This site is a living document. Microsoft updates products and capabilities frequently — this log tracks meaningful content changes, corrections, and additions. Minor fixes (typos, link corrections) are not listed.
Entries marked 🆕 New are net-new content additions. Entries marked ✏️ Updated are corrections or refinements to existing content. Entries marked ⚠️ Correction are cases where earlier content was wrong or misleading and has been fixed.
| Type | Change | Page(s) Affected |
|---|---|---|
| 🆕 New | Added Playbook 09 — Prevent Data Leak to Shadow AI on playbooks.html. Source: Microsoft Learn — "Prevent data leak to shadow AI" deployment model (Introduction + Steps 1–4). Renders the four-stage blueprint as a full playbook: Stage 1 Discover (Defender for Cloud Apps generative-AI discovery + risk scoring/sanctioning; Purview DSPM for AI; Insider Risk Management baseline), Stage 2 Block access (Defender for Cloud Apps org-wide unsanction; Entra Internet Access user/group + Adaptive Protection with Conditional Access; Intune install blocking), Stage 3 Block sensitive data to sanctioned apps (sensitivity labels with encryption; Endpoint DLP paste/upload blocking; Edge Browser Data Security for consumer AI prompts; Network Data Security for non-Edge paths; Defender for Cloud Apps monitoring of M365 Copilot), and Stage 4 Govern (Purview Audit; Communication Compliance; Data Lifecycle Management retention; eDiscovery; ongoing Adaptive Protection). Includes the three-layer DLP coverage caveat, the unmanaged-device/personal-network gap on org-level blocking, a nine-item deployment checklist, and a cross-link to the Agent 365 local-agent controls (which govern local coding agents, vs. this model's browser/network generative-AI apps). Built as a stacked pb-block section (id #playbook9) using the site's defined playbook styling. |
playbooks.html, changelog.html |
| 🆕 New | Playbook index added for the stacked deployment/operational playbooks. The top-of-page nav grid previously listed only the four tabbed playbooks (01–04); added a "Deployment & operational playbooks" section with jump-cards for Playbooks 05–09 (each scrolls to its anchor), so the stacked playbooks below the tab switcher are discoverable without scrolling the whole page. | playbooks.html |
| ⚠️ Correction | Fixed three playbooks that were rendering invisible. Playbooks 06 (Red Teaming with PyRIT), 07 (Brief Your Makers), and 08 (Vet a Third-Party Agent) were authored as class="pb-panel" without the active class; since .pb-panel is display:none by default (it's the tab-switcher panel class), all three were hidden on the live site. Changed them to class="pb-block" — the always-visible stacked-section class already used by Playbooks 05 and 09 — restoring them to view. Verified in a browser that all six stacked playbooks now render. |
playbooks.html |
| Type | Change | Page(s) Affected |
|---|---|---|
| 🆕 New | Added a dedicated Agent 365 SDK deep-dive. Source: "Make any agent enterprise-ready with the Agent 365 SDK" (Aaron Bjork, co-authored by Jeremiah Follis · Jun 2, 2026). The SDK was previously mentioned only in passing across the site; this adds a structured section on agent365.html (#agent365-sdk). Documented: the automatic-vs-SDK distinction — Microsoft AI platform agents (Agent Builder, Copilot Studio, Foundry) get Agent 365 with zero effort, while external/open-source agents (e.g. OpenAI Agents SDK) integrate the SDK for the same controls; the three pillars — Observability (unified agent registry + Defender SOC hunting), Governance (agent lifecycle management, onboarding gates, policy templates bundling Entra/Purview/Defender/SharePoint policies, tenant-wide tool allow/block controls), and Security (Entra agent identity, Conditional Access + Identity Protection, Defender threat detection, threat-blocking on registered tool invocation via the ATG path); the three-step onboarding (install SDK in Python/TypeScript/.NET → register with the Agent 365 CLI → wrap the agent entry point); and the Microsoft Purview APIs add-on (prompt DLP, DSPM, Insider Risk, eDiscovery, Communication Compliance, Audit, DLM). Added a security-architect callout (the SDK is the enforcement boundary for non-Microsoft agents; un-instrumented agents sit outside ATG/Entra/CA/Defender — the existing Gaps-page coverage caveat), a new product-map.html card, an SDK block in both chat.js SYSTEM_PROMPTs, and updated the getting-started "Instrument custom agents" step with the three languages and a deep-dive link. Adopters named: Genspark, Zensai, Egnyte, Zendesk, Kore.ai, Kasisto, n8n. |
agent365.html, product-map.html, functions/api/chat.js, changelog.html |
| Type | Change | Page(s) Affected |
|---|---|---|
| 🆕 New | Reviewed and integrated the "What's new in Agent 365 — June 2026" blog. Source: Microsoft Community Hub (Alex Pozin, Samer Baroudi, Brendan Powers · published Jul 8, 2026). The June wave centres on local agents plus onboarding and programmatic governance. Added a dated June 2026 Update section on agent365.html (#june-2026 anchor) with two capability tables and an architect-takeaways callout, and three new product-map.html cards. New capabilities documented: (1) Local agents in the Agent 365 registry (public preview) — surfaces publisher, detected device count, last scanned date, and a per-agent pane listing every endpoint (device name, model, OS). (2) Purview Audit coverage for GitHub Copilot CLI, Claude Code, OpenAI Codex, OpenClaw. (3) Defender security for local agents (public preview) — discovery now spans Windows and macOS, supports 35+ known agent types, adds exposure risk for local agents, and on-device runtime protection (Claude Code, GitHub Copilot CLI/app, Codex CLI, OpenClaw + Node-based claws) with prompt-injection audit/block, XDR alerts, and Purview real-time prompt/tool-call blocking. (4) MXC for local agents (public preview) — require local agents to run in a hardened Windows container. (5) Agent 365 skills — natural-language onboarding inside the coding environment. (6) Expanded Microsoft Graph API — package-management APIs (List packages, Get package details) moved beta → v1.0, with Global Reader / AI Reader roles and app-only permissions. (7) Entra ID Governance for ecosystem partner agents — entitlement management extends to SDK-integrated partner agents (access packages, lifecycle workflows, least-privilege). Existing Defender-discovery, runtime-protection, and MXC sections on agent365.html / product-map.html had their statuses refreshed to public preview with the new specifics; a matching June 2026 update block was added to both technical and business chat.js SYSTEM_PROMPTs. |
agent365.html, product-map.html, functions/api/chat.js, changelog.html |
| ⚠️ Correction | Registry-sync platform list re-sourced. An earlier draft of this update attributed the four-platform external-cloud registry sync (Amazon Bedrock, Google Vertex AI, Salesforce Agentforce, Databricks Genie) to the June 2026 blog. That blog does not cover external-cloud registry sync — its "registry" item is about local agents. The four supported external platforms are documented on Microsoft Learn and remain useful (the site previously listed only two), so the #registry-sync callout on agent365.html was kept but re-sourced to Learn and no longer dated to the June blog, and the GA-day table row restored to its GA-accurate wording. The chat.js registry-sync sections were corrected to match and now explicitly distinguish external-cloud registry sync from the June local-agent registry addition. |
agent365.html, functions/api/chat.js, changelog.html |
| 🆕 New | Agent 365 Skills deep-dive expanded from a one-line summary to a full section. Source: "Agent 365 Skills: Bring your agents into Microsoft Agent 365 in minutes" (aarthisk · Jun 22, 2026). Added a Deep Dive subsection on agent365.html (#agent365-skills) covering: the five-beat loop (describe → detect → ask → apply → validate); the six skills — a365-setup, make-a365-agent, instrument-observability, add-workiq-tools, make-ai-teammate, test-local; the coding assistants they run in (Claude Code, GitHub Copilot CLI, VS Code agent mode); supported .NET / Node.js / Python stacks; and the three instrument-observability auth modes (OBO, Agentic-User, S2S). Added a security-architect guard-rail callout — skills are additive/idempotent, state-aware via a workspace cache, and guard-railed by pre-tool hooks that block edits outside the project plus stop-hook build validators — with the supply-chain note that skills install from GitHub (gh skill add microsoft/agent365-skills) and should be versioned like any privileged dev dependency. The product-map.html card and both chat.js SYSTEM_PROMPT skill entries were expanded to match. |
agent365.html, product-map.html, functions/api/chat.js, changelog.html |
| Type | Change | Page(s) Affected |
|---|---|---|
| 🆕 AI IR playbook | Added coverage of Microsoft's new AI Incident Response investigator playbook. Source: Microsoft Security blog, June 9, 2026 ("Reconstructing AI activity in investigations"), by Phillip Misner (Head of AI Incident Detection & Response) and the Microsoft AI Red Team. What it is: a structured investigator playbook for Microsoft 365 Copilot and Azure AI services that turns telemetry already available across Purview, Defender, and Sentinel into a coherent investigation. Methodology: a Scope → Context → Signal sequence — (1) scope: who interacted with AI systems, when, and which services; (2) context: what the system accessed, what data may have been exposed, and how that aligns with expected behavior; (3) signal: detection signals such as prompt injection attempts, anomalous usage patterns, and credential-exposure alerts evaluated within that broader chain. AI telemetry is treated as metadata-first (identity, time, resource context), moving investigations from isolated signals to an account of what happened — normal usage, policy violation, or indicator of compromise. Bundles schema references, KQL queries, and detection logic into one working model and extends to agent-based systems (which agents are deployed, how configured, what data they are authorized to access, and whether that authorization was used as expected). Download: aka.ms/AIIRplaybook. Added: new card under the Detect & Respond / Security Copilot & Autonomous Agents section of product-map.html; chat.js SYSTEM_PROMPT section (technical) plus a plain-language note for business mode. | product-map.html, chat.js, changelog.html |
| Type | Change | Page(s) Affected |
|---|---|---|
| 🆕 MDASH deep-dive | Substantial coverage added for Microsoft's autonomous vulnerability discovery system (codename MDASH). Source: Microsoft Security blog, May 12, 2026, by Taesoo Kim (VP Agentic Security, Microsoft). Previously misclassified on the site as part of an "open trust stack" alongside ASSERT and ACS — corrected to its actual category (autonomous vulnerability discovery pipeline, not an open standard). Key facts now on the site: built by Microsoft's Autonomous Code Security (ACS) team, several members from Team Atlanta (DARPA AIxCC winners). Orchestrates 100+ specialised AI agents across an ensemble of frontier + distilled models through Prepare → Scan → Validate → Dedupe → Prove pipeline. Benchmark results: 21/21 planted vulns on private test driver with 0 false positives; 96% recall on 5-year clfs.sys MSRC backlog; 100% recall on tcpip.sys; 88.45% on CyberGym (1,507 real-world vulns) — top score on the leaderboard, ~5 points ahead of next entry (Anthropic at 83.1%). Discovered 16 new CVEs in May 12, 2026 Patch Tuesday, including 4 Critical RCEs (CVE-2026-33824 IKEv2 LocalSystem RCE, CVE-2026-33827 tcpip.sys remote UAF). Currently in limited private preview. Substantive new sections added: threats.html (~200-line section on AI-powered vulnerability discovery + CVE table + benchmark table + strategic implication callouts); product-map.html (new card under AI-Powered SecOps with PRIVATE PREVIEW MAY 2026 badge); chat.js (full technical SYSTEM_PROMPT section + business-language framing for leadership). Strategic framing surfaced: "The harness around the model is most of the engineering" — vendor evaluation criterion shifts from "which model" to "what survives the next model." | threats.html, product-map.html, frameworks.html (correction), chat.js, changelog.html |
| 🔔 Date awareness | Chatbot now proactively surfaces relevant dates and deadlines. After testing revealed the chatbot would give a "yes/no" answer to "do I need Agent 365" without flagging the July 1, 2026 transition, two changes were made: (1) Added a "KEY DATES & DEADLINES" registry near the top of both technical and business SYSTEM_PROMPTs — covers upcoming dates (June 2026 Build wave, July 1 Agent 365 mandate + AIAgentsInfo retirement + RT protection block-mode change + third-party connector retirement + MXC Preview, August 2026 EU AI Act, Colorado AI Act, etc.) and recent dates for context. Includes explicit instructions on when to surface dates proactively (licensing questions → July 1; KQL questions → AIAgentsInfo retirement; compliance questions → AI Act dates; etc.) and how to phrase them (explicit date, what happens, days remaining when relevant). (2) Added a "FREQUENTLY ASKED LICENSING QUESTION" section earlier in the technical SYSTEM_PROMPT giving Q&A pattern for "do I need Agent 365?" that the chatbot is instructed to answer with explicit time-bound context (today vs. after July 1, 2026), what's lost without Agent 365 after July 1, and pricing reminders. Same pattern added to the business prompt's KEY BUSINESS MESSAGES. (3) Chat widget chips updated — added "⏰ July 1, 2026 cutover" to both technical and business modes (replacing the technical "Microsoft's MCP servers" chip); business mode "Compliance deadlines" chip broadened to "Key dates ahead" covering both regulatory and tech cutover dates. | chat.js, all 15 HTML files (chip refresh) |
| 🆕 Defender deep-dive | Defender local AI agent discovery + runtime protection — full detail added from the authoritative Microsoft Learn docs and the Microsoft Threat Protection blog. Earlier in this session the site had general coverage of "Defender local agent discovery"; this round adds the specifics. Sources: local agent discovery overview, runtime protection overview, and the Microsoft Threat Protection blog post. Additions: (1) Full 5-category taxonomy of supported agents — CLI agents (Claude Code, Codex CLI, Gemini CLI, GitHub Copilot CLI, OpenCode, Antigravity CLI), Desktop apps (ChatGPT, Claude, Codex, Ollama, Poe), Agentic IDEs (Cursor, Antigravity, Windsurf), VS Code extensions (Claude Code, Cline, Codex, Gemini Code Assist, GitHub Copilot, Roo Code), Claw-based agents (OpenClaw, Clawpilot, Claw/Nanobot) — 20+ specific products. (2) Agent definition clarified: combination of user + device + agent type (one entry per triple, not per project folder). (3) Runtime protection mechanics: 3 hook points (user prompt, pre-tool call, post-tool response); 3 modes (Block/Audit/Disabled with Audit as recommended starting mode); Tamper Protection; alert name "Suspicious AI prompt injection"; currently supports Claude Code + GitHub Copilot CLI via their published hooks frameworks. (4) Three views in the Defender portal: inventory, exposure map (visual relationships between agents/devices/identities/resources), Advanced Hunting. (5) Microsoft's canonical example documented — coding agent fetches doc → hidden inject instructs read of .env + POST to external URL → Defender blocks at post-tool response. (6) Platform clarification: Learn doc is explicit on Windows-only today (blog mentions macOS, likely planned but not in the Learn-authoritative state). product-map.html now has two Defender cards (Discovery + Runtime Protection) instead of one; mcp.html has a new "Endpoint inventory & runtime protection" section since most discovered agents are MCP clients; agent365.html Native Windows table updated with the discovery + runtime protection rows in full detail; chat.js SYSTEM_PROMPT expanded with the full agent list + hooks framework references + canonical example. |
product-map.html, mcp.html, agent365.html, chat.js, content_monitor.py |
| 🆕 Build 2026 wave | Comprehensive Build 2026 integration — ten new concepts added. Microsoft Build 2026 (June 2, 2026) introduced a substantial body of capabilities for local agents, runtime containment, and the open AI trust stack. (1) Claws + ClawHub — claws are skills loaded into OpenClaw via the public ClawHub registry; installing a claw is functionally installing privileged code. Section on mcp.html covers the security model and supply-chain attack callout. (2) OpenClaw deeper coverage — self-hosted agent runtime, open-source, runs on Windows via MXC. (3) Microsoft Execution Containers (MXC) SDK (Early Preview) — policy-driven execution layer with composable isolation. New product-map card; mcp.html section. (4) Agent 365 + MXC native integration (Preview July 2026) — Defender/Entra/Intune/Purview converge at the runtime boundary. New agent365.html section. (5) Defender local agent discovery (Preview June 2026) — Defender discovers/profiles supported local AI agents on endpoints. New product-map card. (6) Defender AI model scanning (Preview) — inspect models in registries, workspaces, CI/CD. New product-map card. (7) Defender advanced hunting + exposure graph for agents (Preview coming soon). (8) Native Windows + Intune integration — Intune policies gate agent runtime execution. (9) Foundry Agent Service hosted agents (Preview) — instant-on per-agent sandboxes; cloud equivalent of MXC. New product-map card + foundry.html callout. (10) ASSERT + Agent Control Specification + Codename MDASH — open-source AI trust stack. New frameworks.html section. | product-map.html, mcp.html, threats.html, frameworks.html, foundry.html, agent365.html, playbooks.html, chat.js, content_monitor.py |
| ⚠ Real-world threat findings | Two Build-2026-era findings documented in threats.html. (1) Claude Code GitHub Action prompt injection — Microsoft Threat Intelligence identified a pathway allowing access to workflow secrets under specific conditions (Feb 2026 research). Attack pattern: untrusted content (issue body, PR description) becomes prompt input; injection redirects agent to dump secrets.* or call attacker endpoints. Defences documented. (2) Malicious skills on ClawHub — attackers publishing malicious skills disguised as utilities, promoted through community channels. Treat installation as third-party dependency review. Defences: approved-claws list, verified publishers, run OpenClaw inside MXC, enable Purview local-agent observability. |
threats.html, mcp.html |
| 📚 Playbook 07 Rule 6 expanded | Maker rule on local AI agents extended to cover claws and ClawHub. Rule 6 now includes the OpenClaw skill-installation security model — installing a claw is functionally installing privileged code on a developer laptop. Recommendations added: check for approved-claws list, prefer verified publishers, run OpenClaw inside MXC on Windows, treat new claws as third-party dependency review items (same gate as npm or PyPI). | playbooks.html (Playbook 07 Rule 6), chat.js |
| 🆕 Purview AI wave | Five new Purview AI announcements added (June 2026 wave). Microsoft announced five capabilities targeting where AI work actually happens — developer endpoints, Foundry workloads, GitHub Copilot, custom apps. (1) Purview for Local & Endpoint Agents (Preview) — extends Purview to GitHub Copilot CLI, Claude Code, OpenAI Codex, OpenClaw. DSPM visibility, real-time DLP, Insider Risk signals, full interaction logs. Closes the "developer endpoint" governance gap. (2) DLP Runtime Controls for Microsoft Foundry (Preview) — inline DLP integrated into prompt handling. SITs detected during execution; can block requests pre-processing. (3) Purview Insights in Foundry Control Plane (GA) — security telemetry surfaces in the developer workflow without leaving Foundry. Three signals: detected sensitive data, share of sensitive interactions, high-risk users. GA on launch. (4) Purview ↔ GitHub Copilot Integration (Preview) — Copilot audit data streams into Purview. Repos, PRs, sessions in one audit/eDiscovery scope. (5) Microsoft Purview SDK for .NET (Preview) — drop-in toolkit so custom AI apps appear in the same Purview governance views as Microsoft-native workloads. Closes the "if you build it yourself, you lose visibility" gap. New product cards added to product-map.html (5 cards with NEW JUNE 2026 / GA JUNE 2026 badges). Foundry-specific callout added to foundry.html. Local-agent callout added to mcp.html (since Claude Code, GitHub Copilot CLI etc. are MCP clients). Comprehensive section added to chat.js SYSTEM_PROMPT. Playbook 07 (Brief Your Makers) expanded from five maker rules to six — added Rule 6 covering local AI agents (GitHub Copilot CLI, Claude Code, OpenAI Codex, OpenClaw) now being in Purview scope. Header updated to "33-Minute Security Awareness" (was 30 min), audience expanded to include laptop AI agent users, escalation list in Part C extended with a local-agent help row. | product-map.html, foundry.html, mcp.html, playbooks.html, chat.js, content_monitor.py |
| ⚠ Schema migration | AIAgentsInfo → AgentsInfo migration applied site-wide. Per the Microsoft Learn schema changes notice (June 2026): the AIAgentsInfo table is being replaced by the unified AgentsInfo table. Microsoft Agent 365 customers should use the new table today; the old table remains accessible until July 1, 2026. The new schema unifies agent inventory across Copilot Studio, Microsoft Foundry, Microsoft 365 Copilot, third-party agents, and endpoint-discovered agents. All KQL queries on the site (115 references across 13 files) migrated. Key column changes: AIAgentId → AgentId; AIAgentName → AgentName; AgentStatus="Published" → PublishedStatus="Published"; AgentStatus="Deleted" → LifecycleStatus="Deleted" (split into separate columns with values Active/Blocked/Uninstalled/Deleted); UserAuthenticationType (string) → ToolsAuthenticationType (dynamic) — site uses tostring(ToolsAuthenticationType) contains "None" as a robust pattern; OwnerAccountUpns (string) → Owners (dynamic array) — site uses array_length(Owners) == 0; AgentCreationTime → CreatedDateTime; AgentToolsDetails → DeclaredTools; AgentTopicsDetails → Capabilities (best approximation); AgentChannel → Channels; AgentActionTriggers → Triggers; RegistrySource → Platform (semantic shift — all AgentsInfo rows are A365-registered); IsBlocked → LifecycleStatus == "Blocked"; AIModel → Model; EntraObjectId → EntraAgentId; AgentUsers → SharedWith; KnowledgeDetails → DeclaredDataSources. Prominent migration banner added to playbooks.html with full column mapping table (15+ rows); compact migration callouts on agent365.html, identity.html, gaps.html. AgentsInfo is currently labelled Preview — queries against dynamic columns may need JSON field path adjustment against tenant data. |
13 files — agent365.html, chat.js, copilot-vs-foundry.html, foundry.html, frameworks.html, gaps.html, identity.html, playbooks.html, product-map.html, risk.html, strategy.html, threats.html, content_monitor.py |
| 🆕 Microsoft sample queries | Added four more Microsoft-published sample queries to Playbook 01 Step 8 (8e–8h). Per the Microsoft Learn AIAgentsInfo sample queries page, four additional queries weren't on the site. All migrated to AgentsInfo: 8e — HTTP requests to nonstandard ports (potential C2 or covert channel, anything other than 443/80 warrants investigation); 8f — HTTP requests to graph.microsoft.com / management.azure.com (highest-risk auth pattern indicator — App Registration with tenant-wide application permissions); 8g — Generative orchestration + email send with AI-controlled inputs (XPIA exfiltration risk — if a successful XPIA happens, the agent could exfiltrate data to attacker-controlled recipients); 8h — Hard-coded credentials in Topics/Tools (regex matching covers AWS, GCP, Slack, GitHub, Stripe, SendGrid, Telegram, JWTs, Basic Auth credentials). All four queries are Power-Platform-era JSON shape — caveat noted that these may need JSON path adjustment as the unified schema matures. |
playbooks.html |
| ⚠ July 1, 2026 — two more cutover events | Same Microsoft transition adds licence gate and real-time protection table change. Per the transition guide: (1) AI agent security capabilities for Copilot Studio and Foundry agents will require a Microsoft Agent 365 license effective July 1, 2026 — these capabilities are no longer covered by existing Defender for Cloud Apps or Defender for Cloud licenses. (2) Existing Agent 365 real-time protection rules in Block mode stop blocking on July 1, 2026; alerts move to the new BehaviorInfo table in Advanced Hunting; block rules must be redefined under Settings → Security for AI → Policies. (3) Third-party cloud agents are no longer discoverable through Defender for Cloud connectors — use Agent 365 registry sync instead. All three documented in the migration banner on playbooks.html and in chat.js SYSTEM_PROMPT. |
playbooks.html, chat.js |
| 🔧 Method | Used the Microsoft Learn MCP server to systematically compare site coverage against current Microsoft documentation. Searches across the AI security stack, Foundry Control Plane, Purview DSPM for AI, Sentinel data connectors, Entra Agent ID / Agent Registry / ID Protection, MCP integration, and Zero Trust. Source: Microsoft Learn "What's new in Microsoft AI security" (November 2025 wave) — learn.microsoft.com/security/security-for-ai/whats-new. | All content pages |
| ⚠ Correctness reverted | Earlier "Security Dashboard for AI GA → Preview" change was incorrect. I reported correcting this status here but on verification against the authoritative Microsoft Learn page the dashboard has no Preview indicator — it is GA. See the self-correction entry below for the full revert. The original site claim ("Now GA") was correct all along. | index.html |
| 🆕 New | "Latest from Microsoft Learn (Nov 2025 wave)" callout on Overview. Summarises the November 2025 Microsoft AI security wave: Entra Agent Platform, Entra Agent Registry, AI Prompt Shield (network-layer), specialized roles for Agent ID management, Copilot Studio AI agent protection in Defender, and the Microsoft Foundry naming change (formerly Azure AI Foundry). | overview.html |
| 🆕 New | "Agents at risk" card — Microsoft's formal risk taxonomy. Added the four agent risk types Microsoft surfaces natively in the M365 admin center: Shadow agent (Critical), No owner assigned (Critical), Excessive permissions (Critical), Security misconfiguration (High). Each with source signal mapping (Entra / Purview / Defender). | risk.html |
| ⚠ Critical detail | OBO flow risk attribution caveat. Critical technical detail from Microsoft Learn: in On-Behalf-Of flows, risky activity is attributed to the user, not the agent. The agent risk detection table applies only to autonomous agent activity. A delegated-auth agent appearing misbehaved may not appear in the Risky Agents report at all — investigators should check user risk instead. Documented on both risk.html and identity.html. | risk.html, identity.html |
| 🆕 New | ID Protection for Agents — five offline risk detections documented. Detailed coverage of the five detections Microsoft lists in ID Protection for agents (Preview): unfamiliarResourceAccess, signInSpike, failedAccessAttempt, adminConfirmedAgentCompromised, threatIntelligenceAccount. Includes 4 response actions, 90-day retention, Microsoft Graph collections (riskyAgents, agentRiskDetections), and required roles (Security Admin/Operator/Reader for reports, Conditional Access Administrator for risk policies). |
identity.html, chat.js |
| 🆕 New | Custom Security Attributes for agent segmentation. New section on identity.html covering Microsoft's recommended pattern for scaling CA policy across agent estates — define attributes (Environment, Department, DataSensitivity), assign to agents, use as CA policy conditions. Plus the critical caveat: agents cannot satisfy interactive MFA controls — don't rely on user-targeted CA policies for agents. | identity.html |
| 🆕 New | Agent Registry Administrator role + AI security licensing matrix. New Entra built-in role for AI agent management (separate from broader AI Administrator). Plus a clear licensing breakdown: Agent ID (free with Entra), CA for Agents (Entra ID P1), ID Protection for Agents (Entra ID P2), ID Governance (Entra ID P1), Network controls (Entra Internet Access), Agent 365 (per-user, not per-agent). Includes Purview role groups: Data Security Management, Data Security Viewers, Data Security IRM Triage Agent (the new "role assigned to an agent identity" pattern). | identity.html |
| 🆕 New | Microsoft's MCP server landscape. Comprehensive table of first-party MCP servers Microsoft now ships or previews: Sentinel MCP server (hosted, Entra-auth), Microsoft Learn MCP server (authless), Foundry MCP integration (server_label + server_url), Windows On-device Agent Registry (ODR) with contained-by-default execution, Copilot Studio MCP onboarding wizard, Microsoft Agent Framework MCP tools. Plus Microsoft's stated position on third-party MCP servers and authoritative security guidance links. |
mcp.html |
| 🆕 New | External threat detection for Copilot Studio agents. Pluggable runtime control via REST API endpoint that agents call before tool invocation. Public Preview Sep 4, 2025 · GA expected June 2026. Generative agents only. Use cases include corporate-specific data classification, sector-specific guardrails, third-party threat intel integration. Critical caveat: endpoint becomes hard dependency for every tool call — treat as tier-1 service for production. | threats.html |
| 🆕 New | Microsoft's nine harm categories (from Copilot Studio Application Card). The official categories Microsoft tests against in internal safety evaluations: hate and unfairness, sexual, violence, self-harm, protected material, indirect jailbreak (XPIA), direct jailbreak (UPIA), code vulnerability, ungrounded attributes. Distinguished from Foundry's nine continuous-evaluation risk dimensions — both apply, complete acceptance tests cover both. | threats.html |
| ✓ Resolved | Zero Trust Assessment AI pillar — now available. Site previously flagged this as "summer 2026" — Microsoft has shipped it. Updated the Frameworks page, Zero Trust page, and Gaps register. Microsoft identifies three common agent issues the assessment helps surface: authentication and policy mismatch, overpermissioned access, lifecycle and accountability gaps. See Configure agent identity security with the Zero Trust Assessment. | frameworks.html, zero-trust.html, gaps.html |
| 🆕 New | Foundry Control Plane — formal "Operate" toolbar 5-pane structure. Microsoft has standardised the Foundry Control Plane interface around five panes accessible from Operate: Overview (fleet health), Assets (unified inventory), Compliance (policies + Azure Policy/Defender/Purview integration), Quota, Monitoring (App Insights). Plus the Microsoft Foundry naming note (formerly Azure AI Foundry — same product). | foundry.html |
| 🆕 New product card | Three new identity product cards on the product map: Microsoft Entra Agent Platform (developer-first identity SDK/API), Microsoft Entra Agent Registry (complete agent inventory including third-party), AI Prompt Shield (network-layer prompt injection blocking via Entra Internet Access). All Preview, all from the November 2025 wave. | product-map.html |
| 🆕 New playbook section | Agent 365 Sentinel Data Connector documented. Microsoft-supported connector that ingests agent telemetry from Agent 365 + Microsoft Foundry + Copilot into the Sentinel data lake — single connector, three sources. Enables hunting (KQL + natural language via Sentinel MCP), graph workflows (agent-to-agent and agent-to-tool relationships), and MCP investigation workflows. Deactivation cascade caveat documented. | playbooks.html, agent365.html |
| 🆕 New | Agent 365 + Purview integration section. Per Microsoft's dedicated Purview documentation for Microsoft Agent 365: audit an agent instance as you would a user; all agent-to-human, human-to-agent, agent-to-tools, and agent-to-agent interactions captured in unified audit log; Activity Explorer in DSPM shows agent activity under AI activities tab. | agent365.html |
| 🔧 Chat assistant | chat.js SYSTEM_PROMPT extensively updated. Added: November 2025 wave (Agent Platform, Agent Registry, AI Prompt Shield, Foundry naming); M365 admin center "Agents at risk" card with four risk types; Entra built-in roles for AI agent management (with new Agent Registry Administrator); Purview role groups for AI (including the new IRM Triage Agent role assignable to agent identities); ZT Assessment AI pillar now available; external threat detection for Copilot Studio; Agent 365 Sentinel data connector; Microsoft-provided MCP servers landscape; nine harm categories; Foundry Control Plane Operate pane structure; OBO flow risk attribution; custom security attributes for CA at scale. | chat.js |
| 🔧 Updated | content_monitor.py updated with comprehensive June 5 covered-topics list. November 2025 wave additions, role groups, Foundry naming, MCP servers landscape, harm categories, ID Protection detection list — all added so the monitor doesn't flag these as new on next sweep. | content_monitor.py |
| 🔧 Refreshed | Chat widget chips refreshed to surface Microsoft Learn additions. Technical mode added: "Latest from Microsoft" (Nov 2025 wave summary), "ID Protection detections" (the five offline risk detections), "Microsoft's MCP servers" (Sentinel MCP, Windows ODR, Foundry integration). Technical dropped: No-auth KQL (covered by KPI chip), Vet a third-party agent (specialised), Key gaps (too generic). Business mode added: "Latest from Microsoft" (leadership-language Nov 2025 summary). Business dropped: Risk tier explained (overlaps with six-phase). Applied identically across all 15 pages with the chat widget. Verified single MD5 hash across files. | All pages with the chat widget (15 files) |
| 🔧 Fixed | Home page tagline updated — removed stale "8 sections" reference (legacy from the original eight-pillar framing). New tagline highlights breadth without locking in a number: "This guide covers Microsoft's AI security stack end-to-end — identity, runtime, data, monitoring, governance, and compliance." Echoes the six-phase rollout framework now used in the strategy page. | index.html |
| ⚠ Self-correction | Security Dashboard for AI is GA, not Preview — earlier "correction" reverted. Earlier in this session I "corrected" Security Dashboard for AI status from GA to Preview across the site, claiming Microsoft Learn labelled it Preview. On reviewing the authoritative Microsoft Learn article at learn.microsoft.com/security/security-for-ai/security-dashboard-for-ai, there is no Preview indicator anywhere on the page — no preview badge, no prerelease disclaimer, no "feature is in preview" notice. The document describes the dashboard as a live product. The site's original "Now GA" claim was correct. All Security Dashboard for AI status references reverted back to GA across overview.html, frameworks.html, gaps.html, mcp.html, playbooks.html, product-map.html, chat.js, and index.html. | overview.html, frameworks.html, gaps.html, mcp.html, playbooks.html, product-map.html, chat.js, index.html |
This batch came from a structured Microsoft Learn comparison using the Microsoft Learn MCP server. Searches covered each major content page's primary topics; findings were filtered for genuine novelty (not just rephrasing of known material). The site is now aligned with Microsoft's November 2025 wave of AI security announcements. The Microsoft Learn MCP server is recommended as a periodic-sweep tool going forward — natural-language access to current Microsoft documentation without manually crawling the Learn portal.
| Type | Change | Page(s) Affected |
|---|---|---|
| 🔧 Restructured | Strategy page restructured — six-phase rollout replaces eight-pillar framework. The eight-pillar version described what the stack is; the new six-phase framework describes how to roll it out: Discover & Inventory → Identity & Governance → Data Security → Runtime Protection → Monitoring & Detection → Compliance & Governance. Each phase has prerequisites and produces evidence the next phase consumes. Per-pillar deep-dive content lives on its dedicated topic page (playbooks, identity, frameworks, etc.) so the strategy page can stay a strategy page. | strategy.html |
| 🆕 New | AI Readiness Assessment — pre-Phase-1 framing. Attack surface inventory, legacy estate scale, governance maturity gap, commercial path. Now appears before the six-phase rollout as the question to answer first. | strategy.html |
| 🆕 New | Four AI security KPIs to track weekly — Risky agents (target zero), Sensitive access events (stable), DLP policy hits (stable post-tuning), Blocked tool actions (rising then stable). Short version on Strategy with reporting cadence; full operational KQL on Playbooks. | strategy.html, playbooks.html |
| 🆕 New | Quarterly board-level reporting pack — seven-section structure for executive AI risk reporting, sourced from outputs of the six phases and the four weekly KPIs. | strategy.html |
| 🆕 New | Risk tier classification methodology (H / M / L) — explicit criteria with required action and governance cadence. HIGH = no-auth OR maker credentials OR org-wide sharing OR no owner OR regulated data. Includes the critical "highest match wins, not average" caveat — risk does not average down. | risk.html |
| 🆕 New | AI Trust and Safety assurance — distinct from security testing. Adelard safety case methodology referenced for citizen-facing or safety-critical agents. Distinguishes security testing (adversarial), Trust & Safety assurance (reliability, fairness), and Responsible AI evaluation (harms). | risk.html |
| 🆕 New | Agent Approver — third accountability role added to Identity page. Role model extended from Owner / Sponsor / Orphaned to Owner / Sponsor / Approver / Orphaned. The Approver is the IT gatekeeper for any sharing beyond a team or org-wide — what converts sharing limits from policy to enforced gate. | identity.html |
| 🆕 New | AI Governance Operating Model — five forums with cadence and decision rights. AI Security Working Group (monthly), Agent Lifecycle Board (monthly), Quarterly Governance Sweep, Annual AI Risk Assessment, Agent Red Team Cycle. Fills the human-layer gap between deployed controls and sustained governance. | frameworks.html |
| 🆕 New | AI Baseline in Purview Compliance Manager — promoted as starting compliance action. Pre-built evaluation against EU AI Act, NIST AI RMF, ISO 42001 with mapped remediation. Established as the recommended Phase 6 first task. | frameworks.html |
| ⚠️ Caveat | Compliance Manager score ≠ audit-ready compliance assessment. New callout explicitly distinguishing the automated posture score from a structured assessment with evidence collection, control testing, and written findings — suitable for ICO, EU AI Office, internal audit, or board sign-off. Common misconception explicitly corrected. | frameworks.html |
| 🆕 New Playbook | Playbook 07 — Brief Your Makers (30-minute awareness session). Three parts: five things every maker must know (maker credentials risk, no-auth risk, org-wide sharing, connector scope, Owner/Sponsor); red-flag self-audit checklist before publishing; escalation paths. | playbooks.html |
| 🆕 New Playbook | Playbook 08 — Vet a Third-Party Agent Before Publish. Five-step checklist: publisher & provenance, connector & data scope, authentication & identity model, DPIA & regulatory trigger, approval & ongoing governance. Default for external agents is "not approved" — opt-in to allow, opposite of internally built agents. | playbooks.html |
| 🔧 Fixed | Frameworks page — orphan callout div closed. The "Full control list" callout at the bottom of the ZT Workshop controls section was an unclosed div from a previous edit — now properly closed with content pointing to the dedicated Zero Trust page. | frameworks.html |
| 🔧 Refreshed | Chat widget suggestion chips refreshed across both modes. Technical mode now surfaces the six-phase rollout, risk tier methodology, four KPIs, Owner/Sponsor/Approver model, and third-party vetting playbook. Business mode now surfaces six-phase (simple), four KPIs for the board, quarterly board pack, governance forums, and risk tier explained. Older chips that overlapped or had aged out (How long does it take?, Biggest mistakes, CISO 90-day plan, Foundry logging, Maker creds + Security Copilot, Detect orphaned agents, Entra Agent ID GA?, What if we do nothing?, Classic vs Modern simple) were retired. Applied identically across all 15 pages with the chat widget. | All pages with the chat widget (15 files) |
| 🔧 Updated | Chat assistant system prompt (chat.js) updated to cover all new content. Added technical-mode sections for: six-phase rollout (with phase ordering rationale), AI Readiness Assessment, risk tier methodology with the "highest match, not average" caveat, four AI security KPIs with KQL, quarterly board reporting pack structure, AI Governance Operating Model (5 forums with cadences), AI Baseline vs structured assessment distinction, AI Trust & Safety assurance (Adelard), third-party agent vetting (5 steps), maker awareness brief. Owner / Sponsor / Orphaned model extended to Owner / Sponsor / Approver / Orphaned. Business mode received plain-English versions of six-phase, four KPIs, board pack, governance forums, and risk tier. Site navigation section updated to reflect new playbooks (PB07, PB08) and the zero-trust.html page. | chat.js |
This batch of changes came from a gap analysis of the site against an enterprise AI security implementation plan. Twelve generalisable content gaps were identified; customer-specific content (UK NIN, HMG classification, ICO obligations) was deliberately excluded to keep the site vendor-and-jurisdiction neutral.
| Type | Change | Page(s) Affected |
|---|---|---|
| 🆕 New | Six Copilot analytic rules for Sentinel contributed to Azure/Azure-Sentinel GitHub by Samik Roy (May 2026): Jailbreak Attempt Detected · Access From External IP · Plugin Created by Non-Admin User · Plugin Enabled After Being Disabled · Plugin Tampering (Enable/Disable within 5 minutes) · File Uploads Disabled. Deploy via Content Hub → Microsoft Copilot solution. | playbooks.html, product-map.html |
| 🆕 New | Microsoft Copilot Activity Monitoring workbook — 7 sections: All Events, Activity Overview, User Activity Analysis, Plugin Management, AI Model Usage, Security Insights (jailbreak + IP), Detailed Activity Log. Single pane of glass for CopilotActivity telemetry. Deployable from Sentinel Content Hub as part of Microsoft Copilot solution. | playbooks.html |
Samik Roy — Azure/Azure-Sentinel GitHub — Microsoft Copilot solution · LinkedIn article May 4, 2026
| Type | Change | Page(s) Affected |
|---|---|---|
| 🆕 Updated | Work IQ three-layer architecture — Data (M365 signals), Memory (persistent cross-session understanding of how people/teams work), Inference (reasoning + action via Work IQ MCP tools, governed by Agent 365 control plane). M365 Copilot licence required for Work IQ MCP servers. Source: Microsoft Learn Work IQ MCP overview (Preview). | agent365.html |
| 🆕 Updated | MCP server names updated to Work IQ branding — Copilot Search → Work IQ Copilot · Outlook/Teams → Work IQ Calendar / Work IQ Teams · SharePoint → Work IQ SharePoint Lists / Work IQ SharePoint and OneDrive (Frontier). Old names remain supported for existing connections. Source: Microsoft Learn Work IQ MCP overview (Preview). | foundry.html |
| Type | Change | Page(s) Affected |
|---|---|---|
| 🆕 Updated | A365 - Monitor OpenClaw policy details — the "Continuously detect managed devices" toggle creates a specific Intune Device Configuration policy: A365 - Monitor OpenClaw. Properties catalog profile (read-only, safe to deploy). Uses new Local AI Agent Settings Catalog node. Runs via Intune Management Extension (IME), inspects disk and memory on managed Windows devices. 24-hour refresh cadence. |
agent365.html |
| 🆕 New | Eight properties collected per device — Agent Name, Agent Version, Host Process, Install Location, Install Scope, Install Scope Platform User ID (Windows SID), Install Scope User ID (Entra UPN), Local AI Agent Execution Context (user/elevated/SYSTEM). The Execution Context property is a key risk signal — SYSTEM-level agent execution indicates significantly elevated risk. | agent365.html, playbooks.html |
Derk van der Woude (Rubicon Cloud Advisor / #BBTG) — LinkedIn post, May 5, 2026
| Type | Change | Page(s) Affected |
|---|---|---|
| 🆕 Updated | Shadow AI page — two specific Intune policies named: "Continuously detect managed devices" (multi-signal: identity, device, network) and "Block AI Agents from OpenClaw" (Intune baseline policy: A365 - Block OpenClaw). |
agent365.html |
| 🆕 New | Coming Shadow AI detections expanded — beyond Claude Code CLI: Ollama Desktop, OpenAI, Cursor, Poe Desktop. Source: Derk van der Woude (Rubicon Cloud Advisor). | agent365.html |
| ⚠️ Caveat | Critical operational caveat — Block policy cannot be disabled via Agent 365 portal. Once enabled, rollback requires deleting the Intune security policy (A365 - Block OpenClaw) directly in Intune. The Agent 365 portal does not expose a disable control. Source: Derk van der Woude, May 2026. |
agent365.html, gaps.html |
Derk van der Woude (Rubicon Cloud Advisor / #BBTG) — LinkedIn post, May 3, 2026
| Type | Change | Page(s) Affected |
|---|---|---|
| 🆕 Updated | Windows 365 for Agents expanded — Windows 365 for Agents callout replaced with full section. Additions: why agents need a managed execution environment (many enterprise apps have no APIs, UI interaction required), the employee analogy (same trust model extended to AI), three explicit benefits, four-layer Microsoft AI stack (Microsoft IQ / Windows 365 for Agents / Azure / Agent 365), prerequisites (Agent 365 + Intune + Azure subscription for compute billing), setup path, who it is for (legacy/UI apps, human-in-the-loop). Source: Windows IT Pro Blog May 1, 2026. | agent365.html, product-map.html |
| Type | Change | Page(s) Affected |
|---|---|---|
| 🆕 New | Three agent operating modes — Delegated access (GA), Own access/autonomous (GA), Agents in team workflows (Public Preview). Full table with how-it-works and examples. Source: Agent 365 GA blog (May 1, 2026). | agent365.html |
| 🆕 New | Windows 365 for Agents (Public Preview · US only) — new class of Cloud PCs purpose-built for agentic workloads. Managed via Intune. Observable in Agent 365. Infrastructure execution layer complementing Agent 365 governance layer. | agent365.html, product-map.html |
| 🆕 New | Local agent discovery — OpenClaw, GitHub Copilot CLI, Claude Code — new Shadow AI page in Agent 365/M365 admin center. Discover local agents on managed devices, block via Intune. Defender context mapping for local agents June 2026. Gap added: local agents operating outside governance. | agent365.html, gaps.html |
| 🔧 Corrected | Network controls now GA — Secure Web and AI Gateway for Agents is GA as of May 1, 2026 (not Preview). Extends to Copilot Studio agents AND local agents (OpenClaw) running on user endpoint devices. | agent365.html, product-map.html |
| 🆕 New | Partner services taxonomy — five service categories (Inventory/Ownership, Least Privilege, Compliance, Threats, Ongoing Operations) and five service types (Workshops, Governance, Managed Services, Advisory, Security+Integration). Featured launch partners: Accenture, Bechtle, Capgemini, Insight, KPMG, Protiviti, Slalom. | strategy.html |
| Type | Change | Page(s) Affected |
|---|---|---|
| 🆕 New | Agent 365 registry sync with AWS Bedrock + Google Cloud (Preview) — automatically discover and inventory agents on AWS Bedrock and Google Gemini Enterprise Agent Platform. Basic lifecycle governance (start/stop/delete) coming soon. Announced GA day, May 1 2026. | agent365.html |
| 🆕 New | Defender agent context mapping (Preview, June 2026) — relationship map per agent: devices running it, MCP servers configured, associated identities, cloud resources reachable. Blast radius context for security teams. File access and network behaviour investigation. Policy-based controls + runtime blocking via Intune also coming June 2026. | agent365.html |
| 🆕 Updated | Agent 365 pricing clarification — no additional per-agent charge for first 10,000 managed agents per tenant. Graduated consumption ~$0.15/agent/month thereafter (volume discounts via EA). GCC/GCC High late 2026. DoD early 2027. macOS/Linux: dedicated clients committed by end of 2026. | agent365.html |
Microsoft Security Blog — Agent 365 GA (May 1, 2026) · Nirav Shah, Rob Lefferts, Jason Roszak
| Type | Change | Page(s) Affected |
|---|---|---|
| 🆕 New page | Foundry Control Plane (foundry.html) — new page covering: four control plane capabilities, agent lifecycle, three evaluation categories (Quality/Risk+Safety/Agent-specific with all evaluator names), AI Red Teaming Agent (managed vs PyRIT standalone), Content Safety guardrail categories, Purview Data Security Investigations three-stage workflow, AI Baseline in Compliance Manager, Agent 365 MCP tool catalog, Shadow AI discovery 4-step setup, Foundry Projects model. Source: Agent 365 Training Days 2&3. | foundry.html (new) |
| 🔧 Nav | Nav restructure — CS vs Foundry merged into Agent 365. Changelog moved to footer link. Foundry added as new nav item. 14 nav items total. | All pages |
| 🔧 Demo | Demo renamed demo.html — Foundry Control Plane page added with evaluation tables, Content Safety categories, Red Teaming Agent, MCP catalog. AI Baseline modal added to Purview recommendations panel. | demo.html |
Microsoft Partner Project Ready — Implement Agent 365 Training (Day 1, 2, 3) · May 2026
Entries before May 2026 have been removed to keep this page fast — the full history lives in the GitHub commit history. The removed period covered the site's build-out (January–April 2026): RSAC 2026 coverage, the initial Agent 365 GA wave, and the first playbook releases.