4.1.6. Monitoring AI Security and Managing Agents
💡 First Principle: AI risk in Azure spreads across the model endpoints, the data they're grounded on, and the threats aimed at them, so posture findings, alerts, and sensitive-data exposure need to be read together — otherwise it's easy to miss that an exposed storage account is also the grounding source behind a burst of jailbreak alerts.
The Data and AI security dashboard in Defender for Cloud brings Azure data and AI resources into one view: protection coverage, top alerts (including AI threat protection alerts and prompts scanned), critical attack paths and recommendations, sensitive data discovery, and internet-exposed resources used for grounding. Full access needs Defender CSPM with sensitive data discovery plus the Defender for Storage, Databases, and AI threat protection plans. Its sensitive data discovery can use Microsoft Purview sensitivity labels and information types, but it doesn't show Purview DSPM for AI findings (such as Copilot oversharing) or Entra Agent ID findings; those stay in Purview and the Entra and Defender portals. Separately, managing agents in the Microsoft 365 admin center covers the administrative lifecycle of Copilot and other M365-integrated agents — which agents exist, who published them, and organizational-level enablement — a governance layer distinct from Entra Agent ID's identity/access governance.
⚠️ Exam Trap: The Microsoft 365 admin center's agent management view and Entra Agent ID access management (4.1.3) answer different questions — admin center management is about the agent's organizational lifecycle and publishing, while Entra Agent ID governs the agent's runtime identity, permissions, and Conditional Access scope. A scenario about "which agents exist in our tenant" points to the admin center; one about "what can this agent's credentials reach" points to Entra Agent ID.
Reflection Question: Why does having AI security signals consolidated in one dashboard matter more for AI workloads specifically than it might for a single traditional workload type?
