Threat detection for Microsoft Agent 365 agents
Microsoft Defender analyzes runtime signals from agent interactions, tool usage, and execution patterns to surface alerts in Microsoft Defender XDR. Detection uses observability data from Microsoft Copilot Studio, Microsoft Foundry, Microsoft 365 Copilot Agent Builder, and agents integrated through the Microsoft Agent 365 SDK. Analysts can investigate alerts through incidents and advanced hunting. For more information, see Detect and investigate threats to AI agents using Microsoft Defender.
Terms in this update
This is in the weekly digest for week 40 · What changed this week? →
More Defender XDR updates
Identity Security dashboard and Coverage & Maturity
Integrated Security Operations Center (ISOC) in Microsoft Defender
AI agent posture risk in Microsoft Defender
Real-time protection for Microsoft Agent 365 tooling servers
The Domain investigation page allows you to investigate an Active Directory domain
Entity enrichments with threat intelligence**: Entity pages for IP addresses, domains, URLs, and files now include a
Text by Microsoft, from Microsoft's documentation. Features and dates may change. Terms and the timeline are added by 365Fanatic.
