unverified agents. Under conditional access, when I click into the AWS Bedrock policy, you’ll notice that this policy targets all agent identities and blocks their access to Entra-managed resources by default. To give our now verified agent access, we’ll need to exclude it from this conditional access block policy.

-Before we do that, I’ll show you this policy in action from the agent testing experience in Amazon Bedrock. I’ll have the agent perform a simple look up for a user account in our tenant. And you’ll see that it’s blocked from retrieving the user information. In fact, if I move over to this agent’s logs, I can see all the invalid grant errors. And expanding on the first one and then scrolling down to the error description, it gives more specific detail about the conditional access block and what happened.

-Now, if I move back to Microsoft Entra and look at the sign-in logs, we can see all of the sign-in activities for this agent. I’ll expand the same request we just saw in the Bedrock portal and move into this specific instance. And you’ll see the failure reason is exactly what the agent developers saw in Bedrock. In fact, digging into this Conditional Access tab, we can see the corresponding policies listed that apply to this agent, along with AWS Bedrock policy on top and the corresponding failure result. Now let’s look at how we can unblock this agent. As a Microsoft Entra administrator, once we verify that this agent’s identity is established and its permissions are appropriate, we can exclude it from our conditional access block policy to allow it access.

-Back in our conditional access policy settings, under Assignments, I can set up an exclude condition. Then I search for my agent by its name. Here I’m typing, “widget.” There it is. Now I’ll select it and confirm, then I just need to save my policy. That’s it. With our exclusion setup, the agent will be able to perform its operation with least privileged access and Entra. So let’s test it out. Back in the Amazon Bedrock portal, I’ll run the same prompt that failed last time, our account look up. And as you can see, this time it works, and it was able to access and display the account information for this user from our tenant.

-There we have it. That’s how easy it is to integrate Entra Agent ID into your agents and bring them under management. Agent 365 with identity and access controls in Microsoft Entra provides IT and security teams the management and visibility to assess and respond to agent risks. This lets you efficiently integrate agents into your existing systems and infrastructure as first-class identities, alongside existing users, applications, and devices. To learn more, check out aka.ms/EntraforAgents. Keep checking back to Microsoft Mechanics for the latest tech updates, and thanks for watching.

Introducing Azure HorizonDB - PostgreSQL

Zachary-Cavanell — Tue, 09 Jun 2026 18:15:00 GMT

Call AI models directly from SQL, build durable vector pipelines inside the database, and deliver high-accuracy similarity search at massive scale with DiskANN and AI re-ranking, all without leaving PostgreSQL.

Debug and optimize queries faster with the Azure HorizonDB VS Code extension. Visualize execution plans, let Copilot generate fixes, and clone production data to test environments in seconds.

Charles Feddersen, PostgreSQL Partner Director PM, shares how to put all of it to work on Azure.

Same hardware, same zone, same PostgreSQL version.

4,200 TPS self-managed vs. 11,000+ on Azure HorizonDB. The separation of storage and compute layers make the difference. See how it works.

Chunking. Embeddings. Vector storage.

All running as a durable background task inside PostgreSQL with AI Pipelines in Azure HorizonDB, no external orchestration needed. Check it out.

Visual query execution plans. Copilot-generated fixes.

The Azure HorizonDB VS Code extension brings all of it into the editor. Get it now.

QUICK LINKS:

00:00 — Azure HorizonDB features

00:57 — Open-source PostgreSQL

02:24 — How it works

03:37 — Performance

04:51 — Enterprise-ready security

05:34 — Memory & storage work together

06:29 — AI Model Management + AI Functions

08:24 — AI Pipelines

09:50 — DiskANN + AI Re-ranking

10:50 — VS Code Extension + Data Cloning

12:31 — Wrap up

Link References

Check out our blog at https://aka.ms/azurepostgresblog

Unfamiliar with Microsoft Mechanics?

As Microsoft’s official video series for IT, you can watch and share valuable content and demos of current and upcoming tech from the people who build it at Microsoft.

Subscribe to our YouTube: https://www.youtube.com/c/MicrosoftMechanicsSeries
Talk with other IT Pros, join us on the Microsoft Tech Community: https://techcommunity.microsoft.com/t5/microsoft-mechanics-blog/bg-p/MicrosoftMechanicsBlog
Watch or listen from anywhere, subscribe to our podcast: https://microsoftmechanics.libsyn.com/podcast

Keep getting this insider knowledge, join us on social:

Follow us on Twitter: https://twitter.com/MSFTMechanics
Share knowledge on LinkedIn: https://www.linkedin.com/company/microsoft-mechanics/
Enjoy us on Instagram: https://www.instagram.com/msftmechanics/
Loosen up with us on TikTok: https://www.tiktok.com/@msftmechanics

Video Transcript:

- The Postgres you know and love is now even more supercharged on Azure with the latest platform optimizations and AI for enterprise apps all made possible with the new cloud-native Postgres service, Azure HorizonDB. Now, we’ll go deep on its ultra fast performance at high scale, the built-in resiliency across different availability zones, along with major new built-in AI-centric features, leveraging DiskANN, as well as integrated AI model management, where you can provision models or bring your own from Microsoft Foundry, plus a built-in AI pipeline that automatically chunks and processes data in real time as it’s ingested into the database. And finally, a brand new VS code extension with AI-powered query development and debugging as you build your apps and more. And today I’m joined once again by Charles Feddersen who leads the Postgres efforts on Azure. Welcome back to the show.

- Thanks Jeremy, it’s good to be back and we’ve got a lot to get through today.

- Yeah, so the new HorizonDB service in Azure is our newest managed Postgres service where we also have Azure database for Postgres, and we’re actively making deep contributions in the Postgres project as well.

- Yeah, so Microsoft has been actively supporting Postgres on Azure for about nine years now, and our approach has always been to keep the Postgres, you know, and love for its portability and ecosystem and make Azure the best place to run your Postgres workloads. You know, and as you mentioned, we are a major contributor to open source Postgres. In Postgres 19, Microsoft Committers modified over 64,000 lines of code, which represents about 8% of all changes in this version. And we made about 340 commits. These improvements cover both new functionality and also improvements based on our own learnings of running Postgres at a massive scale on Azure. We also host the largest virtual Postgres community conference in the world called POSETTE, which is now in its fifth year. Because we understand the core Postgres engine so well, it’s not unusual for our core committers on the team to work with our customers to help debug and resolve issues that they might be having as well.

- Right, and I remember last time you were on, we discussed how you were shipping major versions of Postgres on Azure within weeks of their releases.

- Yeah, and now we’ve effectively eliminated that delay. There is now zero cloud lag in waiting to leverage the latest features when using Postgres on Azure. We ship the new major version on the same day in Azure.

- So that’s a big deal, there’s no lag, same day access. Why don’t we move back though to our newest managed Postgres service HorizonDB. How does that then change the game for anyone who’s running Postgres services now on Azure?

- Yeah, so HorizonDB brings cloud scale performance built-in resilience and AI ready capabilities to Postgres without changing how you build or run your apps. How this works is we’ve completely decoupled compute and storage to improve performance, scale and availability. At the compute layer, it runs the Postgres engine, fully compatible so existing apps and tools just work. At the storage layer, we built a new and highly optimized log service for transactions where we can sustain a commit latency of typically under one millisecond. That log service is paired to a new shared storage platform, which natively stores data across availability zones for resilient storage by default. We can attach multiple read replicas to the storage and the primary can fail over to any of these replicas in less than five seconds, in the event of an outage. This gives you read scale without replication latency. Ultimately, HorizonDB lets you run any Postgres workload from new AI apps to large scale enterprise systems with the performance, resilience and scale of Azure already built in.

- All right, so you said performance. Let’s dig deeper there. Everybody loves a performance story, so can you prove it?

- Yeah, so one of the big challenges with self-managed Postgres is that enabling high availability, especially across cloud zones, often comes with a performance cost. With HorizonDB, we introduced a new quorum commit protocol that let you durably commit across zones before flushing to disk, so you get both resilience and high performance. Now to show this in action, I’ve got a split screen, HorizonDB on the right and self-managed Postgres on the left. This is the same Postgres version on the same hardware with the same high availability setup in the same Azure region. And I’ll kick both off and then go ahead and let them run. And as you can see clearly HorizonDB is delivering about three times more transactions per second. This gain comes directly from the storage architecture, and now that it’s finished, we can see that self-managed Postgres on the left delivered over 4,200 transactions per second. And HorizonDB had more than 11,000 with much lower latency. Performance was a core design principle for HorizonDB from the beginning, and it’s something that you’ll see directly in your applications.

- Okay, so performance is ultra fast, and we know this is built for both enterprises and developers, and we know enterprises love security. So what’s different there?

- Yeah, so security of course is foundational. It spans everything from network isolation and identity to data protection. Just like performance, it’s been a core focus from day one. And we’re building on the proven enterprise capabilities of Azure database for Postgres to deliver it out of the box like Entra ID integration, where you can enable identity-based access, so users connect securely without managing passwords or private endpoints to lock down access. So the database is only reachable over your private network with no public exposure and of course encryption at rest where data is automatically encrypted on the disk. All of this is available from day one, so you get strong enterprise ready security without any extra setup.

- Okay, and bringing this back to our developers who are watching the built-in AI centric features with HorizonDB now also make it easier to build AI apps.

- Yeah, and this is an area that we’re really leaning into. Postgres was already popular and chat with your data use cases accelerated that adoption because it natively supports vectors for similarity search. Our focus is on making intelligent retrieval and generative AI work on a massive scale with high accuracy and efficiency. To do that, we’ve rethought how memory and storage work together in the database so that more IO traffic moves to disk letting you take advantage of much larger storage capacity using Microsoft’s disk accelerated nearest neighbor or DiskANN technology. This quantize a vector-based graph in memory and maps it to a full precision graph stored on disk, which significantly reduces memory requirements while still delivering fast higher quality similarity search across your data.

- And speaking of generative AI responses, we’ve also made it easier for the database to work directly with AI models.

- Yeah, we have, and this starts with AI model management, which automatically registers a set of models with your instance of HorizonDB. It’s really simple. So here’s my HorizonDB, and I’ll just select the enable managed models then confirm. And what this does behind the scenes is it automatically registers a few AI models for use. Once the provisioning is complete, you can see the AI model management blade in the portal with the GPT, text embedding and re-ranking models listed. And you can also bring your own models where you register them through the database directly.

- So now you can use models effectively with Postgres without extra manual provisioning configuration. So, how would you interact with them?

- Yeah, this is where AI functions come in. These are a set of SQL functions that you interact directly with AI models. The Azure AI extension in HorizonDB provides functions that you can invoke using SQL to leverage AI models. So let me show you a couple. For example, you can use the generate function to produce a response from a prompt. In this case, I’ll say summarize the following customer reviews in two to three sentences, and then I’ll run it and you can see the response is generated as a SQL result that I could use in my app. Alternatively, the extract function is designed to pull specific entities from unstructured text into a structured form that you can then store and query. You can see here that I’m going to use an array to ask for the main product features along with the customer sentiment from my database. Now, we’ll let that run for a moment and we can see the response of producers for each item in the catalog.

- And this is just one scenario that you showed with querying, but I can imagine another case where you might say, use data transformation where the results are written back into the database.

- Yeah, absolutely. And when you do that, obviously the retrieval time for those results stored in the database is incredibly fast and you’re saving on your tokens as well.

- That’s really great to see. So another challenge that we hear a lot of times is around building and maintaining AI pipeline. So we’re making that easier too.

- So this is where AI pipelines in HorizonDB extend AI model management and AI functions even further. Today, most generative AI apps rebuild the same steps, chunking, creating embeddings, backfilling data, often in fragile external pipelines. With AI pipelines, all of this is built directly into Postgres. So you can see here that I’ve created a pipeline using the create pipeline function in the AI extension. This chunks the data in a database in real time as it’s added. It will then create embeddings for those chunks using the embedding model that the AI model management enabled for us. And these are ultimately stored in a table. So I can then go ahead and run this, and then if I count the records in the output table, you can see that it’s increasing. And this is all happening asynchronously in the background so that it’s not blocking or really having any real performance impact on my transactional workload. But the best thing about these pipelines is that they’re durable. And this means that I could pause it. And you can see here that the row count stops increasing, even if the workload continues and I can resume it, think of it as a reliable background task. And if my server fails over, it’s no problem, the AI pipeline fails over as well and it just keeps running.

- So all that pipeline complexity then just moves into the database and kind of reduces the complexity and runs reliably.

- Exactly, and building on this, we can now also use the rank function to re-rank search results with an AI model. Earlier I talked about how DiskANN improved similarity search, but that’s just the first step. With rank, we can apply a model like Cohere to refine the top results and improve overall relevance. Let me show you, I’ve got two identical queries here. One just uses an index and the other wraps the same query in our rank function to improve the relevance of results. If I run the first query for the headphones with the highest playtime and good calling, you can see the results seem pretty good. And these aren’t bad with a few showing around 40 hours. But when I run the rank query that applies the AI ranking model, the top most results are definitely more relevant to my search. Here, there are headphones with 60 or more hours, and the top ranked model has a hundred.

- And this is really powerful. So you basically started out with fast similarity search, then used AI to make the results even more relevant. But why don’t we move beyond the database itself and look at what we’ve done then to help with the building experience of Postgres workloads on HorizonDB?

- Sure, and this is one of my favorite additions. We’ve built a new VS code extension that brings familiar Postgres tools into a modern AI powered experience. As someone who spent years working in database tools, this is something that I really wish I’d had. It makes debugging and development a lot more easy. So here we’re in VS code and on the left you can see I’m using the Postgres extension. Now this works with any Postgres, but when you connect to Postgres on Azure, you get even deeper integration. So let’s look at an Azure server, and if I right click, you can see a number of server management features like network configuration, backups, and even start stop built in with a single click. And if I right click on tables, one of the most recent additions is object properties. But now let’s run a query. This is a little slower than we’d expect. So I open the new visual query execution plans to debug. It’s easy to identify the Inefficient query operator, and I can click on that to debug further. But the best part is that Copilot can fix it for me. Here, I’ll just click on the Copilot button in the query plan and it gets to work. The Copilot generates the fix for me, and it’s really that simple. Now I want to test this fix in a non-prod server, and that’s easy to. For that, I’ll show you a first look at the new built-in data cloning. I’ll go back up to the server and right click and I can clone it with all my data. And that just takes a moment to validate my solution.

- And that’s a real shift. You got the same familiar Postgres experience, but now with AI and platform capabilities that really improve how you build and run apps. So what’s next?

- Yeah, so we’ve covered a lot today, but this is just the start. We’re continuing to push the boundaries of what you can do with Postgres on Azure. So here’s a lot more coming.

- So what’s the best way then for everyone watching to get started with Azure HorizonDB?

- Yeah, so, you know, you can go try it for yourself. It’s in preview now and it’s easy to get started with everything that I demoed. The VS code extension is available in the VS code marketplace. And of course, to stay current, check out our blog at aka.ms/azurepostgresblog.

- Thanks so much for joining us today, Charles, and of course, keep checking back to Microsoft Mechanics for the latest tech updates, and we’ll see you again next time.

Agent 365 | Security Operations in Defender

Zachary-Cavanell — Tue, 09 Jun 2026 16:01:58 GMT

Triage high-severity alerts as IT in the Microsoft 365 admin center, then pivot into the full incident graph as a SOC analyst in Microsoft Defender. Block malicious tool invocations the instant they fire and catch jailbreak attempts on Copilot Studio agents before they take hold.

Trace a compromised user back to suspicious agent activity, then trigger Microsoft Entra conditional access to revoke the session and force a password reset straight from the incident. Hunt overpermissioned agents with pre-built advanced hunting templates — including one that exposes every agent running MCP tools on the maker’s standing credentials — and pull risky builds from the Agent Store using the Agent Registry.

Spencer Berg, AI & Security Product Manager, shares how to turn agent risk signals into coordinated remediation across Defender, Entra, and the Microsoft 365 admin center.

One agent. Two security views.

IT admins triage critical alerts in the M365 admin center. SOC analysts dig into the full incident graph in Microsoft Defender. Try Agent 365.

Real-time agent defense.

Microsoft Defender blocks malicious tool calls mid-execution and flags persistent jailbreak attempts on Copilot Studio agents the moment they happen. Watch it in action.

Pull a risky AI agent from the Agent Store.

Open the Agent Registry in the Microsoft 365 admin center, block the agent, and cut access for current users until the maker resubmits a safer build. See it here.

QUICK LINKS:

00:00 — Stay in control with Agent 365

00:40 — Gain visibility with unified control plane

01:48 — Unified IT & SOC agent view

02:54 — Real-time blocking and jailbreak detection

04:08 — Auto-revoke via Entra conditional access

04:32 — Prevent future incidents

05:28 — Advanced hunting for AI agents

06:43 — Block risky agents

07:15 — Wrap up

Link References

Check out https://aka.ms/Agent365SecOps

Unfamiliar with Microsoft Mechanics?

As Microsoft’s official video series for IT, you can watch and share valuable content and demos of current and upcoming tech from the people who build it at Microsoft.

Subscribe to our YouTube: https://www.youtube.com/c/MicrosoftMechanicsSeries
Talk with other IT Pros, join us on the Microsoft Tech Community: https://techcommunity.microsoft.com/t5/microsoft-mechanics-blog/bg-p/MicrosoftMechanicsBlog
Watch or listen from anywhere, subscribe to our podcast: https://microsoftmechanics.libsyn.com/podcast

Keep getting this insider knowledge, join us on social:

Follow us on Twitter: https://twitter.com/MSFTMechanics
Share knowledge on LinkedIn: https://www.linkedin.com/company/microsoft-mechanics/
Enjoy us on Instagram: https://www.instagram.com/msftmechanics/
Loosen up with us on TikTok: https://www.tiktok.com/@msftmechanics

Video Transcripts:

-What if your next Sev 1 security incident isn’t a compromised user, but instead an autonomous agent, chaining actions across systems you didn’t even know it could reach? In the agentic era, SOC teams aren’t just defending endpoints or identities. They’re defending a machine-speed execution layer that collapses boundaries and turns small gaps into full attack paths. When agents act on their own while logged in as a user, on-behalf-of activity becomes user impersonation. They can access and interact with Teams, email, other internal apps, and your users’ devices. This blurs the lines between human and agent activity. So how do you gain visibility into these activities and stay in control? It starts with the fundamentals of agent defense, knowing what’s running, controlling what it can access, and seeing what it’s doing in real time. Agent 365 brings all these defense areas together through a unified control plane.

-The Microsoft 365 admin center provides centralized inventory and governance of agents and tools. Entra establishes strong identity with least-privilege access and clear ownership. Defender delivers runtime protection and deep observability with end-to-end activity tracing and detection. And Purview enforces data protection and posture by monitoring how agents interact with sensitive information. Together, these capabilities create a shared, consistent view so security and IT can manage agent risk as one system, not in silos. Today, in the second episode of this series, we build on that foundation and dive deeper from the SOC perspective in Microsoft Defender, showing how unified agent visibility enables faster detection, stronger investigations, and coordinated response with IT before agent-driven risk escalates.

-Starting off as an IT admin in the Microsoft 365 admin center, I can see agents which have risks associated with them. The agent risks tab in the registry has identified several agents that need my attention based on security risk signals surfaced here. And drilling into any of these agents exposes the security & compliance page, where the IT admin will see only unresolved alerts with high and critical severity from Defender. Switching perspectives, as a SOC analyst on the Zava security team, the Microsoft Defender portal is my go-to-solution for threat protection, including posture management and investigations. I also need detailed security information for the agents that run in our environment.

-I can view the same agent within Defender with a security lens with related incidents and alerts. I mentioned before that an IT admin can see the big picture and even view unresolved alerts from critical incidents within their experience, but as a SOC analyst, I need the granular details to dig deeper into the incident. I can see all the lower priority and resolved incidents that provide more context on the activity of this agent. Microsoft Defender continuously monitors AI agent activity in real time. It can block malicious tool invocation attempts as they happen, and alert security teams that there have been attempts to jailbreak AI agents.

-Let’s click into the critical incident to investigate further. In the details, I can see that this has been identified as a collection incident involving one user. It also includes the information that our SOC team needs. I can look at the incident description to see that the agent is connected to a tool that sends emails, which was blocked, thankfully. Let’s open the incident page to investigate further.

-Now we can see a detailed explanation of what happened, who was involved, and additional context. Alerts related to the agent are combined into a more detailed incident view, including persistent jailbreak attempts on a Copilot Studio agent and an AI agent tool invocation by the same user, which was blocked by Microsoft Defender. The alert also provides recommended actions to remediate it. It shows all events related to our user, Griffin, where the agent tried to invoke the same email tool multiple times within a short period, each with details on the date, time, and the user’s IP address. Optionally, we could investigate the user further using advanced hunting to view additional activity across a longer period.

-That said, for this incident, I have enough information to suspect that it’s potentially stolen credentials and is carrying out suspicious activity. I can then click on the user to view their details and confirm that they have been compromised. Defender can automatically trigger our Entra conditional access policy to revoke Griffin’s access and require them to reset their password. This would now show that their account has been compromised and let us resolve the incident without further impact.

-And I can also prevent future incidents with this agent. For that, I’ll use advanced hunting to get more information and context. I’ll click on the agent within the incident graph to find out more about the purpose of the agent, its number of associated incidents and alerts, as well as other tools it’s connected to. Running this query gives me the most up-to-date information about this agent. I can see detailed attributes like the agent’s name and creation date, who last modified it, and when. It also shows its action triggers, which actually invokes the agent to run, and any connected or child agents it interacts with.

-Now, tying this back to our earlier attack, we saw that Defender’s real-time protection blocked a tool invocation for the tool that sends emails. That’s already good news, but as the investigator, I want to know what else this agent can do and how risky it is. I’ll open Agent Tool Details and I can see that, in addition to sending emails, this agent also has access to an MCP server as a knowledge source. MCP servers often expose a broad set of actions. These are mostly used for read access, but sometimes write access too. Often, as a workaround for future permissions issues, developers or makers give write access even in cases where the agent only needs read access. That’s what we call overpermissioning, and it goes against the principle of least privilege. In turn, it introduces a lot more risk if the agent is ever compromised. But I don’t want to stop with just one agent. Let’s find out if other agents in my organization are exposing risks related to overpermissioning.

-Here, I have a collection of pre-built queries designed specifically for AI agents, making it easy to spot misconfigurations, excessive permissions, and other risky setups across my environment. This specific template gives me a view into agents with MCP tools configured using the maker’s credentials. That’s not good. With these permissions, the MCP server tools can be accessed using the standing permissions of the agent maker. This can lead to privilege escalation and data exposure. The advanced hunting results show that multiple agents have access to MCP servers with maker privileges, which put them at high risk.

-Now we have the information we need to notify each creator that changes are necessary to scope their agent’s permissions so that they can be used safely. From there, our Microsoft 365 administrator can prevent the current agents from being used until new versions are ready. To do that, as the IT admin, I’m signed into the Microsoft 365 admin center, and in the Agent Registry. There’s our Customer Billing Agent, and I’ll click into its details. I can take action from here and block it from being used, then confirm. That’s going to remove it from the Agent Store for new users, and prevent current users from accessing it.

-Then, once a newer, safer version of the agent is ready, the maker can resubmit it for publishing approval. With Agent 365 using Microsoft Defender, you can strengthen agent security posture and protect against threats. This helps you proactively identify and mitigate risks before attacks occur.

-To learn more, check out aka.ms/Agent365SecOps. And in the next episode of this series, we’ll explore Agent 365 with Microsoft Entra to prevent agent sprawl, unclear ownership, and weak lifecycle management. Keep watching Microsoft Mechanics for the latest AI and security updates. Thanks for watching.

Automate evaluations | Microsoft Foundry

Zachary-Cavanell — Thu, 28 May 2026 16:02:56 GMT

Trace every run end-to-end, generate synthetic datasets to stress-test on demand, fire automated Red Team attacks at your own agents, and pin down why evaluations fail — all from the Microsoft Foundry control plane. Lock in guardrails that inspect every tool call at runtime, define the risks once, and enforce them across every agent run.

Mohammad Abuomar, Responsible AI Principal Architect, shares how to turn a coding agent into production-ready software inside Foundry.

Describe the agent, set the row count, confirm.

Your test set lands in seconds. Microsoft Foundry’s synthetic dataset generator builds eval data on demand. Get started.

Pin down why your agent fails evaluations.

Foundry’s Analyze Results uses AI to cluster failures, name the root cause, and recommend specific fixes. Check it out.

Lock down agent behavior with the Task Adherence Guardrail.

It inspects every tool call against the original task and blocks the off-script ones. Try it in Microsoft Foundry.

QUICK LINKS:

00:00 — Microsoft Foundry control plane

00:33 — See a finished agent

02:30 — See where the agent started

03:19 — Traces

04:04 — Built-in monitoring

04:34 — Evaluation types

05:51 — Red team evaluations

07:08 — Evaluation results

08:14 — Built-in Guardrails

08:14 — Wrap up

Link References

Get everything you need in Microsoft Foundry at https://ai.azure.com

Unfamiliar with Microsoft Mechanics?

As Microsoft’s official video series for IT, you can watch and share valuable content and demos of current and upcoming tech from the people who build it at Microsoft.

Subscribe to our YouTube: https://www.youtube.com/c/MicrosoftMechanicsSeries
Talk with other IT Pros, join us on the Microsoft Tech Community: https://techcommunity.microsoft.com/t5/microsoft-mechanics-blog/bg-p/MicrosoftMechanicsBlog
Watch or listen from anywhere, subscribe to our podcast: https://microsoftmechanics.libsyn.com/podcast

Keep getting this insider knowledge, join us on social:

Follow us on Twitter: https://twitter.com/MSFTMechanics
Share knowledge on LinkedIn: https://www.linkedin.com/company/microsoft-mechanics/
Enjoy us on Instagram: https://www.instagram.com/msftmechanics/
Loosen up with us on TikTok: https://www.tiktok.com/@msftmechanics

Video Transcript:

-If you want to build agents that meet your expectations for output quality, performance, safety, and cost, it’s not just about the model or framework you select. The testing, evaluation, and the controls surrounding your agent matter. And that’s what the Microsoft Foundry control plane is designed to do, with tools you can use during development to make sure your agents raise the bar across every important dimension. Today, I’m going to walk through the process of building a coding agent and demonstrate where the controls in Foundry come in to make it better. I’ll start by showing my finished agent, then after that, I’ll show you the steps I took using Foundry to make it production ready. This agent is designed to take a simple user prompt, then find what it needs to build apps automatically.

-So, I’ll paste in my prompt asking it to generate a Windows desktop app for personal cashflow management. It needs to be fast, use WebUI, and easy to use for broad appeal. I’m also asking it to make it safe, secure, and follow privacy best practices. And it needs to be easy for a developer to read, maintain, and to add to it. I’ll submit the request and it gets to work, with its reasoning on the left and code on the right. This process takes several minutes to complete with a few interactions in between, so to save a little time, I’ll skip to the result. We can see the agent’s reasoning and plan, with its technology stack, approach and initial action. Then, we can follow all of the steps it performed to author and configure the app and its dependencies.

-Below that, is the React code and JavaScript. It asked whether to proceed writing this as an Electron and React setup, and I confirmed. Then it started to write, test and iterate on the app, followed by another question whether to implement more features or focus on security. And I responded to do both. It then finished writing the app and finally it outlined the steps to run the app locally.

-So, let’s test it out. I’ll move over to my terminal window running PowerShell and start it. And here is the generated app. It’s fully functional with user authentication. I can enter my first item, Travel Expenses, and the amount, and there’s a Category dropdown menu with pre-configured options, and I’ll choose “Transportation”. And it writes that record into the local data store. This is a simple, production-ready app that the agent was able to create in just a few minutes. But it didn’t start out this way, and if you’ve built agents or apps yourself, you’ll know a lot of what doesn’t get shown is the testing, iteration, and refinement work to end up with production-ready code. Let’s change that.

-Let’s go back in time to where this agent started. I’m in Visual Studio Code and this is my agent, which I built using the Foundry SDK. Here are the defined tools for it to use, WebSearch and CodeInterpreter. And on the left, we can see the full list of local tools. Like interacting with the file system, as well as git, patching, registry, local search and running shell scripts. And here in the center is the key SDK line that creates the agent, adds the tools, deployment name and so on.

-So, the agent is functional and I’ve also started manual testing. And this is where Foundry controls let me stress‑test the agent to see what works and what doesn’t and see the details for each run. In the Microsoft Foundry portal, I have my agent open and the Traces tab. These are OTel traces of all of the runs for this agent, with the newest runs on top, everything here is backed by Azure Monitor. And I can click into any conversation or Trace ID to view the Input + Output turns for that session. They’re easier to parse than standard logs, speeding up reviews. We can also see the system message, user input, and what the agent did. Along with the agent’s reasoning, the technology stack it used, and the app features. Below that, we can see the development process as well as tool outputs Beyond that, with built-in monitoring, you can get a roll-up view of all activities for our agent with key metrics I’m in the Monitor tab. It shows me the estimated cost and token usage so far. This agent is new so I haven’t configured Evaluations yet, but we’ll get to those in a moment.

-Next, you’ll see Operational metrics like the number of agent runs and how many successfully completed or failed, token consumption, tool calls made by the agent, and the error rate over time. Evaluations are where a lot more testing automation comes in to help you improve agent faster. I’m in the Evaluations tab, I need to create my first one. The options are: Automatic Evaluation, where you can automate the process using AI; Human Evaluation, where someone tests the agent and completes surveys; and Red team, where an agent runs automated attacks to expose vulnerabilities. I’ll start with Automatic Evaluation and hit Create. It starts with defining a target. My agent and the version I want are already selected. For data, I can upload an existing dataset or save time by creating a synthetic dataset, which is very cool. This generates data automatically, you just select the number of rows you want. I’ll guide it with a prompt, “Create a dataset for evaluating a coding agent.” I’ll skip the reference file and just Confirm. That automatically generates 90 rows of data to test with.

-Next, I’ll choose the evaluation Criteria. There are several built-in evaluators for Agents. Below that are evaluators for Quality. These are editable, so I’ll remove Coherence, Fluency, and Groundedness because my agent doesn’t need them. For Safety, there are seven evaluators, and I’ll keep them as-is and move on to Review, then Submit it. These Automatic Evaluations can take several minutes to complete, so while it’s working, I’ll move into Red Teaming, which is now becoming a core part of AI testing to spot vulnerabilities early on. I’ve started creating my first red team evaluation. Let’s look at the standard configuration for risk categories. You can modify these. It can check for unsafe categories plus ungrounded attributes, code vulnerabilities, and task adherence. It shows the tools that the agent can access. I’ll provide descriptions for web_search, to search the internet for relevant SDKs, and the code_interpreter to run code for the coding agent. Then I’ll Save it.

-Next, I’ll change Seed queries from 5 to 10 per category for more testing. In the Attack strategies, I can see exactly what the red teaming agents will try to do and select the ones most relevant to my agent. Each tile describes the attack type that will be tested. I’ll choose AsciiSmuggler, Base64, Jailbreak, StringJoin, UnicodeSubstitution, and IndirectJailbreak. Now, I can review the prohibited actions, including things like attempts to change password, and more. These are all things attackers might try to do with your agent, and we’re automating those tests for you. I’ll hit Submit to get everything started. Now, with two evaluations running, to save a little time, I’ll fast forward to the results of the evaluations.

-Here, we can see the two runs. I’ll open the Automatic Evaluation first. Then clicking into the Run shows the details for each evaluator. If I scroll to the right, you’ll see that we’re green almost across the board. One glaring exception is the TaskCompletion score at 59%, which is below my bar, so it’s something to fix. One of my favorite capabilities in evaluation is using AI to analyze the results. I’ll start the analysis, and it creates a nice cluster analysis showing the main issues. I mentioned TaskCompletion before. Here, you can see “incomplete resolution” and “action plan issues”. Drilling in, looks that there is a “lack of actionable output” and the AI suggests specific ways to fix it. This saved me time to find ways to improve my agent.

-Now, let’s review our Red Teaming evaluation. I’m at the top level view and I’ll click in to see the issues. Immediately, I can see that the Task adherence is red, which is also related to TaskCompletion. We can fix this using a built-in guardrail to check for task adherence. Guardrails define what risks to detect, from which point in the process, and how to respond. Let’s go to the agent playground. Scrolling down to Guardrails, I can see only the default model guardrail is set. Let’s add another by clicking Manage guardrails and Create. Here, I can define the risks and controls I want to enforce. I’ll start with Risk, and these are the types of risks we can detect and mitigate. There’s an option for “Task adherence” that I’ll choose. This guardrail checks any tool call made by the agent to ensure it’s used appropriately to “adhere” to the task.

-Now, I just need hit Submit to activate this guardrail. And the TaskCompletion issue should now be fixed. In fact, here I’ve run another evaluation, and we can see that TaskCompletion is now green and everything meets our overall quality goals. With that, my agent is ready for broader use. And while I focused today on a single agent and using Foundry controls to test it, expose vulnerabilities, and make it better, Foundry also provides fleet-wide performance visibility across all agents and enables centrally applied and enforced policies and configurations to keep agents compliant.

-To find out more and get started with these and other controls, you’ll find everything you need in Microsoft Foundry at ai.azure.com. Subscribe to Mechanics for the latest tech updates, and thanks for watching.

Microsoft Entra Tenant Governance | Find Configuration Drift

Zachary-Cavanell — Wed, 27 May 2026 18:03:51 GMT

Capture configuration as code across 200+ resource types in Entra, Intune, Exchange, Teams, Defender, and Purview. Turn that snapshot into a Monitor. It scans for drift every six hours and flags every policy change.

Extend control to the tenants you don’t fully see today. Entra Tenant Governance surfaces them automatically through B2B, multi-tenant app, and billing signals. Request governance with role-based templates. Complete the secure approval handshake in the Entra admin center, then administer the governed tenant from a single browser using the roles forged in that handshake.

Jeff Staiman, Microsoft Entra Principal Product Manager, shares how to bring every tenant under one governance model.

More than 200 resource types. One baseline.

Configuration Snapshots in Microsoft Entra Tenant Governance lock in your tenant config across Entra, Intune, Exchange, Teams, Defender, & Purview. Start here.

Every tenant connected to your org, surfaced.

Entra Tenant Governance assembles a live Related Tenants list from B2B traffic, multi-tenant app config, and Microsoft Commerce billing signals. Check it out.

Same browser, same login.

Entra Tenant Governance authenticates you through the role assignments from your governance handshake. See how it works.

QUICK LINKS:

00:00 — Prevent tenant configuration drift

00:57 — Create a configuration baseline

02:23 — Detect configuration drifts

03:08 — Identify related tenants to govern

04:05 — Governed tenants

05:01 — Incoming request

06:17 — Set up monitoring

07:40 — Wrap up

Link References

Get started at https://aka.ms/EntraTenantGovernance

Restrict tenant’s connections at https://aka.ms/TenantQuarantine

Unfamiliar with Microsoft Mechanics?

As Microsoft’s official video series for IT, you can watch and share valuable content and demos of current and upcoming tech from the people who build it at Microsoft.

Subscribe to our YouTube: https://www.youtube.com/c/MicrosoftMechanicsSeries
Talk with other IT Pros, join us on the Microsoft Tech Community: https://techcommunity.microsoft.com/t5/microsoft-mechanics-blog/bg-p/MicrosoftMechanicsBlog
Watch or listen from anywhere, subscribe to our podcast: https://microsoftmechanics.libsyn.com/podcast

Keep getting this insider knowledge, join us on social:

Follow us on Twitter: https://twitter.com/MSFTMechanics
Share knowledge on LinkedIn: https://www.linkedin.com/company/microsoft-mechanics/
Enjoy us on Instagram: https://www.instagram.com/msftmechanics/
Loosen up with us on TikTok: https://www.tiktok.com/@msftmechanics

Video Transcript:

-To protect your organization, you need to ensure that your tenant configuration doesn’t drift from your defined security and compliance requirements. This needs to include all the Microsoft Entra tenants that you manage, whether for end-user collaboration, development and testing, mergers and acquisitions, or regional teams, as well as all the unsanctioned tenants set up by your employees, such as for testing or for shadow IT. Even a single configuration drift in one of your tenants can introduce vulnerability to your environment, and that’s where Microsoft Entra Tenant Governance comes in, to define configuration baselines as code in order to monitor configuration drift, to automatically find related tenants with existing B2B, billing, or multi-tenant app relationships, to request the permissions you need, to govern the tenants where you need visibility and control, and once approved by the related tenant admin, to monitor those configuration baselines in your governed tenants to detect drift from your desired state anywhere. Let’s start by creating a configuration baseline for our main tenant, Contoso Inc, to monitor for configuration drift.

-In the Microsoft Entra Admin Center, you can find Tenant governance under Entra ID. This tenant has several conditional access policies and cross-tenant access policies, as well as device compliance policies. We’ve already given the service permissions to read all the policies in this tenant, and that’s going to be required to run the snapshot process, and will be needed later to monitor for configuration drift. I’m going to give you a first look at the new configuration snapshots page, where you can capture the configuration of your existing tenant settings to detect drift or to use as a baseline for other tenants. I’ll create a new snapshot. I’ll begin by giving it a name, Contoso core compliance, and a description, Contoso core compliance May 2026. Then I select the resource types that I want to snapshot. You can use more than 200 resource types to monitor configuration across Entra, Intune, Exchange, Teams, Defender and Purview.

-First, I’ll select conditional access policies, then cross-tenant access policies, and external identity policies in Entra. Then in Intune, I’ll search for device compliance and I’ll choose iOS and Windows. I can review the resource permissions and expand out. Then I just need to confirm by clicking Create Snapshot. That’ll take a moment to query and write the configuration settings. Once it’s completed, I can click into it to view the details, and in the Configuration baseline tab, I can access adjacent representation of all the configuration settings.

-Now I want to set up monitoring so that I can automatically detect any configuration drift in any of these policies in my tenant that happens in the future. I can easily set this up by creating a monitor from this snapshot. In settings, it pre-populated the name and description. The monitors also pre-populate with the settings that were captured in the snapshot. We see that all the required permissions are in place. Monitoring a resource uses the same permissions as snapshotting it, so this is as expected. Now I can confirm and hit Create Monitor. It’ll run on a scheduled interval, currently every six hours. After the monitor has completed one or more runs in your tenant, you can check it for configuration drift. With our first run complete, I can check if there were any configuration drifts, and as you’d expect, everything looks good. No drifts.

-Now that I know I can keep the configuration of my main tenant healthy, let’s see how to identify other related tenants that I also need to govern. I’m still signed in as the admin for our main Contoso Inc tenant, and I’ll start from the related tenants list. It shows all tenants connected to my organization, including shadow tenants and external partner tenants. The list is automatically created and kept up to date by Entra’s tenant discovery signals, which look at B2B usage, multi-tenant app configuration, and Microsoft commerce billing. I see the Contoso 1 tenant in the list, which gets my attention since it has the Contoso name in it. I click on Contoso 1 to see the details. If I click into it and then I look at discovery signals, it shows B2B registration, B2B sign-in, admin app sign-ins, and multi-tenant apps, as well as billing relationships that were detected. I can get more detailed information in the Discovery Signals tab, where I can click to see the number of sign-ins for B2B and for admin apps. And in billing, it looks like our primary tenant is already paying for this one.

-Now let me show you how to establish governance over a related tenant. This is clearly a tenant that we need to govern, so I’ll close this view and I’ll move over to the Governed tenants view. Here you can see that I already have one governed tenant, Fabrikam, but not the Contoso 1 tenant. Let’s add it. So I click Request to govern. In the list of tenants, I can see the Contoso 1 tenant, and I’ll select it.

-To speed up the process, I’ve already created a few governance policy templates to define the access that my primary tenant needs over different types of governed tenants. Next, because this looks like a dev test tenant, I’ll choose the DevOps governance policy template, where I’ll request the global reader, security admin, and tenant governance admin rules. Templates are extensible to use your own multi-tenant resource management apps. This one contains the MegaMonitor app, which is a custom app that Contoso has written to monitor resources and govern tenants. From there, I just need to review and hit Create. The request gets sent via email. Now with the invitation sent, I’ll switch over to the perspective of the Contoso 1 tenant admin, who receives the incoming request. The email is sent from a Microsoft Security account in the microsoft.com domain and contains the details for the tenant governance request.

-For security, the request can’t be approved within the email directly. It needs to be approved in the Entra Admin Center. There’s a link in the email which takes you to the tenant governance relationship tab for pending requests. I see the request on the top of the list, and I click the request to see additional details. As I showed from the requester point of view, it contains the request for three roles: global reader, security admin, and tenant governance admin, and a request for that multi-tenant app called MegaMonitor to have permission to read audit logs and policies.

-From there, I can choose to accept or reject the request, and I’ll accept it. If the other tenant’s admin doesn’t approve your request, you can restrict their tenant’s connections to your primary tenant by blocking apps, preventing B2B access, stopping bill payment, or applying network blocks. To learn how, check out our documentation at aka.ms/TenantQuarantine. Once the request is accepted, the handshake between the tenants is complete and you can govern that other tenant.

-Now let’s switch back to the primary tenant admin’s point of view. Here I can see that the governance request was accepted and the governance status is now active.

-Now I can set up monitoring for that tenant to ensure that the conditional access policies and other policies meet Contoso Inc’s requirements. I need to create that new monitor while logged in as an admin in the newly governed tenant, and the good news is you don’t need to switch browser profiles or authentication contexts to do this. I copy the tenant ID from the Governed tenants page. Then I type entra.microsoft.com/ and I paste in the tenant ID from my clipboard. This signs me into the Entra Admin Center in the context of the governed tenant, Contoso 1. The authentication and authorization works using the Entra role assignment set up with a governance relationship, so there’s no need for a B2B account. You can see the authentication context in the user account area in the upper right corner of the admin center.

-Now I can go to the Tenant governance page. I navigate over to Monitors to create a new one. I start by giving it a name and description, and then I need to put in the configuration baseline for the monitor in Contoso 1. For that, I can go back to my primary tenant and go to my baseline and copy it. Now I’ll go back into the governed tenant and paste it in there.

-Next, there are the application permissions I showed before. A monitoring service in the Contoso 1 tenant needs the same permissions that it needed in the Contoso Inc tenant. To save time, I’ve added these read permissions in advance. Now all I need to do is review and hit Create. The monitoring service will run four times per day, and you’ll be able to review monitoring results from the governed tenant.

-And so that’s how tenant governance lets you keep all of your tenants securely configured on an ongoing basis, including related tenants that you don’t even know about today. To find out more and get started, check out aka.ms/EntraTenantGovernance. Keep watching Microsoft Mechanics for the latest tech updates, and thanks for watching.

Microsoft Excel Beginners Tutorial (2026)

Zachary-Cavanell — Tue, 19 May 2026 16:18:33 GMT

If you’re new to and getting started with Excel or coming from another app, in this video we teach the basics of Excel, the user interface, core concepts, and how to work with basic data. We’ll show you how to build a full Excel workbook from scratch using natural language prompts with Copilot. Format cells, write formulas, and analyze a year of data. Generate sample data, calculate totals, apply conditional formatting, and pin down outliers across columns and rows, all from your browser at excel.new. Share the workbook by name, group, or email and co-author with teammates across web, desktop, and phone. Every edit syncs to OneDrive in real time.

Jeremy Chapman, Microsoft 365 Director, shares how to go from blank workbook to analyzed, shared spreadsheet in one sitting.

A full data set with only one prompt.

Copilot in Excel builds categories, columns, and currency-formatted cells from a natural language prompt. Try it now.

Skip the formula syntax.

Copilot inserts row and column totals from natural language prompts and exposes the underlying SUM logic so you can verify the math. See how it works.

Pull reasoning out of your spreadsheet.

Copilot in Excel surfaces the highest- and lowest-cost months and explains the drivers behind each. Try it in Excel.

QUICK LINKS:

00:00 — Excel Essentials

00:57 — Start from a blank workbook

02:11 — Core terms and concepts

04:25 — Generate Sample Data with Copilot

06:16 — How to work with the numbers

09:35 — Copilot Writes Your SUM Formulas

09:57 — Conditional Formatting from a Prompt

10:40 — Outlier Analysis with Reasoning

11:36 — Real-Time Co-Authoring in OneDrive

12:22 — Wrap up

Link References

Check it out at https://microsoft.com/excel

Unfamiliar with Microsoft Mechanics?

As Microsoft’s official video series for IT, you can watch and share valuable content and demos of current and upcoming tech from the people who build it at Microsoft.

Subscribe to our YouTube: https://www.youtube.com/c/MicrosoftMechanicsSeries
Talk with other IT Pros, join us on the Microsoft Tech Community: https://techcommunity.microsoft.com/t5/microsoft-mechanics-blog/bg-p/MicrosoftMechanicsBlog
Watch or listen from anywhere, subscribe to our podcast: https://microsoftmechanics.libsyn.com/podcast

Keep getting this insider knowledge, join us on social:

Follow us on Twitter: https://twitter.com/MSFTMechanics
Share knowledge on LinkedIn: https://www.linkedin.com/company/microsoft-mechanics/
Enjoy us on Instagram: https://www.instagram.com/msftmechanics/
Loosen up with us on TikTok: https://www.tiktok.com/@msftmechanics

Video Transcript:

-Microsoft Excel can help you organize information, perform calculations, and discover patterns in your data all in one place, and you can get to it on your PC, your Mac, your phone, or on the web. I’m Jeremy Chapman, and I’ve been part of the product team responsible for Office at Microsoft since 2012. And today, I’ll walk you through the essentials of Excel and how to use it. So first, if you have a Microsoft account, like outlook.com, OneDrive, or Xbox, or if you use Microsoft 365 at work, you can use Excel on the web, in your browser, and you can get to Excel by navigating to excel.new. And by the way, if you have the Excel app installed, you can open that on your computer or your phone and follow along. When you’re signed into your work or personal Microsoft account, Excel saves your files to OneDrive, so you can easily find them and pull them up on other devices later.

-So for today, I’ll keep things simple. So I’ll start with a blank workbook Using Excel on the web. Wherever you use Excel, it’s designed to be a consistent experience on large screen devices, so you can follow along if you’re using the local app on Windows or on a Mac. And Excel is designed to organize any kind of information, numbers, dates, texts, and more. In the main view, you can see that I have columns and rows all ready to enter data. In most cases, there’s a one-time step to create what’s called a workbook in Excel, which I have one open here. Now this is where you’ll use and create a blank workbook, or you can choose from dozens of different templates that are filled in with sample data and formatting to get you started. At that point, you can enter your data, your headers, and start formatting your cells.

-Now if you have existing data in a table in another app, you can open it with Excel or just paste in the contents to start working with it. On top, Excel has what’s called the ribbon, with groups of controls presented as tabs that you can use. Within each tab, there are smaller groups of controls, like you can see here with the fonts, alignment, and number. Now let me define a few core names and concepts that you’ll use when you work with Excel in this workbook to manage data. So each field or rectangle that you can see here as I’m highlighting them, these are called cells. Then you have columns, and those are the vertical lines of cells, and those are represented with letters on top.

-Next you have rows, and those are the horizontal lines, and those are represented by numbers. For example, the upper left cell is called A1, A for the column name and 1 for the row name. Now a block of multiple connected cells is called a range. So here, for example, I’ve selected range A1 to D4. Right now I’m in a sheet called Sheet1, and you can see in the lower left corner, I can add more sheets, like I’ll do now, and then I can move between multiple sheets and reference data across them as well. But I won’t do that today.

-So now I’m going to go ahead and go back to Sheet1. And if you right-click and go to Format Cells, you’ll find options for things like number formats, for example, currency, date, time, and percentage. And on the Home tab, the font group is another place to change these settings, as well as Fill, which lets you change the background color for cells, columns, or rows. I’m going to add some text in this cell as a title for what I want to create today, a monthly expense tracker. Now this text looks like it’s spilling into cell B1, but it’s actually just in cell A1. So I can widen or narrow the columns as much as I want. And if I want this title to span several columns, like in my case, I know that I’m going to need 12 months. So I’ll go ahead and select rows M1 all the way back to A1. Then in the alignment group, I’ll choose the Merge & Center option right here, and that makes my 13 cells into one with the text centered.

-So now, in the font group, I can choose the fill color that I want. So in my case, I’ll pick blue. Then for the font color, I’d like to choose something contrasting. So I’ll choose white in my case. And by using these formatting options, you can make things a lot easier to understand as you work with your data. But we still need some content, so let’s add some. So for that, I can use AI with Copilot to generate sample data. So I’m going to go ahead and pull up Copilot and type, “Generate monthly personal finance data for one year with months for columns and expense categories as rows, including sample data. Do not add columns or rows with totals.”

-Now I added that last sentence because I want to show you how to calculate totals yourself in a moment. The Copilot is part of Excel on the web and in the desktop and mobile apps if you’re using Microsoft 365 Personal or a work or school account. And you’ll see, once it’s finished, that Copilot generated a Category column and several month columns, as well as multiple rows with different expense types all filled in with the sample data that I asked for. Now notice that it also formatted the row 2 and column A using formatting options that I mentioned before. And each cell in the middle is also formatted as a currency number with a dollar sign.

-So I want to add a row here, in my case, for car payment. And you’ll see that it doesn’t match the others yet, and I’ll fix that in a second. Now I’ll add an amount for January, 300. And since this is the same amount every month, I can just select the cell. Then using this square in the lower right corner, I can just drag across the other months, and each, in this case, will have the same number, 300. Let’s fix our formatting. Now, to make the dollar amounts match the cells above, I’ll select this one above my new row, then click on the Format painter, this paintbrush icon here, then I’ll select my new cells. And now they all match. Now I can do the same thing for my Car Payment label in cell A16.

-So now I have some formatted data to work with and I can show you how to work with those numbers. I’ll use the Formulas ribbon where you’ll see the most common options to analyze data. For example, if I select all the cells with numbers in column B, then I go up and click on AutoSum, it adds all of the numbers in that column. In fact, now if I click on that cell in the formula bar, I can see a simple formula. Now these start with an equal sign, in my case, SUM as the function itself. Then I have an open parentheses with my range, in my case, B3 to B16, and close parentheses for what I want to calculate. Now that was an example of a very simple formula. Like I did before with the numbers, I can even drag formulas into blank cells.

-So I’ll go ahead and grab this one again by the lower right corner square and drag it across all of my columns. So that now has copied the original formula from the B column and duplicated it for each of the other columns. But as I click into each one, notice something that just happened, I have the column letters B all the way through M to each corresponding formula. That makes each sum specific to each of these column months. Likewise, I can select and drag entire columns into blank areas to fill in that data too. And because Excel detected a series of month names in row 2, it even filled in Jan as the new month name for the new cells that I added. Now let’s try another basic formula. For that, I’m going to select all the numbers above the totals row in column B.

-Now I’m going to choose Average, and that adds a cell with the average across the entire range that I just selected. So now I want to clean up a few cells. And when you go to delete data, you’ll need to know a few different options. So first, I’ll select the month cells that I just added. And if I just hit the Delete key, it leaves the formatting in those columns, like this blue cell here. This is also called clearing content. I’ll use the Control key + Z simultaneously to bring that content back and undo changes. Now I’m going to go ahead and select the same cells. And when I right-click, you’ll see that there are options to Insert or Delete along with Clear Contents like I just did using the Delete key.

-So this time, I’ll choose Delete, and then I have options to delete a column or shift cells left or up. In my case, deleting column N and shifting cells left will clear the contents and formatting. I’ll choose Shift cells left. So now I’ll clear the contents of rows 17 and 18 with my sums and the average to get my content data ready for other ways to analyze it. And there are hundreds of formula options in Excel. In fact, if I expand Financial functions, there are dozens related to accounting and finance. and hovering over each explains how they are used. And in math and trig, for example, there are dozens more that may look familiar if you’ve ever used a scientific calculator. And here I’m just scratching the surface. Those are just a few highlights of the functions that you can use.

-But what if you know how to describe what you want but don’t know the function for it? And that’s another area where Copilot helps you get started. So this time, I’ll use Copilot to calculate the totals. I’ll type, “Add a row and column with totals for each month in category.” And Copilot adds the totals by month and even a new column with the totals per category. Copilot will also help with cell formatting. So if I add, “Make the cells you just added with formulas white and bold text in black,” in my prompt, Copilot then reformats those cells too. And you can also add colors to each cell to easily spot differences across these numbers using something called conditional formatting, which is something else that Copilot can help with. I’ll type, “Add conditional formatting in each row to highlight low and high numbers.”

-And now we can see where the numbers are the lowest and the highest compared to the others in the same expense category for each month. So you just need to describe what you want and Copilot will do the rest. Now let’s go ahead and move on to deeper analysis of our data. With conditional formatting applied, it’s easier to see each month and how it varies in costs across our different categories. So let’s find some outliers. So I’ll ask Copilot, “What months have the highest expenses and why?” And Copilot analyzes the information and finds the months with the highest expenses.

-Then for each, it explains why with the most likely reasons. In this case, December is my highest, and that’s likely due to holiday spending and seasonality. July is the next highest, likely due to air conditioning for utilities costs and the rest of the summer activities that were happening in July. Then August was third highest, also with more travel, AC costs, and dining out. The key insights here summarize what Copilot found with reasoning for increases and decreases along with the lowest months as well. And one more core component that I’ll touch on today is how Excel lets you edit workbooks simultaneously with others.

-As I mentioned in the beginning, when you’re using Excel, signed in with a Microsoft account, or using Microsoft 365 at work or at school, it stores your files in OneDrive by default. Now, it also means that when you share an Excel workbook with other people using their name, group, or email, I’ll add Adele here, for example, and hit Send. Then they will be able to open the Excel workbook on their computer or phone and simultaneously edit it with you. And while you co-author with other people as changes are made, like with Adele here, changing the amounts for dining out and entertainment in January, they are saved to the same file.

-So those are the basic concepts to navigate Excel, format data, analyze it, and work with others using sharing. And I showed you how Copilot AI can help you as you get started. To learn more, check out microsoft.com/excel. And be sure to subscribe to Microsoft Mechanics for the latest updates, and thanks for watching.

Work IQ | Data, Context, Skills & Tools for Copilot and Your Agents

Zachary-Cavanell — Thu, 14 May 2026 12:00:00 GMT

Pull context from SharePoint, OneDrive, Teams, email, and meetings — all through Work IQ. Draft Word documents that carry your existing sensitivity labels, and resolve calendar conflicts in Outlook. Run multi-step Copilot Cowork workflows that generate files, schedule meetings, and send status updates from a single prompt.

Extend the same knowledge layer to ServiceNow, CRMs, and other non-Microsoft systems with API and MCP Server connectors in the Microsoft 365 admin center, or build your own agents in code against the Work IQ API.

Jeremy Chapman, Microsoft 365 Director, shares how data, context, and skills & tools combine into a single grounding layer for Copilot and your custom agents.

Skip the manual prompt scaffolding.

Work IQ delivers data, context, skills & tools as the built-in knowledge layer behind Microsoft 365 Copilot and agents. See how it grounds every response.

Kick off Copilot Cowork with one prompt.

Generate a briefing doc, customer presentation, and Excel forecast in parallel. Queue up meeting scheduling and email drafts while it works. See how it runs.

Your agent. Your code. Work IQ’s grounding.

Integrate Work IQ data, MCP servers, plugins, and skills into custom agents via the Work IQ API. Start here.

QUICK LINKS:

00:00 — Work IQ Knowledge Layer

01:32 — Copilot Chat experiences

02:16 — Work IQ in your apps

03:03 — Auto-Applied Sensitivity Labels

04:20 — Copilot Cowork Agentic Workflow

06:11 — Admin Center Connectors

07:21 — Work IQ API for Developers

08:50 — Wrap up

Link References

Check out the latest updates at https://aka.ms/WorkIQ

Unfamiliar with Microsoft Mechanics?

As Microsoft’s official video series for IT, you can watch and share valuable content and demos of current and upcoming tech from the people who build it at Microsoft.

Subscribe to our YouTube: https://www.youtube.com/c/MicrosoftMechanicsSeries
Talk with other IT Pros, join us on the Microsoft Tech Community: https://techcommunity.microsoft.com/t5/microsoft-mechanics-blog/bg-p/MicrosoftMechanicsBlog
Watch or listen from anywhere, subscribe to our podcast: https://microsoftmechanics.libsyn.com/podcast

Keep getting this insider knowledge, join us on social:

Follow us on Twitter: https://twitter.com/MSFTMechanics
Share knowledge on LinkedIn: https://www.linkedin.com/company/microsoft-mechanics/
Enjoy us on Instagram: https://www.instagram.com/msftmechanics/
Loosen up with us on TikTok: https://www.tiktok.com/@msftmechanics

Video Transcript:

-Imagine AI that understands your individual work context without you having to author long, detailed prompts, manually upload reference content, or query and add business data. That’s what Work IQ is all about. Today, I’ll explain what Work IQ is, how it works, and show you what it can do. So, Work IQ is the brain behind Microsoft 365 Copilot and agents. It’s a built-in knowledge layer that comprises data, with secure access to your unstructured work data across SharePoint, emails, Teams chats and meetings, as well as your structured business data in Dynamics 365 and Power Apps. And you can extend Work IQ data even further to securely interact with external systems using Copilot and Power Platform connectors.

-Then context adds semantic understanding of your business data and relationships, like who you work with, work patterns, like projects important to you. This context also includes personalization in Copilot, consisting of the instructions you provide to format its responses, as well as saved memories comprising personal interests and important facts that Copilot retains from chat.

-And finally, skills and tools as actions that AI can take with specialized capabilities like generating different files, workflow automation for business processes, scheduling relevant meetings, and more. Together, all of these elements are added to your prompts and subsequent reasoning steps performed to generate more relevant responses and outputs. If you’re using other AI tools today, these are things that you would need to bring in manually, sometimes moving files from policy-protected locations to services without your security controls or visibility, so let me show you a few examples of how this works, starting with a few that use data and context.

-So, I’m in Copilot Chat and want to follow up on a recent project discussion, so I’m going to I’ll prompt it, “What did Daichi say about the solar promo timelines earlier this week?” Even though this is a vague statement and could be information in email, Teams, or a recent meeting, Work IQ finds the conversation and its details, then presents those to me. It also finds a related meeting series in my calendar that Daichi scheduled on the topic. And these Work IQ experiences are also available in your apps, like Outlook or other Microsoft 365 apps.

-In this case, my calendar is packed with meetings and I’m double-booked in three different time slots. From Outlook, I can ask Copilot to recommend how to resolve conflicts on my calendar for May 12. Copilot, using information from Work IQ, analyzes my schedule, along with my priorities and past meeting patterns. It finds the three timing conflicts on top. Then for each conflict, it reasons over the adjacent meetings, my role, and work patterns to create detailed recommendations for each conflict time. Below that in the summary, it suggests which meetings to reschedule, who to notify, and some actions to take. And Work IQ can help as you write or edit your files in apps like Word.

-So, here, I want to to write a summary for a project, and as you can see, there are no project details in this document. It’s just a blank page. So I’ll open Copilot and I’ll prompt it to draft an executive summary about our expansion strategy that highlights our products, the market for outdoor gear, our unique position, and go-to-market strategy. Copilot, together with Work IQ, finds and pulls in data from relevant project files in SharePoint and OneDrive, recent updates from meetings, and relevant emails and Teams conversations. You can see that it automatically applied a sensitivity label based on my existing information protection policies.

-Then it generates a detailed summary using all of the data and context that it found, and assembles a fully formatted Word document with specific details about our connected outdoor products, the market opportunity, go-to-market strategy, and our expansion plan with details for carrying it out. As you saw, I didn’t need to author a super long detailed prompt with the project details and have to upload any content or even directly reference files using links. It automatically retrieved relevant content that was aligned with my access permissions as well as my company’s data security policies.

-Now let me show you an example using intelligent skills and tools. In this case, I need to prepare for a customer meeting where I need to have several files generated, internal briefing document, a customer presentation, and data insights in a spreadsheet. So, for that, I’ll use Copilot Cowork. I’m going to paste in my prompt where I’m asking it to create those files. Now, I’ll kick off the process. And now it’s using Work IQ data, context, skills, and tools to find relevant data and information and then generate the files I want.

-Now, this process can run several minutes, so I’ll speed things up a little to save time. As it works, I can even request more tasks while it’s running using other skills and tools. Here, I ask it to schedule prep time with people on my team and send an email status update to the account team. As it continues working, it checks and finds a mutually open time on our schedules, and it proposes a meeting with participants with all of the details filled in. I can create it right from here. Then it uses another skill to author an email to my contact on the account team that I can even edit right from here. Once everything’s done, you’ll see that it’s created a Zava client presentation, a customer briefing doc, and a customer overview Excel file. I’ll open the briefing document first, and it has everything relevant to the meeting and uses our standard briefing template.

-Now, I’ll open the presentation it generated. It explains our work at a glance with key metrics from Work IQ and referenced files, as well as revenue and growth highlights. Now, if I move on to the generated Excel file and open that, it’s laid out year-over-year performance and used that to generate forecasts for this year And you can see the growth trends and more, all from the data it discovered via Work IQ. And like I mentioned, the data can be securely extended to systems from non-Microsoft services using connectors, allowing you to pull in other information like your online CRM systems, content management, databases, ticketing system, and more.

-Now, these can be added and configured under Copilot Connectors in the Microsoft 365 admin center. The gallery lets you select from dozens of pre-built connectors or you can create your own. And these can be API-based or MCP server-based. API connections are indexed for read operations and MCP servers are not indexed and support read and write. To add one, like this API-backed connector for ServiceNow Knowledge, you’ll set up the REST API endpoint, provide its namespace and URL to your instance. And since I already have a few MCP server connectors configured, I’ll cancel out of this view and then go to my connections to show you those. Now, here, you can see all of the MCP connections that I have configured in my tenant for things like financial apps, creative suites, collaboration services, and more.

-Once connected, these in turn can be accessed via Work IQ by Copilot or your agents. In fact, as a developer, if you are building agents, you can integrate Work IQ into your code with connections using the Work IQ API. Here, I’m using the GitHub CLI. It’s connected to Work IQ and using its underlying MCP servers, plugins, and skills. I have my prompt already entered to find a conversation with Ben and Darrel asking about the availability of an MCP server from the claims team. Now, I want this agent to build another agent based on our discussed feature requests, so I’m going to kick it off. And you can see that it reasons immediately and looks for the conversation to find the features that it needs.

-So, after it’s found that, it lists out the features and connects to the insurance claims MCP server and looks at its available tooling. Then it starts to build the scaffolding files for the new agent as JSON and text files. And then deploys a local instance of the agent to test out with a link, so I’ll open that and run a prompt to stack-rank my open claims by age so I can clear the backlog. Then the agent builds a nice claims dashboard with a tiled view of each stack ranked claim. And below that, it even summarizes my priorities so that I can easily focus on what’s important and work through the list.

-So, even as you develop new agents or work in other solutions, you can use the data, context, skills, and tools from Work IQ to power those experiences and save time. Work IQ works with Copilot and your agents to deliver personalized, accurate, and grounded outputs based on your real work data, context, and specialized skills and tools.

-To learn more, check out the latest updates at aka.ms/WorkIQ. Keep watching Microsoft Mechanics for latest deep dives about AI and what makes it work. And thanks for watching.

Azure Arc | On-prem + Multi-cloud Management

Zachary-Cavanell — Wed, 13 May 2026 14:32:38 GMT

In this video, we explore how Azure Arc simplifies hybrid and multi-cloud operations by providing a single, consistent control plane for managing your entire infrastructure across Linux and Windows, on-prem, in Azure, or in any cloud.

Once connected, you can patch Windows and Linux together with Azure Update Manager, enforce CIS benchmarks and Azure Security Baselines through Azure Policy, and pull consistent inventory, tags, and RBAC across your whole estate.

Auto-recover unbootable Windows Server 2025 machines with Quick Machine Recovery, audit and configure WinRE using built-in Azure Policy. Run your virtual machines as Azure Virtual Desktop session hosts on Nutanix, VMware, Hyper-V, or using physical Windows hardware.

Satya Vel, Azure Arc Principal Group PDM Manager, shares how to make Azure your operational standard for every workload, anywhere it runs.

Learn more about Azure Arc at https://aka.ms/AzureArcServer, or join the community at https://aka.ms/ArcServerForumSignup

Organize, filter, & manage inventory at scale.

Centralize visibility into servers, VMs, and Kubernetes clusters across on‑prem, AWS, GCP, and Azure from a single control plane. Check out Azure Arc.

Policy-as-code, everywhere your servers run.

Azure Arc extends Azure Policy to on-prem, AWS, and GCP resources — pre-built CIS and security baselines included. Try it.

AVD, off-Azure.

Azure Virtual Desktop for hybrid environments turns any Azure Arc-enabled Windows VM or physical server into a session host. Get started.

QUICK LINKS:

00:00 — Azure Arc in hybrid environments

00:46 — Transitioning to Azure Arc

02:35 — Unified management

03:43 — How to bring in servers and containers

04:48 — Inventory management

05:30 — Patching

06:48 — Auto-manage future updates

08:25 — One-time update

09:32 — Configuration in a hybrid environment

11:05 — Auditing Windows machines

11:34 — Microsoft Defender for Cloud

13:06 — Desktop virtualization

13:51 — Wrap up

Link References

For more information go to https://aka.ms/AzureArc

Unfamiliar with Microsoft Mechanics?

As Microsoft’s official video series for IT, you can watch and share valuable content and demos of current and upcoming tech from the people who build it at Microsoft.

Subscribe to our YouTube: https://www.youtube.com/c/MicrosoftMechanicsSeries
Talk with other IT Pros, join us on the Microsoft Tech Community: https://techcommunity.microsoft.com/t5/microsoft-mechanics-blog/bg-p/MicrosoftMechanicsBlog
Watch or listen from anywhere, subscribe to our podcast: https://microsoftmechanics.libsyn.com/podcast

Keep getting this insider knowledge, join us on social:

Follow us on Twitter: https://twitter.com/MSFTMechanics
Share knowledge on LinkedIn: https://www.linkedin.com/company/microsoft-mechanics/
Enjoy us on Instagram: https://www.instagram.com/msftmechanics/
Loosen up with us on TikTok: https://www.tiktok.com/@msftmechanics

Video Transcript:

- If you’re managing servers and containers today, you’re probably operating across on-prem multiple clouds and using different tools for each. Azure Arc changes that by providing a single way to manage servers, Kubernetes, and containers across Linux and Windows, on-prem, in any cloud, and at the edge. Since launching in 2019, Azure Arc has gained strong momentum, enabling consistent patching, configuration, compliance, and advanced resilience features like remote recovery even for machines that cannot boot and more. And to explore how Azure Arc works in real hybrid environments, I’m joined by our resident management expert, Satya Vel. Welcome.

- Hi, Jeremy. It’s great to be on the show. It’s been a while.

- Yeah, it has been a while. Thanks for joining us today. And why don’t we jump right into this? So if I’m coming from maybe a traditional server management background using things like Ansible, VMware vSphere, maybe System Center, what does it take then to transition to Azure Arc, and why would I do it and is it worth the effort?

- That’s a fair question. Those are all proven powerful tools. That said, it’s challenging moving between multiple tools to manage what you have. What we are seeing today is more of a people and process change. Most enterprises are now hybrid by default, on-prem, multi-cloud, multiple operating systems managed by a central operations team. And what those teams want most is consistency. Azure extends its management capabilities to servers and Kubernetes clusters wherever they run using Azure Arc. That’s where the value of cloud native innovation shows up, beyond basic monitoring of servers and clusters, like the health and status of each resource. With Azure Arc, you can collect richer operational and security data and query it at a massive scale. All these are now actionable insights. You can use them to improve your security posture to close vulnerabilities faster. They’ll let you more easily fix compliance drift to realign resources with your policies and maintain day-to-day operations. This includes modern patching, all applied across your multi-cloud and hybrid estate. And finally, Azure Arc centralizes governance by bringing consistent tags for grouping along with unified identity and access management using RBAC for connected resources. That way everything is controlled the same way regardless of where it runs from a single control plane without duplication or drift. So to answer your earlier question, it is totally worth it, and Azure Arc is really the glue that brings it all together.

- Okay, so why don’t we make this real for everyone watching? Can you show us the unified management experience and what that looks like with Azure Arc?

- Sure thing, and that’s the best part. In fact here I’m managing my on-prem and multi-cloud environment using Azure services enabled by Azure Arc. Notice I have everything from a Windows server to Kubernetes clusters running on AWS, different Linux distros. There’s even a Windows client Desktop VM and more. All right here. And I can drill into any of these items to see its specs as well as what’s configured. I can take a look at whether it’s compliant with my configuration policies. For example, this test resource has a few non-compliant policies that I might want to take a look into. And the great thing is everything is in one spot. I don’t need to move between consoles to see everything. Once these resources are enrolled, everything is automated and rule-based. I can look for servers and workloads as they are provisioned or updated, and monitor them 24/7. Then based on the configuration status it finds, it can take actions and get items into a compliant state.

- Okay, so we’re going to get to what the management experiences look like in a minute, but let’s go back a step. So what happens if I’ve got infrastructure and I want to bring that into Azure Arc? What does that experience look?

- This process is super straightforward and simple. Let me show you. You can bring servers and containers running in any cloud on-premises and on any hypervisor under management with Azure Arc. To onboard resources to Azure Arc, we have a few different methods. The any environment option is the most flexible, where you can use scripts for Linux and Windows, or an installer. This is a lightweight agent that you can install on your Linux and Windows servers. You can use your preferred deployment method to run the scripts on your servers and clusters, like this one for Linux, which downloads the agent, installs it and connects it to Azure Arc. And if you have existing tools like Ansible Automation Controller, formerly known as Ansible Tower, we have published a playbook that makes it super simple to onboard your machines. And this playbook is published in the Ansible Galaxy, which is the official community hub.

- Okay, so now we’ve got everything in. Now moving into the next thing that people manage a lot every day, inventory. So how does Azure Arc change that?

- So I briefly showed the different locations and platforms that could run under Azure Arc. But there’s more to it. All my servers and clusters are in one view. It spans on-prem as I search for Azure Local, then I’ll filter for AWS as well as GCP services. And I can see Azure VMs plus my on-prem servers listed together with a consistent tagging and status information. I define everything based on their location and platforms in Azure, so it’s super easy to see where everything is running, and there’s less chance that any infrastructure falls through the cracks.

- Beyond inventory management, something else that we do every day is patch management. So can Azure ARC handle patch management for servers and infrastructure outside of Azure?

- Absolutely. This is an area where Azure Arc can help a lot. Today, patching often means different tools for different environments: WSUS or SCCM for Windows, scripts for Linux, or separate crowd portals. And with Azure Arc, this all happens consistently from one place. You can see Azure Update Manager, which I have opened here. Each server has an update status indicating if it’s got pending updates or not. Azure Update Manager continuously assesses the update compliance of your managed servers on a schedule. And you can manually trigger assessments by selecting resources and hitting check for updates. Now, you can see I have both Linux and Windows machines missing updates, and even though these are different OS types, I can update them together with just a few clicks if I want. But before I do that, notice this on-prem Windows Server 2016 machine that needs to be updated. Here, a benefit of managing your Windows and SQL Server infrastructure on Azure is that the service offers extended security updates so you can run them longer in support without disruption to business critical applications. Let’s get back to updating these machines. The nice thing is that you only have to set the right policy and logic one time to manage updates automatically in the future. To save a little time, I’ll select every machine. From here, I can schedule updates for these resources where first I’ll fill in the basics for my subscription and resource group. Then the instance details like the configuration name and the region. The maintenance scope using the guest option lets me target my resources. Then under schedule, I can select the start date as well as the time, how many hours and minutes I want the maintenance window to be, the frequency of repeats in hours, days, weeks, or months. Then in the resources tab, if I want to add more servers, I can group everything I want in the same maintenance schedule. Likewise, you’d use this grouping for staggered rollouts. Importantly, using dynamic scopes, I can also make sure that any new resources are targeted as they come online based on defined filters like the resource groups they’re in, the resource types, locations, operating systems or tags. In updates, I can target the type of updates I want, for example, only critical and security updates. Finally, I can add pre and post events to run before and after the update, like redirecting an app to an informational page saying that the resource is being serviced and when it’ll be back online. Of course, I can tag this as well. And then I just need to review and click create.

- And the favorite thing I just saw there was the dynamic scoping that you can apply as a set it and forget it setting basically. So what happens though, if I’ve got an update that’s really critical that I need to push out immediately, can I do that?

- Not a problem. You can do that as well. For that, you’ll select one or more resources and choose one time updates so that it gets applied immediately. I just need to confirm the machines, then choose the update type or any exclusions that I want to define. I’ll keep everything in scope here. Then in properties I can determine the reboot behavior I want and maximum maintenance window time in minutes. From there, I can review and install. That will push the update to my selected servers, whether they are in the cloud or on-premise, so it’s one place to get resources into update compliance. And in case you want to stagger updates over a longer period of time for large patch management jobs, you can orchestrate updates using groups.

- So the main thing is here you control the timing, like only patching during off hours and approvals and you get to decide which updates to apply, so it’s super flexible. Now, software updates are one type of configuration management, but what other types of configurations can you manage here?

- Configuration management in hybrid environments is complex. You traditionally use group policy, desired state configuration or scripts for Windows, and then separate tools like Ansible, remote scripting or manual commands of SSH for Linux. All this can be done centrally from Azure Arc. It extends Azure policy to any resource. And you can use Microsoft provided built-in policy baselines covering common security requirements. For example, the security baseline contains best practices and controls that we’ve defined for cloud services running on Linux and Windows. And above that, you can also see CIS Benchmark policy, which is an internationally recognized standard spanning OS platforms used to protect against cyber attacks. I’ll apply this baseline, then I’ll choose the Red Hat Enterprise Linux 9 Benchmark. And searching across 300 CIS Benchmark policies, I’ll look for passwords. And there are 24 policies defined. And then for Firewall, you can see four more. And these are just a few examples that are pre-configured. So once you assign these to your resources, Azure continuously monitors each machine for compliance. So you can use policy as code across your entire state with Azure policy controls that automatically stay current as standards like CIS evolve. We also recently added the ability to audit and enable WinRE through Azure Arc, improving recoverability even for machines that can’t boot. As you can see, there are a couple of new policies for auditing machines that do not have WinRE enabled and configuring WinRE on Windows machine. With quick machine recovery on Windows Server 2025, that also means for broader issues with known fixes, we’ll automatically recover machines that are not bootable.

- And that’s really a great resiliency option. But what about security, compliance, and configurations and assessments? Can we do something there?

- For that, you can use Microsoft Defender for Cloud. This lets you standardize security agents and settings across machines and containers wherever they run. In the Defender portal, you can see that the same way Azure Resources spanned Azure, AWS, GCP, and other environments, those same resources are visible here too. Defender continuously assesses connected resources for security posture. This includes what I showed before in the Security Baseline and CIS Benchmark. It detects threats in real time with associated security alerts and how they are trending. You get a complete breakdown by compute with your virtual machines and their associated risks. And the same is true for your connected containers running in Kubernetes. If I move over to cloud assets here you can see all the virtual machines, Kubernetes clusters that we saw in Azure Arc. And clicking into any of these, like this Ubuntu VM will show me all of its details. Scrolling down, I get a view of its risk factors. And below that, you’ll see that this one has 82 risk-based recommendations to improve its security.

- And one of the big upsides of Microsoft Defender is that shared visibility, so everything logs to the same place. So if you think about assumed breach, it means that you won’t have any blind spots then as attackers are moving laterally through your environment. So that means security teams, they see what you see. So why don’t we move on though to desktop virtualization. What can Azure Arc do to help me there?

- Sure, Azure Arc unlocks the ability to run Azure Virtual Desktop, or AVD, for short, outside of Azure so it can run on your own infrastructure, either via Azure Local or something new we recently announced: Azure Virtual Desktop for hybrid environments. This means any existing on-prem server can be configured as a AVD session host as long as it’s attached to Azure Arc. The management is in the VM layer using a management extension. It’s flexible, and Nutanix AHV, VMware vSphere, Hyper-V, or physical Windows Server can work. So with Azure Arc, you have full control over the entire infrastructure’s lifecycle from inventory, configuration management and policy enforcement all from one place. And the good news is that if you own Software Assurance, you can access services enabled by Azure Arc as part of your license for inventory, configuration, and update management.

- That was a great tour and update of Azure Arc. So thanks for joining us today, Satya. And if you want to learn more about Azure Arc and try it out for yourself, just go to aka.ms/AzureArc for more information. Or as an admin search for Arc, A-R-C, in the Azure Portal to get started. And keep watching Microsoft Mechanics for the latest updates. We’ll see you again soon.

Agent 365 | Your Security & Compliance Controls

Zachary-Cavanell — Wed, 13 May 2026 06:21:15 GMT

Block agent access to labeled files at runtime, stop sensitive data from leaving in agent-drafted emails, and catch agents that cross conduct lines using the same Microsoft Purview controls you already run for users. Map every risky agent action in Insider Risk Management, drill into Activity Explorer for interaction-level detail, and pull regulator-ready forensics from Purview Audit.

Shilpa Ranganathan, Microsoft Purview Partner Group Squad Leader, shares how IT and data security teams can govern agent behavior on a single Agent 365 control plane built into the Microsoft tools that you're already using today.

Block labeled files from agent access in real time.

No policy bypass, no data leak. See how it works using Microsoft Purview as part of Agent 365.

Same policies, now extended to agents.

Purview DLP catches sensitive content and blocks the send. Watch it in action.

Map the full chain of risky agent actions in one view.

Insider Risk Management in Purview sequences sensitive file access & DLP blocks. See how it works.

QUICK LINKS:

00:00 — Agent security, compliance, & IT

01:13 — IT & data security teams using Agent 365

02:22 — Visibility with Microsoft Purview

03:14 — End user perspective

04:05 — DLP on Agent-Initiated Messages

04:23 — Communication Compliance for Agent Behavior

04:50 — Data Security admin in the Purview portal

06:04 — Policy violations

06:39 — Purview Audit

07:06 — Microsoft 365 admin center

07:44 — Wrap up

Link References

Check out https://aka.ms/Agent365DataSecurity

Unfamiliar with Microsoft Mechanics?

As Microsoft’s official video series for IT, you can watch and share valuable content and demos of current and upcoming tech from the people who build it at Microsoft.

Subscribe to our YouTube: https://www.youtube.com/c/MicrosoftMechanicsSeries
Talk with other IT Pros, join us on the Microsoft Tech Community: https://techcommunity.microsoft.com/t5/microsoft-mechanics-blog/bg-p/MicrosoftMechanicsBlog
Watch or listen from anywhere, subscribe to our podcast: https://microsoftmechanics.libsyn.com/podcast

Keep getting this insider knowledge, join us on social:

Follow us on Twitter: https://twitter.com/MSFTMechanics
Share knowledge on LinkedIn: https://www.linkedin.com/company/microsoft-mechanics/
Enjoy us on Instagram: https://www.instagram.com/msftmechanics/
Loosen up with us on TikTok: https://www.tiktok.com/@msftmechanics

Video Transcript:

-How do you make sure agents don’t run unchecked across your environment? It starts with the right level of observability across security, compliance, and IT, insights that’s tailored to each team’s domain expertise, yet shared across teams, so issues can be identified early and addressed quickly when something goes wrong. This is where Agent 365 comes in to bring together security and IT teams so they can stay in control through a unified control plane, built to work with the Microsoft tools you already use.

-Whether you’re viewing agents along with their configurations and high-level activities in the Microsoft 365 Admin Center, understanding agent activities and protecting sensitive information with Microsoft Purview, managing agent identities and permissions to apps, data, and resources with Microsoft Entra, or investigating and responding to incidents in Microsoft Defender, Agent 365 provides a common source of truth for agent activity, enabling teams to assess and respond to risks from their own domain expertise using the tools and workflows they know best. Today is the first episode in a series where we go deeper on using Agent 365 across your organization, starting with protecting your sensitive data. For example, if data isn’t properly classified and protected, AI, which uses powerful semantic search, can quickly surface information that was once hard to find, leading to data loss.

-At the same time, it can potentially share it with the wrong people, and related other risks can escalate quickly. Microsoft Purview now extends the controls you have for users in your organization to agents so they stay aligned with your organization’s data security and compliance requirements. Let me show you how IT and data security teams can work together using Agent 365. Starting in Agent 365 in the Microsoft 365 Admin Center. As an IT admin, I can see a comprehensive list of agents in our organization. I can manage agent deployment requests to review the details for agent configurations and even leverage built-in security defaults for Agent 365 to quickly establish policy controls.

-That said, as agents are used inside of your organization, Microsoft Purview, as part of the Agent 365 control plane, provides more granular controls with deeper visibility over data security. This includes rich AI observability, protection, and compliance. Right from Microsoft Purview, I can see agents running in my organization with the same left-to-right agent visibility we saw in the Microsoft 365 Admin Center. From Data Security Posture Management, or DSPM, for short, I can find key agent metrics and what’s important for data security, like which agents are active and their risk levels, whether they’re interacting with sensitive data, in which ways, along with interaction trends. I can also see if their activities are protected with sufficient policy coverage.

-Let me show you an example of how this level of oversight and protection works, starting from the end user perspective. This is a custom, in-house-developed Zava supplier agent. It’s designed to review and summarize purchase orders for clients. Here, a member of the procurement team asks the agent to review a few linked purchase orders PDF files and check for delays and impacts. The reasoning agent gets to work almost immediately, providing a summary for the linked files. It then attempts to access a contract file to figure out the contractual impacts of any delays.

-Now, because the contract has a label that the agent is not allowed to process, it stops and says that it cannot access the information contained in that file. This is Microsoft Purview enforcing least-privilege access in real time. Next, our same user asks the agent to email the summary to an external supplier. The agent tries, but Purview spots sensitive data in the message. In fact, if we move to Outlook and open the message, we can see that our sensitive information policies have blocked the email from being sent. Back in Teams, we can see that the same user is attempting to use the agent to draft an email that promises an exclusive gift incentive to fast track the PO approval. The agent stops again. It recognizes the request crosses ethical and compliance lines and explains why to our user.

-Importantly, behind the scenes, Purview logs all activity as it happens and flags the interaction for review. In fact, let’s switch perspectives to the data security admin in the Purview portal after these activities have taken place. I’m back in DSPM under AI Observability with a view of my running agents. And on top of my list, Purview has flagged the supplier agent as high risk. Let’s drill into it. For that, I’m in insider risk management view for this activity. It maps out the sequence of events that our user and agent attempted to carry out, starting with sensitive file access in SharePoint, including the contract I mentioned.

-Then the DLP policy block, which stopped the email summary from being sent to the external supplier. And, finally, the unethical behavior block when a user attempted to offer a gift in exchange for faster contract approval. All these activities raise the risk level of the agent, and each action is clearly outlined. To get more detailed context about the agent’s behavior, I can view the activity timeline, which links me directly into Activity Explorer in DSPM to see other interactions with this agent. It looks like there’s a mix of benign activity at the bottom of the list, and the higher risk activities for our user are at the top. All prompts and responses are evaluated against compliance policies and classifiers, and any matches are surfaced using the same investigation and remediation workflows you already use today.

-In fact, you can find the details for agent policy violations across solutions in Microsoft Purview. For example, if your focus is on communication compliance, you can find the details for the agent interaction that was flagged as unethical. In this case, it matched the gifts and entertainment condition. And clicking in, you can see related matches for other sources too. And Purview Audit also captures every agent interaction, which you’ll find using an audit search.

-Here we’ve searched across agent interactions that occurred between February 1st and March 1st for our agent, and you can see the exportable details for each interaction, including IP, user, agent, record, and activity details. So when a regulator asks: “How did this happen?” You can trace it instantly using Purview Audit. Of course, with Agent 365 at the foundation, everything is connected and integrated across the control plane. So now as an IT admin working in the Microsoft 365 Admin Center, I can see the agents running in our environment filtered by high risk, and there’s our supplier agent. In its details, under Security and Compliance, I can see it has performed a few risky activities. This is all signal that has been pulled in from Microsoft Purview as part of Agent 365.

-From here, I can tune the agent configurations, including its permissions, or even block it all together from use. AI agents move fast, and without the right level of visibility and guardrails in place, they can easily access data they shouldn’t overshare, and even work against your company’s ethics. Agent 365 with Microsoft Purview keeps your agents in line, spots trouble before it happens, and makes sure that actions are recorded.

-To learn more, check out aka.ms/Agent365DataSecurity. In the next episode of the series, we’ll explore Agent 365 with Microsoft Defender to investigate and respond to security incidents involving agentic activity. Subscribe to Microsoft Mechanics if you haven’t already, and thanks for watching.