Some links on this page are affiliate links: if you buy through them we may earn a commission, at no extra cost to you.
Start with Microsoft Purview Audit, then add DSPM for AI, Defender, and Sentinel. Purview establishes which identity interacted with Copilot or another AI application, when it happened, the workload involved, and which files, sites, or other resources were referenced. DSPM for AI adds prompt, response, sensitivity-label, DLP, eDiscovery, and retention context where available. Defender’s Agent 365 telemetry can reveal runtime attacks and near-real-time suspicious behavior, while Sentinel correlates the evidence across users, agents, tools, alerts, and resources.
Investigate before you delete evidence: export the relevant records, identify the agent and owner, determine whether data was merely reachable or actually returned to a user or sent elsewhere, then contain the agent and its connections. The sequence below is designed for Microsoft 365 administrators, SOC analysts, incident responders, compliance teams, and security architects working in 2026.
As an Amazon Associate I earn from qualifying purchases.
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minutePC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11What counts as unauthorized AI-agent activity in Microsoft 365?
Unauthorized activity is any AI-agent action that exceeds the approval, identity, data-access, or business-purpose boundaries your organization established. The agent might be malicious, misconfigured, orphaned after an employee leaves, or legitimately installed but granted excessive permissions.
Examples include an agent reading SharePoint or OneDrive content outside its intended project, using a connector with a stale service credential, sending sensitive output to an unapproved recipient, following an indirect prompt injection in a document, or continuing to run after its owner and business purpose disappeared. A normal Copilot interaction can also look suspicious if the user did not understand that a connected workload or custom agent was in scope.
#1 Best Overall
- [Ultra-Lightweight Ear Buds Designed for Small Ears] Each earbud weighs only 3.7g and features a compact, ergonomic in-ear design made especially for small ears. Secure, low-profile, and comfortable for workouts, all-day wear or overnight sleeping.The ultra-slim profile sits flush in your ear with no hard edges poking or rubbing, so you can even sleep on your side without discomfort.
- [Immersive Stereo Sound with TOZO OrigX Technology] TOZO OrigX tuning delivers clear vocals, balanced mids, and natural stereo sound for music, podcasts, and videos.
- [Long Battery Life for Daily Use] Get up to 7 hours of playtime on a single charge, with up to 32 hours total using the charging case—ideal for workdays, commuting, and extended listening sessions.
- [Bluetooth 5.3 & Stable Connection] Bluetooth 5.3 provides fast pairing, stable wireless performance, and reduced dropouts as you move around home or office.
- [Deep Bass with Clear Vocals] High-performance drivers produce punchy bass while keeping vocals clean and detailed for everyday listening.
Do not equate a log entry with confirmed exfiltration. An audit record can show that an identity or agent accessed a resource; content review, message tracing, endpoint evidence, or destination logs may be needed to prove that information left Microsoft 365.
Where are Copilot and AI-agent audit records?
Purview Audit is the starting point for identity and activity scope. Microsoft describes Copilot and AI-application audit records as containing the user, time, interaction context, and references to files, sites, or other resources involved.
Recommended Free Tools
| Control | What it shows | Best use | Important limitation |
|---|---|---|---|
| Purview Audit | User or app identity, timestamp, workload, operation, and referenced resources | Build the initial event timeline and scope | Metadata may not prove what content was returned or transferred |
| DSPM for AI Activity Explorer | AI interactions, prompts and responses where available, sensitivity, DLP matches, and governance context | Assess data exposure and policy impact | Availability depends on workload, configuration, and licensing |
| Defender Agent 365 | Managed-agent inventory, tools, execution patterns, alerts, and runtime detections | Identify prompt injection, jailbreaks, credential leakage, and suspicious behavior | Some capabilities are preview and scoped to Agent 365-managed agents |
| Advanced Hunting | Joined agent, alert, user, URL, resource, and behavior records | Pivot from one indicator to related activity | Retention and table availability follow the service configuration |
| Microsoft Sentinel | Cross-service correlation, KQL-based analytics, incidents, and evidence exports | Run repeatable detections and coordinate enterprise response | Requires data connectors, workspace configuration, and analytic-rule maintenance |
Microsoft’s 2026 AI Investigation Playbook describes a workflow spanning Purview, Defender, Sentinel, and Azure AI services. Treat each service as a layer: audit tells you what happened and who was involved; runtime telemetry explains how an agent behaved; SIEM correlation tells you whether the event connects to a broader incident.
How do I find out whether an AI agent used Microsoft 365 data without permission?
Work in this order: scope the event, establish data context, hunt runtime behavior, correlate related evidence, and only then make containment and notification decisions.
1. Scope the event in Purview Audit
Open the Microsoft Purview portal and go to Solutions > Audit. Select the date and time window that brackets the suspected activity, then filter for Copilot and AI-related operations available in your tenant. Use the narrowest window that still includes the first known indicator; expand it in controlled increments if the timeline is incomplete.
- Record the initiating user, application or service identity, tenant, workload, operation, and timestamp, including the time zone.
- Capture the agent name, agent identifier, connection or plugin identity, and any available correlation or session ID.
- List every referenced file, SharePoint site, OneDrive item, mailbox, Teams location, or other resource.
- Export the search results in the native format offered by Purview and preserve the export hash or chain-of-custody record in your case system.
- Repeat the search for adjacent operations by the same identity, agent, IP address, and connector so that a single prompt is not treated as the entire incident.
Keep the original export read-only. Screenshots are useful for a ticket but are not a substitute for the underlying export, especially when an investigation may lead to eDiscovery, disciplinary action, regulatory reporting, or litigation.
Rank #2
- 【IP68 Waterproof Multifunctinal Smart Watch】Torjalph fitness activity tracker smart watch is IP68 waterproof technology ,you can wear it when swimming,handwashing,it's rain-proof which means that you perform multiple exercise modes outside without worrying about sweat or rain corroding your fitness smart watch,and this watch equipped with a 230 mAh large capacity battery magnetic charging ,and this sports activity tracker watch can be used 5-7 days If fully charged.
- 【Larger 1.83'' Full Screen Watch & Multi-dial Selection】1.83 inch full HD color touch screen smart watch for men / women provides excellent 240*284 resolution image quality ,This Bluetooth smart watch offers a better touch experience and remarkable immersion and ,more than 200 watch faces for you to choose from App"Da Fit ", you can change the dial style according to your mood to wear keeping the world on your wrist
- 【Accurate Activity Tracker Smart Watch 】sports watch activity tracker uses sweat and dust resistant breathable silicone strap, our Fitness Tracker Smart Watch for Android iOS Phones supports 12 sports modes,walking,running,bicycle,swimming,badminton,basketball,football,rope skipping. This bluetooth calls smart watch for men women is lightweight and stylish, bringing more convenient and relaxing sports experience while also providing more protection.
- 【Your 24 Hour Personal Daily Health Monitor】Fitness watch for women men full touch screen IP67 waterproof bluetooth smartwatch for Android iOS Phones with heart rate blood pressure monitor multifunction Andriod smart watch with steps counter sleep monitor sports fitness watch, monitoring blood oxygen saturation allows you to understand your physical condition in real time to track fitness progress ,to know your health status in time.
- 【More Functions Bluetooth Call Smart Watch】This fitness activity smart watch full screen for iPhone and Android phones includes a bunch of new features including:The bluetooth smart watch can hang up the phone, receive and display WhatsAPP /Text /Facebook /Twitter /Messenger reminder.Support sedentary reminder, alarm clock, stopwatch, timer,weather information,music control, remote camera control compatible with Android 5.0 and above or iOS 9.0 and above smartphones.
2. Establish whether sensitive data was in context
Use Solutions > Data Security Posture Management (DSPM) > DSPM for AI, then open Activity Explorer for the same identity and time range. Compare the resources in the audit record with sensitivity labels, DLP matches, retention settings, and eDiscovery holds.
- Prompt and response evidence: determine whether the user supplied sensitive text, whether the model returned protected content, and whether the record is complete for that workload.
- Resource references: distinguish a citation or retrieval attempt from a successful read of the underlying item.
- Policy context: note which DLP, insider-risk, communication-compliance, or sensitivity-label policy matched, if any.
- Coverage gaps: record when a prompt, response, or file reference is unavailable rather than inferring that no data was exposed.
Purview supports governance actions such as retention, eDiscovery, and deletion controls for applicable AI interaction data. Apply those controls only after preserving the evidence needed for the incident.
3. Check whether the agent behaved maliciously at runtime
In Microsoft Defender, open the Agent 365 inventory and inspect the affected managed agent’s configuration, owner, tools, connectors, permissions, and recent activity. Defender continuously analyzes telemetry for Agent 365-managed agents and can alert on jailbreaks, indirect prompt injection, malicious propagation, secret or credential leakage, evasion, reconnaissance, and suspicious user or IP access.
Prioritize alerts that line up with the Purview timestamp and resource list. A runtime alert without a corresponding data-access event may be a blocked attempt; an audit event without a runtime alert may still represent over-permissioning or accidental exposure rather than an exploit.
Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Repair Windows errors before they cause bigger problems3Fix the driver behind crashes, sound loss and screen glitchesSome Agent 365 detection capabilities are preview features. Confirm the preview status, supported region, workload, and managed-agent scope before treating an absence of an alert as evidence that no attack occurred.
4. Correlate the evidence in Advanced Hunting
Use Defender Advanced Hunting to pivot from the initial identity or agent to related objects. The exact columns available depend on your tenant and enabled services, but Microsoft documents a useful set of tables for this investigation.
Rank #3
- [Low Noise High Fidelity] New bee guitar cord with 22AWG oxygen-free-copper center conductors provides enhanced signal transfer, the PVC insulation material and the high-density stranded copper double shield provide noise rejection for quiet operation
- [Ideal for Choice] New bee 1/4 straight and right angle metal connectors, ensures a secure connection in any instrument, pedal, or amp jack. L shape great fro on stage guitar stands
- [Wide Compatible] Suitable for mixer, power amplifier, microphone, effector, decoder, equalizer, electoronic organ, electric guitar, electric bass and other electronic equipments. Widely used in the installation of smart home, karaoke speaker, professional stage audio, etc
- [Easy Disassemble] Making incidental repairs quick and easy! Very nice, flexible cable
- [Dont Hesite to Order] 24 hours customer services and professional technology team are standing by
| Table | Pivot questions |
|---|---|
AlertInfo |
Which detections fired, at what severity, and under which technique or category? |
AlertEvidence |
Which users, agents, URLs, files, resources, or devices were attached to an alert? |
CloudAppEvents |
Did a cloud application, connector, or user perform related activity before or after the AI interaction? |
AgentsInfo |
What is the agent’s identity, owner, status, configuration, and declared capability? |
BehaviorInfo |
What suspicious behavior pattern did Defender identify? |
BehaviorEntities |
Which entities were involved in that behavior, and what other events share them? |
Begin with exact matches on agent ID, user ID, operation, and time. Then broaden by shared connector, URL, IP address, resource, or device. Save the query text and result set with the case so another analyst can reproduce the pivot.
5. Use Sentinel when the investigation spans services or tenants
Sentinel is the right layer for repeatable correlation, long-running investigations, and SOC workflows that combine Microsoft 365 with identity, endpoint, network, or Azure AI signals. Microsoft’s AI Investigation Playbook includes configuration guidance, KQL examples, detection logic, analytic rules, and evidence-export patterns.
- Confirm that Purview, Defender, identity, and relevant Azure AI data connectors are sending the records your rules expect.
- Normalize timestamps to UTC in the workspace and retain the original time zone in an evidence field.
- Create an incident entity for the agent, owner, user, connector, and affected resources rather than only the alert title.
- Correlate a short pre-event and post-event window to catch reconnaissance, permission changes, secret retrieval, and outbound activity.
- Export the correlated evidence before closing or suppressing alerts, and document which records were unavailable because of retention or licensing limits.
Analytic rules should identify unusual combinations, not merely high-volume normal use. For example, a new agent owner plus a new connector plus access to labeled content is more actionable than a generic “AI interaction” event.
How can I tell whether data was actually exposed?
Separate four questions: could the agent reach the data, did it retrieve the data, did it place the data in a prompt or response, and did it transmit the data outside the approved boundary.
- Permission check: inspect the agent’s delegated and application permissions, SharePoint or OneDrive access, mailbox scope, connector roles, and conditional-access context at the event time.
- Retrieval check: compare audit resource references with item-level access records and connector execution logs.
- Content check: review preserved prompts, responses, citations, and DLP matches. For high-risk data, use approved eDiscovery procedures rather than copying content into an analyst’s personal notes.
- Transfer check: examine email recipients, Teams messages, file-sharing events, connector destinations, browser or endpoint telemetry, and service logs for outbound movement.
- Impact check: classify the data by sensitivity, affected people, contractual restrictions, and regulatory obligations; involve privacy and legal teams where required.
If only permission and retrieval are proven, report the finding as unauthorized access or attempted access. If a response or outbound event contains the material, classify it as exposure according to your incident policy and preserve the exact evidence supporting that conclusion.
How do I disable or contain a rogue Copilot agent?
Containment should stop further access while preserving enough configuration and telemetry to explain what happened.
Rank #4
- Digital Family Calendar: BSIMB digital calendar wall touch screen puts an end to your chaotic life. Designed for busy families, the digital calendar keeps you organised and in step with your family. Assign different colours and tasks to each family member to make family scheduling easier and more intuitive.
- Easy Setup and Auto-Sync: Plug in, connect to WLAN and auto-syn your electric calendar in minutes. Digital wall calendar compatible with Google calendar, iCloud calendar, Outlook calendar, Cozi calendar and Yahoo calendar. Add events directly on the device or through the ecalendar app. Electronic calendar stays current whether you're at work or traveling—no manual updates needed.
- All-In-One Home Assistant: Smart calendar builds habits and encourage independence with personalised chores. Display daily meal plan to reduce the daily ‘What's for dinner?’ stress. To-do lists keep track of everything you want. Turning chores into valuable achievements with stars and rewards, making life easier and more enjoyable.
- Manage Anytime Anywhere: BSIMB electronic calendar for family stay connected with the powerful ecalendar app. Access and manage your digital wall calendar anytime, anywhere with free features like stars & rewards, photo screensaver, chore charts, meals plans, to-do lists etc. Electronic planner paid features like Magic Import tailor advanced tools for users with special needs.
- Stay in Touch with Loved Ones: Share photos or videos from your phone to electronic wall calendar with app, instantly update your life moment, and keep in touch with your family, especially those who are far away; you can also surprise your smart calendar digital wall by sending him a wish card; it's also great for keeping tech-illiterate elders in touch with the youngsters.
Immediate containment
- In the agent-management interface, suspend or disable the affected agent. If a tenant-wide switch or workload control is needed, use the narrowest scope that stops the risk without destroying unrelated evidence.
- Block or revoke the specific connector, OAuth grant, application permission, service principal credential, or API key used by the agent.
- Disable high-risk actions such as sending messages, changing permissions, creating sharing links, running code, or writing to external systems until reviewed.
- Revoke active sessions and rotate secrets that may have been exposed. Preserve the secret’s metadata and rotation time, never the secret value itself.
- Apply temporary DLP, conditional-access, or unmanaged-app blocks for the affected users, devices, destinations, or data labels.
- Notify the named incident owner, compliance contact, and business owner; record who approved each containment action.
Do not simply delete an agent as the first move. Deletion can remove configuration needed to determine its owner, tools, instructions, permissions, and execution history. Export those details, then remove the agent when your retention and response process permits.
Remediation before re-enablement
- Ownership: assign a named business owner and technical custodian, with a deputy and review date.
- Least privilege: replace broad delegated or application permissions with resource-, action-, and data-specific scopes.
- Connection hygiene: remove dormant connections, unused actions, shared accounts, embedded secrets, and integrations without authenticated official endpoints.
- Instruction hardening: treat documents, web pages, emails, and retrieved text as untrusted input; define what the agent must never disclose or execute.
- Human approval: require confirmation before sending to new recipients, changing access, publishing content, or executing sensitive operations.
- Transport security: use HTTPS and authenticated integrations, and verify destination ownership rather than allowing an agent to choose arbitrary endpoints.
- Lifecycle: review agents after ownership changes, connector changes, model changes, and periods of inactivity; retire those without a current business purpose.
Re-enable the agent in a monitored pilot, test with synthetic data, verify DLP and approval controls, and compare its observed actions with the approved capability statement.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.How do I stop unmanaged AI applications from accessing Microsoft 365 data?
Use Defender for Cloud Apps, Defender for Endpoint, DSPM policies, and browser controls to discover and restrict AI applications that are outside your managed-agent inventory.
- Discover: identify AI applications in cloud-application discovery and review the users, devices, uploads, prompts, and destinations associated with them.
- Monitor: classify applications by business approval, data handling, authentication method, and contractual status.
- Block selectively: block specific unsanctioned applications or risky activities rather than interrupting every AI tool used by the business.
- Protect endpoints: use Defender for Endpoint controls on onboarded devices to prevent unapproved applications where policy requires it.
- Protect the browser path: use available Edge and DSPM controls to surface prompt activity and apply data-protection policies.
- Provide an approved route: users are less likely to bypass controls when an approved assistant, connector, and data-handling process meets their need.
Cloud-app discovery will not show every interaction with perfect fidelity. Reconcile it with identity, endpoint, proxy, and Microsoft 365 audit data when an investigation depends on proving a transfer.
Free tools Windows power users keep installed
One-click scans. No signup required.
Which Microsoft 365 control should I use first?
The right starting point depends on whether you need historical accountability, content context, runtime detection, or cross-service response.
| Investigation need | Primary control | What to expect |
|---|---|---|
| Who used Copilot or an AI app, when, and against which resources? | Purview Audit | Identity, time, workload, operation, and resource references |
| Did prompts or responses contain protected information? | DSPM for AI Activity Explorer | Prompt/response and policy context where the workload supplies it |
| Was the agent attacked or behaving suspiciously? | Defender Agent 365 | Runtime telemetry and near-real-time detections for supported managed agents |
| What else is connected to the same user, tool, URL, or resource? | Defender Advanced Hunting | Correlated tables such as AlertInfo, CloudAppEvents, and AgentsInfo |
| How do we operationalize detections and case management? | Microsoft Sentinel | KQL, analytic rules, incidents, automation, and evidence exports |
| How do we stop an external or unapproved AI app? | Defender for Cloud Apps and Defender for Endpoint | Discovery, monitoring, and blocking options for supported applications and devices |
What retention and availability limits affect an investigation?
Do not assume every AI interaction is logged in the same way or for the same period. Microsoft’s current documentation states that non-Microsoft AI interaction audit logs require pay-as-you-go billing when enabled and are retained for 180 days. Workload coverage, regional availability, licensing, preview status, and tenant configuration can change what appears in Purview, DSPM, Defender, or Sentinel.
At the start of a case, document the tenant’s audit configuration, licensing state, connector health, retention settings, and the earliest available record. If a required prompt or response is absent, state that the evidence is unavailable; do not infer that the interaction did not occur.
What mistakes make AI-agent investigations fail?
- Searching only by user: an app identity, service principal, connector, or delegated session may be the actor visible in the record.
- Looking only at alerts: over-permissioning and accidental disclosure may generate no high-severity runtime alert.
- Deleting first: removal can destroy ownership, instruction, permission, and connection evidence.
- Assuming a citation equals a read: validate retrieval and content access with the underlying workload records.
- Assuming access equals exfiltration: prove the outbound path before declaring data loss.
- Ignoring orphaned agents: an unowned agent can continue operating after its creator leaves or changes roles.
- Relying on preview behavior: confirm supported scope before using a Defender feature as a control assurance.
- Failing to preserve time zones: keep UTC-normalized timestamps alongside the original local time to avoid false ordering.
What should an enterprise investigation runbook contain?
A usable runbook turns the sequence into assignments, evidence requirements, and decision points.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
- Intake: capture the reporter, suspected agent, user, first indicator, business owner, and potential data classes.
- Preservation: export Purview, DSPM, Defender, and Sentinel records; preserve agent configuration, permissions, connections, and instructions.
- Scoping: search the initiating identity, agent ID, connectors, users, devices, URLs, IPs, and affected resources across the same time window.
- Classification: label the event as attempted access, unauthorized access, confirmed exposure, or confirmed transfer according to evidence.
- Containment: suspend the agent, revoke risky connections, rotate credentials, and apply narrowly targeted policy blocks.
- Notification: engage privacy, legal, compliance, and the business owner when the data class or jurisdiction requires it.
- Recovery: remediate permissions and instructions, test with non-sensitive data, and re-enable under monitoring.
- Lessons learned: add detections for the observed pattern, assign lifecycle ownership, and schedule a review date.
This approach aligns with Microsoft’s 2026 guidance that AI interactions generate telemetry across Purview, Defender, and Sentinel, while keeping the evidentiary distinction between an agent’s capability, an attempted action, and a confirmed disclosure.
Frequently Asked Questions
Can Microsoft 365 audit logs prove that an AI agent exfiltrated a file?
Usually not by themselves. Audit records can establish identity, timing, operations, and referenced resources, but proving exfiltration normally requires a response record or outbound evidence such as a message, sharing event, connector log, endpoint event, or destination-service record.
Should I rotate an agent’s credentials before investigating it?
If active misuse is continuing, revoke or rotate the credential as a containment action, but first preserve its metadata, permissions, owner, connection details, and relevant logs. Never copy the secret value into the case file; record only the identifier and rotation event.
Do sensitivity labels automatically prevent an AI agent from reading a document?
Not necessarily. Labels provide classification and can participate in encryption, DLP, and access policies, but effective prevention depends on the label configuration, the agent’s identity, the connector, and the workload’s enforcement behavior.
What should we do when an agent has no current owner?
Treat it as a governance risk and suspend it if its purpose or access cannot be verified. Preserve its configuration, identify the business process it supported, assign accountable ownership, and require a documented review before restoring access.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
