Build1 publisher2 min readPublished
Defender's new agent detections start at the Microsoft 365 app connector
Microsoft's public preview flags jailbreaks, prompt injection and credential leakage from agent telemetry, and agents built outside Copilot Studio, Foundry and Agent Builder need the Agent 365 SDK first.
The Engineer · Build desk
What happened
- Microsoft has put threat detection for AI agents into public preview in Defender, raising near-real-time alerts and letting security teams trace an agent incident's root cause and blast radius.
- Defender analyses agent telemetry, tool usage and execution patterns for jailbreak attempts, indirect prompt injection, malicious content propagation, secret and credential leakage, evasion, LLM reconnaissance and suspicious user or IP access.
- The stated prerequisite is enabling security for AI agents, including the Microsoft 365 app connector that collects Agent 365 observability data on what agents actually do.
- Local agents running on endpoints are onboarded separately from cloud agents and require AI agent runtime protection with Defender for Endpoint running in active mode.
Compiled by The EngineerSomething wrong?How this is made
Why it matters
- constraint An agent built on a platform Microsoft does not cover by default produces nothing for Defender to read until a platform team ships Agent 365 SDK calls into it, so the security team's coverage depends on another team's backlog.
- decision Because prompt evidence collection ships on, the decision about storing fragments of user prompts in the security portal gets made at rollout, and a team that wants it off has to give up prompt context at triage.
- exposure Two agents can generate the same incident with unequal evidence depending on which builder produced them, so an SOC runbook has to record which agents lack behavior records before an analyst goes looking for them.
- cost Endpoint-resident agents add a second onboarding path and a Defender for Endpoint mode requirement. That work lands on the endpoint team.
Detection here depends on telemetry. The near-real-time alerts rely on Agent 365 observability data, and Advanced Hunting queries that same observability data in Kusto Query Language [10][11]. The connector's coverage therefore limits alerting and hunting alike.
Which agents reach that pipeline depends on how they were built. Agents built with Microsoft Copilot Studio, Microsoft Foundry, and declarative agents built with the Microsoft Copilot Agent Builder send observability data to Microsoft 365 by default [5]. Agents built on other platforms need observability enabled through the Microsoft Agent 365 SDK [6]. For an agent your own team wrote against another framework, the prerequisite is a code change inside the agent, scheduled by whoever owns that repository.
Microsoft's documentation says Defender continuously monitors AI agent activity and detects suspicious and malicious behaviour for all Agent 365-managed agents [3]. The scope word is "managed", and agents outside Agent 365, or inside it and not emitting, produce no detections.
Seven threat categories are named [16]. Microsoft gives the timing only as near-real-time, and publishes no detection rate, false positive rate, or latency value for any of them [17]. Without those figures a SOC lead cannot work out how many analyst hours a week the preview adds.
Investigation runs through the incident graph, with alerts correlated into incidents and real-time protection audit and block events recorded as behaviors in the BehaviorInfo table for correlation with those alerts [12]. Block events from Microsoft Prompt Shields for Foundry and from the Microsoft Copilot Agent Builder are recorded as behaviors too, and the documentation says this is not yet supported for agents built with Copilot Studio [13].
Prompt evidence collection is enabled by default [8]. It attaches the prompt snippets that triggered a detection to the alert as evidence [8]. Enabling the connector therefore starts copying fragments of user input into the security portal.
The feature is in public preview and the Microsoft Defender preview terms apply [1]. Blocking unsafe agent actions during runtime is documented as a separate Defender feature [14].
What to watch
- Whether block events from Copilot Studio agents start landing in BehaviorInfo, closing the per-builder evidence gap.
- Whether Microsoft publishes detection or false positive figures before the feature leaves public preview.
- Whether non-Microsoft agent frameworks adopt Agent 365 SDK observability by default, or leave it opt-in per deployment.