Securing AI in the Enterprise with Microsoft Security

Published July 20, 2026

Artificial intelligence is expanding quickly across the enterprise. As business units deploy copilots, agents, and generative AI tools, security leaders face a critical question: how does AI fundamentally change the attack surface, and what must be done to stay ahead?

Microsoft has already built meaningful native coverage for AI workloads, Copilot activity, AI agents, Shadow AI, and data protection. The ION MXDR service integrates these controls into continuous monitoring, detection, and response workflows.

How AI changes the attack surface

AI workloads, including models, training data, pipelines, orchestration systems, and supporting APIs, introduce new attack surface which can be abused or manipulated without the attacker ever touching a user endpoint.

AI agents increasingly act on behalf of users, often with delegated access to mailboxes, documents, collaboration platforms, and business applications. Through MCP servers and other integrations, these agents connect directly to enterprise applications and data sources. That makes identity and access management even more important.

Users can inadvertently expose sensitive data by sharing it with approved tools, pasting it into unsanctioned services, or interacting with AI agents. This includes, for example, data used for Retrieval-augmented generation (RAG) and system prompts. AI risks largely reflect existing security challenges, such as identity, data exposure, and misconfigurations, but appear in new forms.

New attack vectors target organizations

The most visible AI-related threats fall into two categories: threats against AI systems and threats using AI as an amplifier.

Threats against AI systems

AI workloads introduce application-layer threats that target how models process inputs. Prompt injection, both direct and indirect, is a primary risk, allowing attackers to manipulate model behavior. Model jailbreak attempts further exploit this by bypassing safety controls to generate harmful or restricted outputs.

Additional risks include training data poisoning, where manipulated data introduces hidden biases or backdoors, and unauthorized access to AI models, where exposed endpoints allow attackers to query or replicate models. Emerging threats also include credential theft, where attackers use AI interactions to capture tokens or sensitive credentials.

AI agents pose unique risks due to their autonomy and system integration. Abuse of delegated permissions can lead agents to perform unintended or unauthorized actions. The risk escalates significantly if an agent’s identity is compromised, enabling attackers to operate with its privileges. Attackers can manipulate agent behavior using carefully crafted prompts that subtly influence decisions. This can result in unsafe or malicious actions, making strong validation and oversight essential.

AI systems introduce significant data and governance challenges. Sensitive data can be exposed through prompts, either accidentally or intentionally, while oversharing with generative AI tools may leak confidential information.

The use of unsanctioned AI tools, or Shadow AI, further increases risk by bypassing security controls and governance processes. Without proper oversight, organizations may lose visibility and control over how their data is used and exposed.

Threats using AI as an amplifier

At the same time, attackers are using AI to work faster. AI-assisted reconnaissance, large-scale phishing content generation, and more convincing social engineering all increase the speed and quality of attacker operations. AI collapses the cost and time of offense.

However, there is a misconception that attack vectors are different between human operators and “agentic AI-based cyber attacks”. AI-powered attacks still exploit the same fundamental weaknesses. The recommended approach to defending against AI-powered cyber attacks is grounded in the same principles that protect against human-driven threats:

Security fundamentals still apply during AI adoption

How Microsoft addresses AI threats

Microsoft already provides broad native coverage across the major AI risk areas, and this is the central message security leaders should understand: Customers invested in the Microsoft security ecosystem are already better positioned than they may think.

The following sections highlight how Microsoft’s security products help secure AI adoption in the enterprise.

Microsoft Agent 365

Microsoft Agent 365 extends Microsoft Defender, Microsoft Entra ID Protection, and Microsoft Purview with a holistic control plane to register and manage AI agents. It introduces centralized lifecycle management for agents, including identity provisioning, policy enforcement, and visibility into how agents interact with enterprise data and services. By leveraging Entra ID risk-based controls, organizations can continuously evaluate agent identities for signs of compromise, such as anomalous sign-in behavior or risky token usage.

Microsoft Defender complements this by providing detection and response capabilities tailored to agent activity, including monitoring prompt interactions, tool usage, and downstream actions performed on behalf of users.

Defender for Cloud

Microsoft Defender for Cloud – AI Threat Protection is focused on securing generative AI workloads such as AI applications, agents, and models hosted in Azure. This includes Azure Direct Models as well as models from partners and the community. Among the detected threats are:

• Data leakage
• Data poisoning
• Jailbreaking
• Credential theft

Visit this link for a full alert reference for Defender for Cloud AI Threat Protection: Alerts for AI services – Microsoft Defender for Cloud

Defender for Cloud Apps

Microsoft Defender for Cloud Apps helps organizations discover, protect, and govern AI applications used in their enterprise, limiting the spread of Shadow AI. Administrators can allow specific, sanctioned AI applications while preventing access to others through fine-grained policies. Policy enforcement to block access to an app works through Defender for Endpoint Network Protection.

Defender for Cloud Apps can detect and respond to threats such as sensitive data in prompts and completions. Native alerts for prompt injection attacks and malicious prompts embedded in SharePoint files can be extended using custom policies. Defender for Cloud Apps also integrates with Defender for Cloud’s CSPM to assess the security posture of AI apps and apply risk scoring (e.g. compliance risk, legal risk, security risk).

Defender for Endpoint

Local AI Agent Discovery in Microsoft Defender for Endpoint enables discovery of 20+ supported local AI agents and MCP server configurations across Windows and macOS, including coding assistants, CLI tools, desktop AI apps, and IDE extensions. It provides a centralized AI agent inventory with device and user associations and an exposure map visualizing relationships between agents, devices, identities, and accessible resources. It can also block unauthorized coding agents while generating detailed alerts for security investigations. For agents built with Microsoft Copilot Studio, it offers real-time protection which monitors user prompts, pre-tool calls, and post-tool responses. Real-time protection can detect and respond to threats such as:

• Attempts to extract or exfiltrate system instructions or internal tool details
• Direct attempts to leak sensitive data
• Misuse of internal-only tools
• Routing information to untrusted or malicious destinations
• Use of obfuscated or hidden content to manipulate agent behavior
• Credential leakage through legitimate channels such as email or external APIs
• Prompt injection attacks that attempt to manipulate agents through injected instructions hidden in files, tool responses, or user input

Supported agents: Local AI agent discovery with Microsoft Defender for Endpoint (Preview) – Microsoft Defender for Endpoint

Microsoft Purview

Data Security Posture Management for AI monitors AI interactions (including prompts and responses) across Copilot experiences, enterprise AI applications, and third‑party generative AI tools.

For first-party apps such as Copilot, organizations can proactively detect and mitigate risks associated with its interactions. By utilizing advanced machine learning classifiers, Microsoft Purview can detect risky Copilot prompts and responses, such as those involving unauthorized disclosure of sensitive information. Purview ensures Copilot responses respect user permissions and access controls.

For third-party GenAI apps, Microsoft Purview provides capabilities to warn or prevent users from pasting sensitive data into GenAI prompts, thus mitigating the risk of oversharing. Sensitivity labels prevent AI apps from accessing and exfiltrating protected files.

Adaptive Protection in Microsoft Purview also enables organizations to take a dynamic approach to AI security by proactively blocking high-risk users from pasting sensitive data into a third-party GenAI app while allowing low-risk users to do so.

Microsoft Defender XDR

All these Microsoft security products integrate with Defender XDR, enabling teams to centralize alerts from AI workloads, agents, and data in a single portal. By correlating incidents in Defender XDR, teams can understand the complete scope of an attack, including AI-related activity. This centralized approach provides a cohesive security view that aligns with how modern attacks unfold across identities, data, and applications. It enables organizations to move beyond siloed monitoring and toward a more integrated detection and response model. Ultimately, this improves both the speed and effectiveness of incident response in environments where AI is deeply embedded in business processes.

Maximizing Microsoft Security Investments

AI and LLMs unquestionably expand the attack surface. Jailbreaking, prompt injection, oversharing of data and Shadow AI are just a few examples of new attack vectors threatening organizations. But they do not invalidate the core principles of cyber defense, and they do not leave Microsoft customers exposed by default.

The key for organizations is not to start from scratch, but to activate and operationalize what they already have. The following graphic summarizes the points above, mapping the new attack surface introduced by AI adoption to products in Microsoft’s security suite.

Overview of AI threats and Microsoft security products

Organizations can confidently embrace AI adoption without compromising their security posture if they align existing Microsoft security controls for AI with proven fundamentals such as strong identity and access management, holistic patch management, and continuous monitoring.

That is where Ontinue adds value. By combining Microsoft-native visibility with 24/7 MXDR, expert investigation, response, and ongoing advisory support, Ontinue helps customers translate platform capability into practical resilience.