1.2.2. Where AI Workloads Introduce New Attack Surface
💡 First Principle: An AI agent is not just "another application" from a security standpoint — it can read data across systems on a user's behalf, take autonomous actions, and be manipulated through the content it processes rather than through a traditional exploit. That combination is why SC-500 gives AI security its own skill group instead of folding it quietly into general compute security.
This is the part of the exam blueprint with no AZ-500 equivalent, so treat unfamiliarity with these concepts as expected rather than a personal gap. Three new risk categories matter here: oversharing (AI surfaces content a user technically had permission to see but would never have found), agent identity risk (an agent's blast radius if its credentials are compromised), and behavioral risk (prompt injection or jailbreak attempts that manipulate what the AI does, rather than exploiting a code vulnerability).
| Traditional Workload Risk | AI Workload Equivalent |
|---|---|
| Overprivileged service account | Overprivileged agent identity (Entra Agent ID) |
| Publicly exposed storage | Overshared SharePoint content surfaced by Copilot |
| Injection attack (SQL, command) | Prompt injection against a model or agent |
| Lateral movement after compromise | Agent blast radius across connected systems |
| Missing egress filtering | Missing AI Gateway governance on model traffic |
⚠️ Exam Trap: A question describing a Copilot deployment that only surfaces documents users "already had access to" is not describing a non-issue — that's precisely the oversharing scenario Purview DSPM for AI is built to catch. Permissions being technically correct doesn't mean they were intentionally scoped for AI-scale discoverability.
Reflection Question: Why might an organization's SharePoint permissions have been "fine" for years and only become a real risk the moment Copilot was turned on?
