Edit

Discover AI agents and assess security posture using Microsoft Defender (Preview)

  • Applies to: Microsoft Defender for XDR, Microsoft Defender for Cloud Apps, Microsoft Defender for Cloud

Microsoft Defender lets you discover all of the Microsoft Agent 365 managed agents in your organization and view their configuration details using two experiences in the Microsoft Defender portal:

  • Advanced Hunting
  • A dedicated AI agent inventory experience

This inventory includes cloud agents built with Microsoft Copilot Studio, Microsoft Foundry, and supported non-Microsoft cloud platforms, and local AI agents discovered on endpoints.

This article explains how to discover AI agents, assess their security posture, and use the AI agent inventory in the Microsoft Defender portal.

Prerequisites

Discover AI agents and assess security posture using Advanced Hunting

The AgentsInfo table in Advanced Hunting provides a complete inventory of your Agent 365 agents along with their security-relevant properties. This table enables you to:

  • Discover AI agents registered in your Agent 365 environment.
  • Assess security posture and risks by querying authentication, access control, tools, knowledge sources, and orchestration settings.

Note

The AgentsInfo table replaces the previous AIAgentsInfo table as part of the Microsoft Agent 365 transition. For more information, see Transition agent security capabilities to Microsoft Agent 365.

To view your Agent 365-managed agents and their configuration details:

  1. Open the Microsoft Defender portal

  2. Select Investigation & response > Hunting > Advanced hunting.

  3. Query the AgentsInfo table.

    To manage security posture, use the prebuilt queries that Microsoft provides and maintains for AI agents. To access these queries, select the Queries tab, then select AI Agents. For more information, see Sample queries.

    Create your own queries using Kusto Query Language (KQL). For example, run this query to get a list of all AI agents registered with Microsoft Agent 365, along with their key security information:

    AgentsInfo
| summarize arg_max(Timestamp, *) by AgentId
| where LifecycleStatus != "Deleted"

    The results show you the AI agents in your organization that are registered with Microsoft Agent 365, along with their configuration settings.

    Screenshot of Advanced Hunting in Microsoft Defender showing the AgentsInfo table query with results displaying agent name, platform, description, version, published status, lifecycle status, and creation time.

    Important

    The AgentsInfo table stores multiple snapshots of each agent over time. Use arg_max(Timestamp, *) to get the latest state of each agent. For more information about the arg_max() aggregation function, see arg_max() function.

    For more information:

Discover and manage AI agents using the AI Assets page (Preview)

The AI Assets page in the Defender portal provides a centralized view of all agents you build with Microsoft agent plaforms, supported non-Microsoft cloud platforms, and local AI agents discovered on endpoints.

To view your AI agent inventory:

  1. Sign in to the Microsoft Defender portal.

  2. In the left navigation pane, select Assets > AI Agents.

    The AI Assets page opens. Select the Agents tab to see cloud-based agents, or the Local agents tab to see agents discovered on endpoints.

    Screenshot that shows the AI Assets page in the Defender portal with the Agents tab selected, displaying agent name, platform, publish status, MCP servers count, discovered tools, active alerts, and creation time columns.

  3. Use the filter bar to narrow the list by Agent name, Platform, Publish status, Model, Version, or Creation time.

  4. To see detailed information about an AI agent, select the agent from the list. This opens the Agent pane, which provides detailed information about the selected agent.

    Screenshot of the AI agent inventory in the Defender portal showing the agent details pane for a selected Copilot Studio agent, including description, version, publish status, creation time, model, tools, channels, and MCP servers.

    • Select Open agent page to open the AI Agent page.
    • Select Go hunt to run Advanced Hunting queries.

Next steps

  • Last updated on