STORIES WE THINK YOU'LL LIKE
2025 Microsoft Inclusion Changemaker Partner of the Year
Valorem Reply is proud to announce that we have been recognized as winner of 2025 Microsoft Inclusion Changemaker Partner of the Year Award
Read More
Most enterprises already have shadow AI. Employees install agents like OpenClaw on their laptops. Developers wire up Claude Code in repos. Marketing connects browser extensions to OAuth-scoped tokens. The IT team rarely knows. Security teams see the network noise but not the identities behind it.
Microsoft Agent 365, generally available since May 1, 2026, is purpose-built to close that gap. The product threads agent discovery, identity, access control, data protection, and threat response into the security stack your organization already runs. The piece below is a five-step playbook for using Agent 365 to surface every agent in the tenant, govern it, and respond when something goes wrong. What is shadow AI in the enterprise?
Shadow AI is any AI tool, model, or agent operating inside an organization without IT or security visibility. The term covers consumer GenAI tools used for work, browser extensions invoking external models, SaaS agents authorized through OAuth, and autonomous agents installed locally on managed devices. Shadow AI is not just shadow IT renamed. The agents read documents, execute code, send emails, and take actions on behalf of users at machine speed. Customers building secure Microsoft Copilot architecture often discover their shadow AI footprint is larger than their sanctioned one.
Why shadow AI agents are different from shadow IT
The same employee installing a free chatbot extension in 2026 is creating a different category of risk than the one installing a SaaS file-sharing tool in 2010. Two things have changed. First, the agent acts. Shadow IT stores your data; shadow AI uses it, transforms it, and triggers downstream actions. Second, identity has gone non-human. According to Microsoft's Zero Trust security guidance, identity-based cyberattacks now account for nearly 80 percent of breaches. Every unmanaged agent is one more unmonitored identity inside that statistic.
The traditional shadow IT response, block the tool, does not work for agents. Block one and three more appear, often inside SaaS products that users already need. The path forward is the one that solved shadow IT in the cloud era: visibility first, governance second, secure replacement third. Many of those secure replacements live inside modern work transformation rollouts already underway.
How Microsoft Agent 365 closes the shadow AI gap in five steps
The control plane is structured to follow a security workflow that mirrors how SOC teams already operate. Each step uses tools your team likely runs today.
Step 1: Discover every agent in your environment
Agent 365 surfaces agents through three channels: agents that already carry a Microsoft Entra Agent ID, agents that an admin manually registers, and shadow agents discovered automatically through Microsoft Defender and Microsoft Intune. The shadow AI page in the Microsoft 365 admin center finds local agents on Windows endpoints, beginning with OpenClaw. Multicloud sync extends discovery into AWS Bedrock and Google Cloud.
The output is a single registry showing what is running, who owns it, and which platform it came from. Until that exists, governance is guesswork.
Step 2: Bring agents under one identity system
Each agent gets a Microsoft Entra Agent ID, the same identity primitive that already covers users and service accounts. Agents acting on behalf of a user carry both identities, so every action is attributed back to a specific human owner. Lifecycle controls from Microsoft Entra ID Governance handle onboarding, access reviews, and retirement. Without identity, audit logs cannot be reconstructed, and access reviews cannot be enforced.
Step 3: Apply conditional access at the agent level
Microsoft Entra conditional access extends to agents with the same policy framework that already protects users. Admins can build policies that block agent identities exhibiting risky behavior, sign-ins from unusual locations, abnormal authentication spikes, or attempts to reach high-sensitivity resources outside the agent's stated scope.
Microsoft Entra Internet Access prompt injection protection, generally available since March 31, 2026, blocks malicious AI prompts at the network layer. Customers tightening their enterprise security guardrails usually start here, because conditional access is the highest-leverage control for an over-privileged agent.
Step 4: Extend data protection to every agent action
Microsoft Purview applies sensitivity labels, DLP, retention, and eDiscovery to anything an agent reads or generates. Agent-to-agent and agent-to-human data flows are treated with the same rigor as human-to-human communication. New Microsoft Purview prompt-level protections, now generally available, can block sensitive content from being submitted into AI prompts. The Data Security Posture Agent inside Microsoft Purview adds credential scanning to detect exposed secrets that agents might pick up. A mature data and AI strategy make these controls land cleanly; the labels and DLP rules need to exist before the agent does.
Step 5: Detect and respond to agent threats in real time
Microsoft Defender treats agents as first-class entities. Agent security posture management identifies misconfigurations and exposure paths. Threat detection watches for prompt injection, tool misuse, and signs of compromise. Compromised agents can be quarantined the same way a compromised endpoint is. Defender also surfaces agent attack paths visually, so security teams can see how a single overprivileged agent connects to sensitive data. The Security Alert Triage Agent, in preview since April 2026, automatically classifies and prioritizes the noisier alerts.
What about the agents Microsoft cannot reach yet?
Agent 365 does not magically make every agent visible. Three categories sit outside its current line of sight:
- Agents on unmanaged personal devices that never touch a managed network. Microsoft Edge for Business shadow AI protections help here, enforcing policy as long as users sign in with Microsoft Entra ID.
- Agents inside SaaS products your team uses but does not own. Microsoft Defender for Cloud Apps surfaces these, and the Agent 365 ecosystem partner program is steadily expanding coverage.
- Agents on operating systems, Agent 365, do not yet discover natively. Coverage beyond OpenClaw is incremental, so Defender posture management and network monitoring stay on the security checklist.
A clear-eyed program plans for these gaps rather than pretending they do not exist.
A pilot rollout in 6 weeks
A practical 6-week assessment and setup:
- Weeks 1-2: Discovery & Stakeholder Alignment. We audit your environment using Defender, Entra, and third-party portals (e.g., AWS) to identify unsanctioned agents. We conduct workshops with SecOps and business leads to map your "as-is" architectural state.
- Weeks 3-4: Governance & Security Baseline. Navigating enterprise change-control, we harden your tenant. We establish Entra Agent identities, configure Purview DLP for AI to enforce data boundaries, and enable Defender for AI to intercept runtime threats.
- Weeks 5-6: Architecture & Roadmapping. We design your "to-be" architecture and strategically plan the next steps for custom integration, concluding with an executive readout.
Where to take it from here
Shadow AI is not a problem you solve once. Agents are arriving faster than the controls, regulators are watching, and the longer the gap stays open, the wider it gets. Organizations getting ahead are treating shadow AI the way they treat unmanaged endpoints: surface, identify, govern, defend. Microsoft Agent 365 is the most direct path inside the Microsoft stack. Valorem Reply works with Microsoft customers on shadow AI discovery and Agent 365 rollout.
Frequently asked questions
Does Microsoft Agent 365 detect shadow AI agents on user laptops?
Yes. Microsoft Agent 365 uses Microsoft Defender and Microsoft Intune to discover local AI agents on Windows endpoints, starting with OpenClaw. Admins can quarantine or block unmanaged agents from the registry.
What is the difference between shadow AI and shadow IT?
Shadow IT covers unauthorized SaaS apps and software. Shadow AI covers unauthorized AI tools and autonomous agents that act on data and connect to other systems. Shadow AI typically creates a wider blast radius because the agent itself is doing work, not just storing files.
Can Agent 365 secure agents built outside Microsoft Copilot Studio?
Yes. The control plane is platform agnostic. Agent 365 covers agents from Microsoft Copilot Studio, Microsoft Foundry, AWS Bedrock, Google Cloud, and partner platforms, with multicloud registry sync in public preview.
How does Agent 365 prevent prompt injection attacks?
Microsoft Entra Internet Access prompt injection protection blocks malicious prompts at the network layer. Microsoft Defender flags prompt injection attempts as part of agent threat detection, and Microsoft Purview applies prompt-level protections that block sensitive content from being submitted to agents.
Do securing agents require new tools or licenses?
Agent 365 extends existing Microsoft Defender, Microsoft Entra, and Microsoft Purview capabilities to agents. Agent 365 is licensed at $15 per user per month, standalone or as part of Microsoft 365 E7 at $99 per user.
How quickly can a security team operationalize Agent 365?
Most organizations can run a meaningful pilot, including discovery, identity assignment, conditional access, and a governed workflow, inside 90 days when sequenced.
