Secure Compute · Topic 1 of 3
Implementing Security for AI
SC-500 AI security: data oversharing and Purview DSPM for AI, Copilot Studio protection, Entra Agent ID, AI Gateway, Defender for AI and Foundry guardrails.
- 5 min
- AI surfaces overshared data; fix SharePoint permissions and use Purview DSPM (formerly DSPM for AI).
- Copilot Studio agents can use real-time protection to block suspicious tool actions.
- Entra Agent ID gives agents identities that Conditional Access and access reviews can govern.
What it is
AI apps and agents bring new risks: they can surface data users should not see, they can be manipulated by prompt injection, and agents act with their own identities and permissions. SC-500 covers controls across Microsoft Purview, Copilot Studio, Microsoft Entra, Defender, API Management and Microsoft Foundry to secure AI workloads.
How it works
Protecting the data AI can reach
- AI assistants such as Microsoft 365 Copilot respect existing permissions, so overshared content in SharePoint becomes easy to find. Identify oversharing with SharePoint Advanced Management data access governance reports and site access reviews, and with Purview DSPM data risk assessments; then fix permissions, apply sensitivity labels, or limit what Copilot surfaces with restricted content discovery or restricted access control.
- Microsoft Purview Data Security Posture Management (DSPM) shows how Copilot, AI apps and agents are used (AI observability), identifies risks such as sensitive data in prompts, runs data risk assessments and recommends policies. It is now one unified DSPM experience; the earlier separate DSPM for AI is labeled DSPM for AI (classic) and is being retired.
Securing agents
| Control | Purpose |
|---|---|
| Real-time protection for Copilot Studio agents | Before a generative agent invokes a tool, sends the planned action to a threat detection provider (Microsoft Defender, a third party or a custom service) that can block it; turned on per environment by a Power Platform administrator (preview) |
| Microsoft Entra Agent ID | Gives AI agents their own identities in Entra ID, so they can be governed like other identities |
| Conditional Access for agents | Targets agent identities, agent identity blueprints (all agents created from them) or agent users, for example to block risky agents; when an agent acts on behalf of a signed-in user, the user's policies apply |
| Agent access management | Each agent identity has owners and an accountable human sponsor; grant access through access packages, review and revoke blueprint permissions, and disable an agent or blueprint (Agent ID Administrator role) |
| Blast radius analysis in Defender XDR | Shows what an identity, including an agent, could reach if compromised |
| Agents in the Microsoft 365 admin center | View agents in the registry, review and publish or reject agents submitted for the organization, scope who can use them, and block agents |
Securing AI apps
- AI Gateway in Azure API Management sits in front of Foundry model endpoints. The gateway authenticates to the model with its managed identity, so apps don't need model keys. Policies enforce token limits and quotas (
llm-token-limit), emit token metrics, apply Azure AI Content Safety checks (llm-content-safety) and log prompts and usage. An AI gateway can also be associated directly with a Foundry resource (preview). - Guardrails in Microsoft Foundry apply controls such as content filters and Prompt Shields at intervention points: user input and output for models and agents, plus tool call and tool response for agents (preview). An agent's guardrail overrides the model's guardrail.
Threat protection and monitoring
- Defender for AI services (a Defender for Cloud workload protection plan) works with Prompt Shields and threat intelligence to raise alerts for threats such as jailbreak, data leakage, data poisoning and credential theft against Azure OpenAI and Foundry model deployments. Prompt evidence can be included in alerts, and alerts flow to Defender XDR.
- The Data and AI security dashboard in Defender for Cloud (preview) gives one view of data and AI resources, their protection status, top alerts, recommendations and attack paths. The full view needs Defender CSPM with sensitive data discovery plus the Storage, Databases and AI services plans.
A worked example: a company rolls out an internal agent that reads HR documents. The security team checks SharePoint for overshared HR sites before launch, registers the agent with an Entra Agent ID and applies Conditional Access, routes model calls through an AI Gateway with token limits, turns on Foundry guardrails and Defender for AI services, and watches the Data and AI security dashboard.
Match the layer to the control. Data exposure: Purview DSPM and SharePoint permissions. Agent identity: Entra Agent ID and Conditional Access. Model endpoint: AI Gateway and guardrails. Threats: Defender for AI services.
How the exam asks about this
- "Find sensitive data that users are pasting into AI apps." Purview DSPM (AI observability and activity explorer).
- "Apply token limits and managed identity authentication in front of Foundry models." AI Gateway in API Management.
- "Detect jailbreak attempts against an AI application." Defender for AI services.
What to remember for the exam
- AI surfaces overshared data; fix SharePoint permissions and use Purview DSPM (formerly DSPM for AI).
- Copilot Studio agents can use real-time protection to block suspicious tool actions.
- Entra Agent ID gives agents identities that Conditional Access and access reviews can govern.
- AI Gateway in API Management adds authentication, token limits and logging for model endpoints.
- Defender for AI services and the Data and AI security dashboard monitor AI workloads.
An AI assistant can expose data even when no permission was changed. Overshared permissions are the root cause to fix.
Common mistakes
Treating AI security as only a model problem. Data permissions and identities matter as much.
Giving apps direct model keys. Use an AI Gateway with managed identities.
Ignoring agent identities. Agents need governance like users and apps.
Check yourself
Why does oversharing matter more once AI assistants are deployed?
Assistants respect existing permissions, so content that is overshared becomes easy for users to discover through the assistant.
What does Microsoft Entra Agent ID provide?
Identities for AI agents in Entra ID, so they can be governed with controls such as Conditional Access.
Which Defender for Cloud plan detects threats against AI workloads?
Defender for AI services.
Topic 1 of 3 in Secure Compute
Test yourself on Secure Compute
The full Microsoft SC-500 question bank has 650 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by Microsoft. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.