Last reviewed: August 2026
Quick answer
Enterprise AI security and governance with Microsoft is organized around four control planes: identity (Microsoft Entra), data protection and compliance (Microsoft Purview), threat protection and posture (Microsoft Defender), and application and platform governance (Microsoft Foundry and Azure controls). These address the attack surface that AI agents, prompts, and workload identities introduce, layered with inventory, logging, and incident response (Microsoft Learn).
Enterprise AI security is the practice of protecting AI applications, agents, models, and the data they touch using the same identity, data protection, and threat detection disciplines already applied to other enterprise systems, extended for AI-specific risks. Organizations that already run Microsoft 365, Azure, and Power Platform can reuse existing Entra, Purview, and Defender investments rather than building a separate AI security stack. This article maps the risk landscape, defines the four control planes, and provides a readiness checklist.
Product terminology note
Microsoft's AI product names change frequently. As of this review, Azure AI Foundry has been renamed Microsoft Foundry, and the former Azure AI Services/Azure Cognitive Services portfolio is now branded Foundry Tools (Microsoft Foundry migration guide). Agent identity capabilities in Microsoft Entra are branded Microsoft Entra Agent ID, now generally available (Microsoft Entra Agent ID documentation), and agent-wide management is converging under Microsoft Agent 365. Because these names shift, verify current naming and GA-versus-preview status against Microsoft Learn before making procurement or architecture decisions.
How does AI expand the enterprise attack surface?
AI systems introduce risk patterns that traditional application security controls were not designed for. Understanding these patterns is the starting point for a governance program.
New data flows. Retrieval-augmented generation and agent tool calls move data between previously isolated systems — a chatbot might now read from SharePoint, a CRM, and a ticketing system in one session. Microsoft Purview documentation notes that generative AI "amplifies the problem and risk of oversharing or leaking data" because it surfaces content faster than manual review can catch it (Microsoft Purview documentation).
New workload identities and service principals. Every AI agent, connector, and pipeline needs an identity to authenticate and act. A workload identity is a non-human identity — an application, service principal, or managed identity — used by software rather than a person (Microsoft Entra Workload ID). Agent identity is a related but distinct construct purpose-built for AI agents, giving each agent its own identifiable, policy-controlled account instead of a shared service principal (Microsoft Entra Agent ID overview). Without deliberate identity design, organizations accumulate agent sprawl — many agents with overlapping, over-broad permissions and no clear owner.
Tool and API access. Agents that call tools, plug-ins, or Model Context Protocol (MCP) servers can take real actions — sending email, updating records, executing code — not just generate text. Each tool connection is an access path needing its own least-privilege scoping.
Prompt injection. Prompt injection is an attack technique where malicious instructions embedded in content an AI system processes cause it to act against the user's intent. Indirect prompt injection (XPIA) hides instructions in external data — a web page, an email, a document — that an agent trusts and processes automatically (Microsoft Security blog). Microsoft Defender now offers prompt injection protection for inbound email and runtime protection for agent tool calls (Microsoft Security: What's new July 2026).
Data leakage and shadow AI. Users can inadvertently expose sensitive information — account numbers, health data, project code names — by typing it into a prompt, and AI outputs can resurface overshared content to users who technically have access but should not (Microsoft Tech Community). Shadow AI is the use of AI tools, agents, or services that IT and security teams have not inventoried, approved, or governed — including agents built internally but never registered with a central identity system (Microsoft Entra Agent ID blog).
What are the four control planes for AI security on Microsoft?
Microsoft's approach to enterprise AI security is organized around four control planes that map to existing security domains rather than a single, separate "AI security product."
1. Identity and access — Microsoft Entra
Microsoft Entra is Microsoft's identity and access management platform. For AI, it now includes Microsoft Entra Agent ID, which gives every AI agent a distinct, governed identity with its own permissions, lifecycle, and audit trail, whether built in Microsoft Foundry, Microsoft Copilot Studio, or a third-party platform such as AWS Bedrock (Microsoft Entra Agent ID). Conditional Access, identity governance, and Entra ID Protection risk detection all extend to agent identities as well as human users and workload identities (Microsoft Entra RSAC 2026 announcements). This control plane is covered in identity design for AI agents and workload identities.
2. Data protection and compliance — Microsoft Purview
Microsoft Purview provides information protection, data loss prevention (DLP), insider risk management, audit, and eDiscovery, extended to AI through Data Security Posture Management (DSPM) for AI. DSPM for AI centralizes visibility into AI activity — which apps and agents are in use, what sensitive data they touch, and where oversharing risk exists — plus one-click policies to reduce that risk (Microsoft Purview documentation). Sensitivity labels and DLP conditions restrict what an AI system can read or return, and Insider Risk Management includes a risky AI usage policy template (Microsoft Purview AI protections). This control plane is covered in Purview information protection and compliance controls for AI.
3. Threat protection and posture — Microsoft Defender
Microsoft Defender extends security posture management and threat detection to AI infrastructure, models, and agents. Defender for Cloud's AI security posture management discovers a generative AI "bill of materials," flags misconfigurations such as missing private endpoints or non-identity-based authentication, and runs attack path analysis across Microsoft Foundry, AWS Bedrock, and Google Cloud Vertex AI (Defender for Cloud AI security posture). Defender also provides runtime protection that can audit or block tool calls when indirect prompt injection is detected, correlating AI-related alerts into Microsoft Defender XDR incidents (Microsoft Defender security for AI). Effective July 1, 2026, agent-level discovery and posture capabilities for Microsoft Foundry and third-party cloud agents require a Microsoft Agent 365 license, while Defender CSPM continues to discover Foundry accounts and projects at the infrastructure level (Defender for Cloud AI security posture).
4. Application and platform governance — Microsoft Foundry and Azure controls
Microsoft Foundry, covered in the Microsoft Foundry enterprise AI guide, is Microsoft's unified platform for building, evaluating, deploying, and governing AI models, agents, and tools. Its Foundry Control Plane provides role-based access control, network isolation options (bring-your-own or managed virtual network), guardrails such as content safety filters and prompt shields, task adherence evaluation, and continuous monitoring of agentic systems (Microsoft Foundry responsible AI overview). Azure RBAC, Azure Policy, and network controls such as private endpoints apply governance around Foundry projects at the infrastructure level (Azure Cloud Adoption Framework). Equivalent governance considerations apply inside Power Platform's enterprise governance model, and for the data layer feeding these systems, see data governance foundations for enterprise AI.
The following table summarizes how the four control planes map to specific AI risks.
| Control plane | Primary Microsoft capability | Addresses |
|---|---|---|
| Identity and access | Microsoft Entra, Entra Agent ID | Agent sprawl, over-privileged service principals, unmanaged tool access |
| Data protection and compliance | Microsoft Purview, DSPM for AI | Data oversharing, prompt-level data leakage, regulatory compliance |
| Threat protection and posture | Microsoft Defender, Defender for Cloud | Prompt injection, misconfigurations, runtime threats, attack paths |
| Application and platform governance | Microsoft Foundry Control Plane, Azure RBAC/Policy | Model/agent misuse, network exposure, unsafe outputs, drift |
What does defense in depth look like for AI systems?
Defense in depth applies layered, overlapping controls so that a single failure does not compromise the whole system. For AI, this means combining controls across all four planes rather than relying on any single product.
- Identity layer: every agent and tool connection has its own scoped identity rather than a shared credential.
- Data layer: sensitivity labels and DLP policies determine what an AI system can read and return.
- Runtime layer: guardrails intervene at input, tool call, tool response, and output stages (Microsoft Foundry Responsible AI).
- Network layer: private endpoints and egress controls limit where AI workloads can send or receive data.
- Detection layer: Defender XDR correlates signals from identity, data, and application layers into one incident view.
- Human layer: approval gates for high-impact or high-autonomy agent actions.
How should security teams inventory, log, and assess risk for AI systems?
- Build a single AI inventory. Require every agent and AI application to be registered — the Microsoft Entra Agent Registry provides a centralized view of agents built on Microsoft and non-Microsoft platforms, including agents that lack a governed identity yet (Microsoft Entra Agent ID blog).
- Assign ownership. Every agent needs a business owner, a security owner, and a documented retirement process (Microsoft Power Platform blog).
- Centralize logging. Route identity sign-in logs, Purview audit records, and Defender alerts into a shared analytics workspace or Microsoft Sentinel for correlation.
- Run risk assessments before production. Use adversarial testing (red teaming) to identify prompt injection, data leakage, and jailbreak vulnerabilities before an agent goes live, and repeat after significant changes (Azure Cloud Adoption Framework).
- Define incident response paths. Route AI-related alerts — anomalous agent behavior, risky AI usage detections, prompt injection alerts — into the same security operations process as other incidents, with defined escalation thresholds.
Enterprise AI security readiness checklist
- Every AI agent and application is registered in a central inventory with an assigned owner.
- Agent and workload identities use dedicated, least-privilege identities rather than shared service principals.
- Sensitivity labels and DLP policies are applied to data sources that AI systems can access.
- AI-specific threat protection is enabled for agents and models in use.
- Guardrails are configured at input, tool-call, and output stages for agentic systems.
- AI-related logs and alerts are integrated into existing incident response workflows.
- Adversarial testing runs before production deployment and after major updates.
- A documented approval policy exists for new AI tools and agents to reduce shadow AI risk.
Key takeaways
- AI expands the enterprise attack surface through new data flows, agent and workload identities, tool/API access, prompt injection, data leakage, and shadow AI.
- Microsoft organizes AI security around four control planes: identity (Entra), data protection (Purview), threat protection (Defender), and platform governance (Foundry and Azure controls).
- Microsoft Entra Agent ID is now generally available and gives every AI agent a distinct, governed identity separate from shared service principals.
- Microsoft Purview's DSPM for AI centralizes visibility into AI activity, oversharing risk, and policy enforcement across Microsoft and third-party AI tools.
- Microsoft Defender extends posture management and runtime threat protection to AI infrastructure, models, and agents, including prompt injection detection.
- Defense in depth for AI requires layered controls across identity, data, runtime, network, detection, and human-review layers.
Frequently asked questions
What is the difference between a workload identity and an agent identity?
A workload identity is a general-purpose non-human identity — such as a service principal or managed identity — used by applications and services to access resources (Microsoft Entra Workload ID). An agent identity is a specialized identity construct built specifically for AI agents, with agent-specific governance features such as blueprints and sponsor lifecycle management, available through Microsoft Entra Agent ID (Microsoft Entra Agent ID).
What is shadow AI and why does it matter for security?
Shadow AI refers to AI tools, agents, or services in use across an organization without IT or security approval or visibility. It matters because unregistered AI systems can access sensitive data, connect to internal tools, or process data without any of the identity, data protection, or threat detection controls applied to sanctioned systems, creating unmonitored risk.
Does Microsoft Defender protect against prompt injection attacks?
Microsoft Defender includes prompt injection protection in Defender for Office 365 for inbound email, and runtime protection for agents that can audit or block tool calls when indirect prompt injection is detected (Microsoft Tech Community monthly news). Some of these capabilities are in preview, so verify current scope and licensing before relying on them for a specific workload.
Is Azure AI Foundry the same as Microsoft Foundry?
Yes. Microsoft renamed Azure AI Foundry to Microsoft Foundry around the November 2025 to January 2026 product update cycle; existing deployments transitioned automatically and the underlying resource type did not change (Microsoft Foundry migration guide). Documentation may still reference the earlier name during the transition.
Do we need a separate security product for AI, or can we extend existing Microsoft tools?
Microsoft's current approach extends Entra, Purview, and Defender to AI workloads rather than requiring a separate AI security product, supplemented by AI-specific licensing such as Microsoft Agent 365 for certain agent-level discovery and protection features (Defender for Cloud AI security posture).
How does AI security governance connect to responsible AI practices?
Security controls and responsible AI practices (fairness, transparency, safe use) are complementary but distinct disciplines that intersect at points such as content safety guardrails and audit logging. For the governance dimension, see responsible AI governance for enterprise deployments.
Next step
The next implementation decision is typically which control plane has the largest current gap — most organizations start with identity, since ungoverned agent and workload identities are the most common source of AI-related exposure; see identity design for AI agents and workload identities for a starting checklist.
Book a 30 minute strategy call to map this to your environment — we will review your current Microsoft estate, identify the readiness gaps, and prioritize the next 90 days.
Sources
- What is Microsoft Entra Agent ID?
- What's new in Microsoft Entra Agent ID
- What are agent identities? - Microsoft Entra Agent ID
- Microsoft Entra innovations announced at RSAC 2026
- Surfing the AI Wave: Manage, govern, and protect AI agents with Microsoft Entra Agent ID
- Secured and Governed your AI Agents: Microsoft Entra Agent ID for Dataverse
- Microsoft Entra Workload ID | Microsoft Security
- Microsoft Purview data security and compliance protections for AI
- Learn about Data Security Posture Management for AI (classic)
- From Oversharing to Enforcement: A Practical Guide to AI Data Security with Microsoft Purview
- AI security posture management - Microsoft Defender for Cloud
- Protect AI assets from emerging threats and vulnerabilities using Microsoft Defender
- Monthly News - August 2026 (Microsoft Defender)
- A new era of agents, a new era of posture
- What's new in Microsoft Security: July 2026
- Responsible AI for Microsoft Foundry
- Govern and secure AI agents - Azure Cloud Adoption Framework
- Migrate from the Foundry (classic) portal
WRITTEN BY
Alaena VanderMost is VP of Operations and Delivery at Engineer Up. She has spent 13+ years building the operating systems that let creative and technology companies scale, and writes about the governance, decision-making structures, and operational infrastructure that actually hold up under pressure.
Get Your Team AI Ready
Let's hear your use case - we'll help you get on the path to AI readiness.
FILED UNDER
TOOLS IN THIS POST
