What's changed: Added per-section figures (cert-figure-retrofit). New SC-500 Chapter 3 (Domain 3 "Secure compute": AI security = SharePoint overexposure/Purview DSPM for AI/Copilot Studio real-time protection/Entra Agent ID-conditional access/Defender XDR blast radius/APIM AI Gateway-Foundry guardrails/Defender for AI-Data and AI dashboard; servers/VMs = Bastion-JIT/disk encryption-trusted launch/Defender for Servers-agentless/Azure Arc/Machine Configuration; app platform = Defender for Containers/ACR-AKS/App Service-Functions-Logic Apps/WAF-API Management)
3.1Securing AI solutions
The area SC-500 expands most beyond AZ-500. Learn to identify data overexposure in SharePoint, assess Copilot/AI-app risk with Microsoft Purview DSPM, apply real-time protection to Copilot Studio agents, use conditional access and blast-radius analysis for Microsoft Entra Agent ID, configure the AI Gateway and guardrails in Microsoft Foundry, and use Defender for AI and the Data and AI security dashboard in Defender for Cloud.
Generative AI and agents (AI that autonomously calls tools to act) introduce new attack surface. Because AI can access large amounts of data, there is a risk of "pulling data a user should not see via Copilot (overexposure)," plus prompt injection (malicious input hijacking instructions) and agents autonomously taking wrong actions. SC-500 asks how to identify, protect, and monitor these across Microsoft’s services.
3.1.1Data overexposure and Purview DSPM
Microsoft 365 Copilot generates answers across content the user has access to. So if SharePoint/OneDrive sites or files are shared too broadly, Copilot may summarize and expose them. The starting point is identifying SharePoint overexposure and using Microsoft Purview DSPM (Data Security Posture Management for AI) to visualize sensitive-data risk handled by Copilot and AI apps. DSPM for AI shows how sensitive data is used in AI interactions, driving remediation via labeling, access review, and DLP.
3.1.2Real-time protection for Copilot Studio agents
For custom agents built in Copilot Studio, enable real-time protection to detect and block runtime risks such as prompt injection, sensitive-data leakage, and harmful responses. The key is that this protects while the agent is running, not just at design time.
3.1.3Entra Agent ID—agent identity and blast radius
Because agents act autonomously, they must be governed with identities like humans. Microsoft Entra Agent ID gives agents an identity and applies conditional access to control "which agent, under what conditions, can access what." If an agent is compromised, analyze how far the impact spreads (blast radius) with Microsoft Defender XDR and minimize/disable access. Continuously inventory and manage agent identities and access.
3.1.4AI Gateway and guardrails in Microsoft Foundry
For Microsoft Foundry (building generative AI apps on Azure), place the AI Gateway in Azure API Management to centrally authenticate, rate-limit, monitor, and manage token consumption for model access (hiding backend model keys and governing usage). Additionally configure guardrails (agent security) in Foundry to apply prompt shields, harmful-content filtering, and output restrictions. Runtime threat protection is handled by Defender for AI (next).
3.1.5Defender for AI and the Data and AI security dashboard
Enabling Defender for AI Service (a Cloud Workload Protection plan) in Microsoft Defender for Cloud detects and alerts on runtime threats to AI workloads (prompt-injection attempts, credential misuse, sensitive-data exfiltration, etc.). Monitor the big picture via the Data and AI security dashboard in Defender for Cloud. On the M365 side, manage agents in the Microsoft 365 admin center to govern the agents used across the organization.
| Risk/goal | Feature | Key point |
|---|---|---|
| Sensitive-data overexposure via Copilot | Identify SharePoint overexposure / Purview DSPM for AI | Remediate sharing scope, labels/DLP |
| Runtime risk of custom agents | Copilot Studio real-time protection | Block injection/leak/harmful responses |
| Govern agent access | Entra Agent ID + conditional access | Give agents identity and least privilege |
| Understand compromise impact | Blast-radius analysis in Defender XDR | See spread and revoke access |
| Govern Foundry model access | AI Gateway in APIM + Foundry guardrails | Auth/rate/token mgmt + prompt shields |
| Runtime threats to AI workloads | Defender for AI + Data and AI dashboard | A workload-protection plan; central monitoring |
Watch the mix-ups: (1) Purview DSPM for AI (proactive posture: overexposure/sensitive-data use) vs Defender for AI (runtime threat detection for AI workloads). (2) Copilot Studio real-time protection (runtime protection of custom agents) vs Entra Agent ID (agent identity and access governance). (3) AI Gateway (centralized model-access control in APIM) vs Foundry guardrails (safety filters on the model/agent side).
Common: AI-security requirement → feature. E.g., "identify oversharing so Copilot does not expose sensitive data" = SharePoint overexposure / Purview DSPM; "apply conditional access to an agent" = Entra Agent ID; "understand a compromised agent’s impact" = Defender XDR blast radius; "centrally authenticate/rate-limit Foundry model access" = AI Gateway in APIM; "detect runtime threats to AI workloads" = Defender for AI.
3.1.6Section summary
- AI-specific risks = overexposure, prompt injection, agents autonomously misbehaving
- Proactive posture: identify SharePoint overexposure + Purview DSPM for AI. Runtime: Copilot Studio real-time protection, Defender for AI
- Agent governance: Entra Agent ID + conditional access, Defender XDR blast radius. Foundry: AI Gateway in APIM + guardrails
Sign in to track progress — Log in.
Quick check
(just a quick review)Q1. Which visualizes sensitive-data risk handled by Copilot and AI apps so Microsoft 365 Copilot does not overexpose data?
Q2. Which Microsoft capability gives autonomous AI agents an identity and governs their access with conditional access?
Q3. Which is used to analyze how far a compromised AI agent’s impact spreads (blast radius)?
Q4. Which centrally authenticates, rate-limits, and manages tokens for access to Microsoft Foundry models while hiding backend keys?
Q5. Which Defender for Cloud plan detects and alerts on runtime threats to AI workloads (prompt-injection attempts, sensitive-data exfiltration, etc.)?
Q6. For a custom agent built in Copilot Studio, what do you enable to detect and block prompt injection and sensitive-data leakage at runtime?