Note
Access to this page requires authorization. You can try signing in or changing directories.
Access to this page requires authorization. You can try changing directories.
Deployed AI agents operate autonomously, invoking tools, accessing data, and taking actions in response to natural‑language input. Microsoft Defender provides real-time protection to prevent AI agents from performing unsafe actions during runtime, and lets you control that protection using policies and rules.
To detect, investigate, and hunt for AI agent threats after they occur, see Detect and investigate threats to AI agents using Microsoft Defender.
Prerequisites
- Enable security for AI agents, including the Microsoft 365 app connector. See Enable security for AI agents using Microsoft Defender.
- To protect Copilot Studio agents in real time, make sure Copilot Studio is connected. See Enable security for AI agents using Microsoft Defender.
- Local agents are onboarded separately from cloud agents. To protect local AI agents that run on endpoints, set up AI agent runtime protection in Microsoft Defender for Endpoint. Microsoft Defender for Endpoint must run in active mode.
How real-time protection works
Real-time protection inspects AI agent activity throughout the agentic loop and blocks risky actions before they execute. Coverage depends on the agent type:
Agent 365 tool invocations: Defender integrates with Work IQ MCP to evaluate tool invocations before they run, including invocations of customer MCP tools onboarded to Agent 365. Agents that rely on unsupported tools or don't integrate with Work IQ MCP aren't covered.
Copilot Studio agents (Preview): Protection evaluates tool invocations, which doesn't depend on Work IQ MCP. To enable it, make sure that Copilot Studio is connected. For more information, see Enable security for AI agents using Microsoft Defender.
Foundry agents (Preview): Protection evaluates user requests, agent responses, tool invocations, and tool responses.
Local AI agents: Covered through endpoint runtime protection in Microsoft Defender for Endpoint.
For cloud agents, there are two types of real-time protection rules:
- Default rule: Audits all agents, recording matching activity as a behavior without stopping the action. This gives you visibility before you enforce blocking.
- Custom rules: Block matching actions before they execute and record the behavior. Create custom rules for high-confidence threats and scope them to specific agents.
When Microsoft Defender audits or blocks an action, it records the event as a behavior in the BehaviorInfo table, including what happened, why the action was considered risky, and which agent, user, and tool were involved. Security teams can query these behaviors to build custom detections, hunting queries, and downstream automation. Near-real-time detections continue to surface as alerts only in audit mode. When a blocking rule covers an agent, near-real-time alerts aren't generated for that agent.
Note
Block events from Microsoft Prompt Shields for Foundry, Copilot Studio and Microsoft Copilot Agent Builder are also recorded as behaviors.
Supported threat scenarios for real-time protection
Real-time protection inspects agent interactions for threats. When you enable a blocking rule for a threat scenario, interactions that match that scenario are blocked at the intervention point where the threat is detected.
Malicious content propagation
Malicious content propagation occurs when an agent receives, generates, or passes along content identified as malicious. For example, an attacker might include a malicious URL in a user request or tool response, which the agent could then share with a user or pass to another tool.
When blocking is enabled: Interactions containing detected malicious content are blocked. Depending on where detection occurs, this prevents a user request from reaching the model, a model response from being delivered, a tool request from executing, or a tool response from being passed back to the model.
Secret exfiltration
Secret exfiltration occurs when an agent interaction exposes or attempts to transfer secrets, such as API keys, credentials, or access tokens. For example, an agent might retrieve a secret from a connected data source and include it in a response or pass it as an argument to a tool.
When blocking is enabled: Interactions identified as secret exfiltration are blocked. This can stop a user request containing an exfiltration attempt, prevent a model response from disclosing a secret, stop a tool call that would transmit a secret, or prevent a tool response containing detected secret exfiltration from reaching the model.
Evasion techniques
Evasion techniques attempt to conceal malicious instructions or content to bypass security controls. For example, an attacker might encode or obfuscate content so that its intent is harder to detect.
When blocking is enabled: Interactions containing detected evasion techniques are blocked. Protection applies to user requests, model responses, tool requests, and tool responses, preventing the detected content from proceeding through the interaction.
Unsafe email domain
An unsafe email domain scenario occurs when an agent attempts to send an email to a recipient whose domain is identified as unsafe or untrusted. For example, an attacker might instruct an agent to send information to an email address on an untrusted domain.
When blocking is enabled: A tool call identified as sending email to an unsafe domain is blocked before the tool executes. This scenario is evaluated only at the tool request intervention point. An email address appearing in a user request, model response, or tool response does not, by itself, trigger blocking for this scenario.
Configure real-time protection rules
To view and manage rules, go to Settings > Security for AI > Policies & rules > Real-time protection. A built-in Default rule audits all agents. You can create custom rules to block specific detection types and scope them to specific agents.
Create a real-time protection rule
To create a blocking rule:
Sign in to the Microsoft Defender portal.
Go to Settings > Security for AI > Policies & rules > Real-time protection.
Select Create rule.
On the Rule details step, set the rule Status, enter a Rule name and Rule description, then select Next.
Configure the rule scope and detection types:
Scope: Choose whether the rule applies to All agents or to specific agents.
Exclude: To exempt specific agents from the rule, choose the agents to exclude. You can filter the list by platform and publish status. Only agents with a Microsoft Entra agent ID appear in the list.
Detection types: Select the threat scenarios that the rule applies to, then select Apply.
Select Next.
Confirm the rule name, description, action, scope, detection rules, and status, then select Create.
Manage existing rules
On the Real-time protection page, select a rule to open its details pane, where you can review the rule configuration and select Edit rule to change it. Use Enable, Disable, and Delete in the toolbar to manage rules.
Control prompt evidence in alerts
By default, Microsoft Defender includes prompt snippets exchanged between the user and the agent as evidence in each alert.
To configure this setting, go to Settings > Security for AI > Prompt evidence collection, then toggle Enabled on or off.
When enabled, the snippets include only the portions of user prompts or agent responses identified as suspicious and relevant to security classification. Sensitive data and secrets are redacted; however, customer conversations might still be sensitive in nature. The evidence is available in the Defender portal as part of each alert.
