The starting point

Securing AI with Microsoft —
five surfaces, one map, and the licences between you and each control

I spend my working week securing Microsoft AI estates, and the guidance for doing it is scattered across product teams, blogs and licence tiers. This site is the primer I kept wishing I could hand people — deliberately small: the concepts you need to orient, and pointers outward for depth. Read the five surfaces, trace your agents on the map, check what your licences actually gate. Then go build.

500,000+ agentsin Microsoft's own tenant — this is scale, not a pilot (Customer Zero, Aug 2026)

Four screens count agentsand they disagree by design — always say which screen a number came from

Most telemetry is licence-gated— the dashed lines on the map are where every blind spot lives

🗺️

INTERACTIVE

Agent Telemetry Map — where do your agents leave a trace?

Seven creation paths · fourteen telemetry destinations · the licence gate on every table · what each connection delivers

→

The organising idea

Five AI threat surfaces

Everything on this site hangs off one taxonomy. Your AI estate is five asset classes, each with different risks, different owning controls, and different licence gates — and the most common failure I see is securing one class and assuming the others came along for free.

SURFACE 1

AI apps & assistants →

M365 Copilot, declarative agents, SaaS AI, shadow AI. The risk is what people paste in and what comes back out.

SURFACE 2

AI platform & workloads →

Foundry, Azure OpenAI, RAG pipelines, grounding data. Azure-side risk that no M365 licence covers.

SURFACE 3

Agents →

Copilot Studio, Foundry agents, third-party. Sprawl, maker credentials, and the blueprint blast radius.

SURFACE 4

Tools, MCP servers & connectors →

Every MCP server is a supply-chain dependency with tenant access — an asset with an owner, not plumbing.

SURFACE 5

Endpoints running local AI →

Coding CLIs, desktop AI, local model runners — inference outside every prompt-logging and DLP path you have. The class most organisations discover last; the one I check first.

Held positions

Five rules I don't bend

Enabled is not covered.
A discovery list is never a protection list.
Blocking relocates risk; it doesn't remove it. People route around controls — visibility usually beats prohibition.
An unevaluated asset is a visibility gap, not a pass.
Browser AI is a class-1 asset governed by class-5 mechanisms. Look at the endpoint, not only the tenant.

Then: what licences actually gate · where to start, in six phases · the deep-dive archive for everything this primer deliberately leaves out.

Securing AI with Microsoft —five surfaces, one map, and the licences between you and each control