Category: AI Governance

AI Governance, AI Security, azure, Microsoft Certification, SC-500, security

Identify risks related to Microsoft Copilot and AI apps by using Microsoft Purview Data Security Posture Management (DSPM) (SC-500 Exam Prep)

 
This post is a part of the "SC-500: Implementing End-to-End Security Controls for Cloud and AI Workloads" Exam Prep Hub.
This topic falls under these sections:
Secure compute (20–25%)
   --> Implement security for AI
      --> Identify risks related to Microsoft Copilot and AI apps by using Microsoft Purview Data Security Posture Management (DSPM)

Note that there are 10 practice questions (with answers) at the end of each section to help you solidify your knowledge of the material. Also, there are 4 practice tests with 30 questions each available from the hub's main page below the exam topics section.

Introduction

This topic focuses on using Microsoft Purview Data Security Posture Management (DSPM) to identify risks associated with Microsoft Copilot and other AI applications.

You should understand how to:

  • Discover which AI applications are being used.
  • Identify sensitive information involved in AI interactions.
  • Detect potential data exposure and oversharing.
  • Review prompts, responses, and referenced content when permitted.
  • Use DSPM insights and recommendations to prioritize security controls.
  • Understand the relationship between DSPM, Microsoft Purview, Microsoft Defender, and Microsoft 365 security controls.

Why AI-related data risks matter

Generative AI applications can make sensitive information easier to discover, summarize, combine, and distribute. A user might ask Copilot to summarize documents, analyze business information, or answer questions using organizational data. If the underlying data is incorrectly shared or insufficiently protected, AI can amplify the exposure by making that information easier to retrieve and use.

Microsoft 365 Copilot is designed to respect existing user permissions. Therefore, many Copilot data-exposure risks are not caused by Copilot bypassing permissions. Instead, they occur because users already have access to information that is too broadly shared, improperly classified, stale, or insufficiently governed.

Microsoft Purview DSPM helps organizations understand these risks by bringing together information about data, users, AI interactions, sensitive information, and existing security controls. It provides analytics, trends, recommendations, and guided actions that help security and compliance teams improve their data security posture.

What is Microsoft Purview DSPM?

Microsoft Purview Data Security Posture Management is a centralized capability for discovering, assessing, and managing data security risks across an organization.

DSPM can help organizations:

  1. Understand where sensitive data exists.
  2. Identify how data is accessed and used.
  3. Detect potential oversharing and exposure.
  4. Identify risky AI interactions.
  5. Review recommendations for improving protection.
  6. Connect findings to Microsoft Purview security and compliance controls.

DSPM for AI provides visibility into AI-related risks, including sensitive data in prompts and responses, risky AI usage, and interactions involving enterprise or third-party AI applications. Microsoft Purview also provides related capabilities through auditing, data classification, sensitivity labels, Data Loss Prevention, Insider Risk Management, and eDiscovery.

Microsoft documentation now distinguishes between the current Data Security Posture Management experience and the earlier DSPM for AI (classic) experience. The current DSPM experience provides broader data-security workflows, while some older one-click policies and documentation may still use the “DSPM for AI” terminology.

Important AI-related risks

1. Overshared data

Oversharing occurs when sensitive information is accessible to more users than necessary.

Examples include:

  • A confidential SharePoint site accessible to all employees.
  • A document shared through an “Anyone” link.
  • A sensitive file available through a broad Microsoft 365 group.
  • A former project site that still contains confidential information.
  • A document with unique permissions that were never reviewed.
  • A file that lacks an appropriate sensitivity label.

When Copilot or an agent can access data through a user’s existing permissions, overshared information may become easier to discover in AI-generated responses. DSPM and related SharePoint governance reports help identify these conditions.

2. Sensitive information in prompts and responses

Users may enter sensitive information into AI applications, such as:

  • Customer information.
  • Financial data.
  • Employee records.
  • Intellectual property.
  • Credentials or secrets.
  • Health-related information.
  • Legal or regulatory information.
  • Confidential source code.

Microsoft Purview data classification can use sensitive information types and trainable classifiers to identify sensitive data in AI prompts and responses. These findings can appear in Microsoft Purview reports and Activity Explorer.

3. Risky AI usage

Risky AI usage can include:

  • Attempted prompt injection.
  • Attempts to access protected material.
  • Use of AI to expose confidential information.
  • Unusual or potentially malicious AI activity.
  • Inappropriate use of AI applications.
  • Copying sensitive organizational data into an unapproved AI service.

Microsoft Purview Insider Risk Management can use AI-related signals to help identify potentially risky behavior. For example, the risky AI usage policy template can detect activities such as prompt injection attempts and attempts to access protected materials.

4. Use of unapproved third-party AI applications

Employees may use public AI websites without organizational approval. Examples include consumer versions of ChatGPT, Google Gemini, or other generative AI services.

These applications can create risks when users:

  • Paste sensitive business information into prompts.
  • Upload confidential files.
  • Use organizational data in an application without approved controls.
  • Circumvent organizational AI policies.
  • Use an AI service that does not meet organizational compliance requirements.

Microsoft Purview supports visibility into certain third-party AI interactions. Network-based data security capabilities can help audit prompts and responses through supported Secure Access Service Edge or Security Service Edge integrations. The Microsoft Purview browser extension and onboarded devices may also be required for particular discovery and endpoint DLP scenarios.

Microsoft Purview DSPM capabilities for AI

AI activity discovery

DSPM helps organizations understand which AI applications are being used and how users interact with them.

Depending on the application and configuration, organizations may be able to identify:

  • The AI application involved.
  • The user or activity associated with an interaction.
  • The presence of sensitive information.
  • Risk indicators.
  • Related prompts and responses.
  • Referenced files or data sources.
  • Potentially unethical or inappropriate interactions.

The level of detail available depends on the application, licensing, permissions, collection policies, and supported integration.

Sensitive-data insights

DSPM can use Microsoft Purview classification capabilities to identify sensitive information in AI interactions.

Classification may be based on:

  • Sensitive information types.
  • Trainable classifiers.
  • Existing sensitivity labels.
  • Other Microsoft Purview classification signals.

These insights help security teams determine whether users are submitting or receiving information that requires additional protection.

Risk assessments and recommendations

DSPM provides data risk assessments and recommendations that help organizations identify security weaknesses and determine appropriate next steps.

Examples of recommendations may include:

  • Protecting sensitive data with sensitivity labels.
  • Reviewing overshared SharePoint content.
  • Capturing AI interactions for investigation or compliance.
  • Creating DLP policies.
  • Creating Insider Risk Management policies.
  • Reviewing risky users or activities.
  • Restricting access to sensitive content.

DSPM is not simply a reporting dashboard. Its purpose is to help transform data-discovery findings into practical security and compliance actions.

How to access DSPM

The current Microsoft Purview experience provides DSPM functionality through the Microsoft Purview portal.

A typical workflow is:

  1. Sign in to the Microsoft Purview portal.
  2. Open Data Security Posture Management.
  3. Review the available security objectives, dashboards, assessments, and recommendations.
  4. Select the relevant AI or data-risk area.
  5. Review the affected applications, users, data, or activities.
  6. Drill into details using available reports or Activity Explorer.
  7. Apply or configure the recommended security controls.

Some older documentation refers to:

Microsoft Purview portal → Solutions → DSPM for AI (classic)

The exact navigation and available capabilities may vary as Microsoft transitions functionality from the classic experience to the current DSPM experience.

Recommended setup tasks

Before DSPM can provide meaningful insights, several prerequisites and setup tasks may be required.

Activate Microsoft Purview Audit

Auditing provides visibility into activities that occur in supported Microsoft services and applications. In many new tenants, auditing is already enabled, but administrators should verify that it is available and configured appropriately.

Configure AI interaction collection

Some AI investigations require collection policies to capture prompts and responses.

For example, Microsoft Purview provides one-click policies for capturing interactions from supported Copilot experiences and enterprise AI applications. These policies allow the interactions to be analyzed by supported Purview solutions such as DSPM, eDiscovery, Data Lifecycle Management, and compliance workflows.

Configure sensitive-data discovery

Organizations can extend insights into sensitive data shared with AI applications by configuring the appropriate data-classification and network-based discovery capabilities.

Onboard devices when required

Device onboarding may be required for scenarios such as:

  • Discovering sensitive information shared with third-party AI sites.
  • Applying endpoint DLP policies.
  • Detecting users who paste sensitive information into public AI applications.

Configure sensitivity labels

Sensitivity labels help classify and protect files, emails, and other supported content. Labels can provide protection even when content is moved or downloaded, depending on the configured label settings.

Configure pay-as-you-go billing when required

Some DSPM and AI-related data storage or processing capabilities require pay-as-you-go billing. The applicable requirements depend on the specific feature and configuration.

Reviewing AI risk dashboards

DSPM for AI can provide reports and dashboards that help security teams identify patterns such as:

  • Total AI interactions over time.
  • Sensitive interactions by AI application.
  • Risky AI usage.
  • Potentially unethical interactions.
  • Insider Risk severity.
  • AI applications associated with sensitive data.
  • Activities involving protected material.

Security teams can select View details or similar drill-down options to inspect individual activities in Activity Explorer. The ability to view prompts, responses, and referenced files is controlled by Microsoft Purview permissions and role groups. For example, viewing content details may require membership in an appropriate Content Explorer or related role group.

Why activity-level investigation matters

A dashboard may show that sensitive AI interactions are increasing, but it may not explain:

  • Which application is involved.
  • Which users are involved.
  • What type of sensitive data was used.
  • Whether the activity was accidental or intentional.
  • Whether a policy violation occurred.
  • Which control should be applied.

Activity-level investigation provides the context needed to determine whether the issue requires:

  • User education.
  • A sensitivity label.
  • A DLP policy.
  • An Insider Risk Management policy.
  • Access remediation.
  • An investigation.
  • A change to the approved AI application list.

Relationship between DSPM and other Microsoft Purview capabilities

DSPM is not a replacement for all other security and compliance solutions. It provides visibility and recommendations while working with other Microsoft Purview capabilities.

CapabilityPrimary purpose in AI risk management
DSPMDiscover and assess data-security risks and provide recommendations
Microsoft Purview AuditRecord and investigate supported AI and user activities
Data classificationIdentify sensitive information in supported content and interactions
Sensitivity labelsClassify and protect sensitive content
Data Loss PreventionDetect, warn, or block inappropriate sharing of sensitive data
Insider Risk ManagementIdentify potentially risky user behavior
Communication ComplianceDetect inappropriate or policy-violating communications
eDiscoverySearch and preserve supported AI interaction content for investigations or legal matters
Data Lifecycle ManagementRetain or delete content according to organizational requirements

For example, DSPM might identify that users are frequently submitting sensitive information to an AI application. A security team could then use the finding to create a DLP policy, configure an Insider Risk Management policy, or improve sensitivity-label coverage.

Microsoft Copilot and permission-based access

Microsoft 365 Copilot uses the permissions available to the user. This means that an organization should not assume that deploying Copilot automatically creates a new permission model or bypasses SharePoint and Microsoft 365 access controls.

However, existing permissions may be too broad.

For example:

  • A user may belong to a large group that has access to a confidential site.
  • A document may be shared with everyone in the organization.
  • A file may be available through an overly broad sharing link.
  • A site may contain outdated information that is still accessible.
  • A sensitive document may not have an appropriate label or protection.

In these cases, Copilot may make the information more discoverable, but the underlying problem is usually the organization’s data-access or governance configuration. DSPM and SharePoint data-access governance capabilities help identify these issues.

Important distinction: DSPM versus SharePoint data-access governance

Both DSPM and SharePoint data-access governance can help identify exposure risks, but they serve different purposes.

DSPM

DSPM focuses on the broader data-security posture, including:

  • Sensitive data.
  • AI interactions.
  • Risk trends.
  • Recommendations.
  • Data exposure.
  • User and application activity.
  • AI-related security objectives.

SharePoint data-access governance

SharePoint data-access governance reports focus more directly on SharePoint and OneDrive permissions, sharing links, and access patterns.

Examples include:

  • Site permissions across the organization.
  • Site permissions for individual users.
  • Sites or files shared with everyone in the organization.
  • Sites or files shared with everyone except external users.
  • Sharing-link activity.
  • Sensitivity labels applied to files.
  • Site-access reviews.

These reports can help identify the underlying access configuration that may cause sensitive data to be exposed to Copilot or other authorized users.

Recommended process for identifying AI-related data risks

Step 1: Identify approved AI applications

Create an inventory of:

  • Microsoft 365 Copilot.
  • Microsoft Copilot Studio agents.
  • Microsoft Security Copilot.
  • Enterprise AI applications.
  • AI applications connected through Microsoft Entra.
  • AI applications built with Microsoft Foundry.
  • Approved third-party AI applications.
  • Unapproved or consumer AI applications.

This inventory helps distinguish expected business use from potentially unauthorized AI usage.

Step 2: Identify sensitive data

Review the organization’s use of:

  • Sensitive information types.
  • Sensitivity labels.
  • Trainable classifiers.
  • Confidentiality classifications.
  • DLP policies.
  • Data-retention requirements.

AI-risk detection is more effective when sensitive data has already been classified consistently.

Step 3: Configure the required collection and auditing

Verify that:

  • Microsoft Purview Audit is enabled.
  • Required AI interaction collection policies are configured.
  • Devices are onboarded where required.
  • Network integrations are configured for supported third-party AI scenarios.
  • Required licensing and billing prerequisites are satisfied.

Step 4: Review DSPM dashboards and recommendations

Look for:

  • Sensitive AI interactions.
  • Risky AI usage.
  • High-risk applications.
  • Repeated policy violations.
  • Users interacting with sensitive data.
  • AI activities involving protected material.
  • Recommendations for improving security posture.

Step 5: Investigate individual activities

Use available drill-down capabilities to determine:

  • Which user performed the activity.
  • Which AI application was used.
  • What data was involved.
  • Whether the data was sensitive.
  • Whether the activity was permitted.
  • Whether the activity was accidental or suspicious.
  • Which policy or control should be applied.

Step 6: Remediate the underlying risk

Possible actions include:

  • Applying or improving sensitivity labels.
  • Reducing SharePoint permissions.
  • Removing unnecessary sharing links.
  • Restricting access to sensitive sites.
  • Creating DLP policies.
  • Creating Insider Risk Management policies.
  • Blocking or restricting unapproved AI applications.
  • Educating users.
  • Archiving or deleting unnecessary content.
  • Reviewing AI agent permissions and data sources.

Step 7: Monitor continuously

AI usage and data exposure change over time. Organizations should regularly review:

  • New AI applications.
  • New agents.
  • Changes to permissions.
  • New sensitive-data findings.
  • Risk trends.
  • DLP incidents.
  • Insider Risk alerts.
  • Newly overshared content.
  • Changes in AI application usage.

Licensing and permissions considerations

The available DSPM capabilities depend on the organization’s licensing, tenant configuration, application support, and assigned administrative roles.

Some capabilities may require:

  • Microsoft Purview licensing.
  • Microsoft 365 licensing.
  • Microsoft Defender licensing.
  • Pay-as-you-go billing.
  • Appropriate Microsoft Entra or Microsoft Purview roles.
  • Device onboarding.
  • Audit configuration.
  • AI interaction collection policies.
  • Supported application integrations.

For example, some AI investigations require additional permissions before administrators can view prompt and response text or referenced files. Administrators should follow least-privilege principles and assign only the roles necessary for the investigation or compliance task.

Common exam traps

Trap 1: Assuming Copilot bypasses permissions

Copilot generally works with the permissions available to the user. The issue may be that the user already has excessive access.

Trap 2: Confusing DSPM with DLP

DSPM primarily helps discover, assess, and understand risks. DLP is used to enforce policies that can warn, block, or restrict certain data-sharing activities.

Trap 3: Confusing Audit with DSPM

Audit provides activity records. DSPM provides broader risk analysis, dashboards, assessments, and recommendations.

Trap 4: Assuming every AI application is monitored automatically

Coverage depends on the application, integration, licensing, configuration, and collection policies.

Trap 5: Assuming all prompt and response content is visible to every administrator

Viewing detailed content is controlled by permissions and role groups.

Trap 6: Treating every risk finding as proof of malicious behavior

A DSPM finding may indicate potential exposure or risky activity. It requires investigation and context before a conclusion is reached.

Trap 7: Confusing sensitivity labels with permissions

A sensitivity label can classify and protect content, but labeling alone does not necessarily replace SharePoint permissions or correct an incorrectly configured access group.

Trap 8: Ignoring third-party AI applications

AI risks can exist outside Microsoft Copilot. Microsoft Purview can provide supported visibility into certain enterprise and third-party AI scenarios, but coverage is not universal.

Summary

Microsoft Purview DSPM helps organizations identify and manage risks associated with Microsoft Copilot and other AI applications.

The most important concepts are:

  • AI can amplify existing data oversharing.
  • Microsoft 365 Copilot generally respects existing permissions.
  • DSPM provides centralized visibility into data-security risks.
  • DSPM for AI can identify sensitive AI interactions and risky usage.
  • Microsoft Purview Audit provides activity records.
  • Data classification identifies sensitive information.
  • Sensitivity labels classify and protect content.
  • DLP can enforce data-sharing restrictions.
  • Insider Risk Management helps identify potentially risky behavior.
  • Activity Explorer supports detailed investigation when the administrator has the required permissions.
  • AI-risk monitoring requires appropriate configuration, licensing, and collection policies.
  • DSPM findings should lead to investigation, remediation, and continuous monitoring.

Practice Exam Questions

Question 1

An organization wants to identify whether users are submitting sensitive information to Microsoft Copilot and other supported AI applications. Which Microsoft Purview capability is the best starting point?

A. Microsoft Purview Data Lifecycle Management
B. Microsoft Purview Communication Compliance
C. Microsoft Purview Records Management
D. Microsoft Purview Data Security Posture Management

Answer: D

Explanation: Microsoft Purview DSPM provides dashboards, assessments, and recommendations for identifying data-security risks, including sensitive information involved in AI interactions. Data Lifecycle Management focuses on retention and deletion, while Communication Compliance focuses primarily on inappropriate communications.

Question 2

A user asks Microsoft 365 Copilot to summarize a confidential document. The user can access the document because it is shared with a large Microsoft 365 group. What is the most likely underlying security issue?

A. Copilot has bypassed SharePoint permissions.
B. Copilot has trained its model on the document.
C. Copilot has disabled the document’s sensitivity label.
D. The document may be overshared through existing permissions.

Answer: D

Explanation: Microsoft 365 Copilot generally respects the user’s existing permissions. The likely problem is that the document is accessible to more users than necessary through the group’s permissions.

Question 3

An administrator needs to investigate individual AI activities and, where authorized, view the prompts, responses, and referenced files. Which capability should the administrator use?

A. Activity Explorer in Microsoft Purview
B. Azure Resource Graph
C. Azure Policy compliance results
D. Microsoft Defender for Containers

Answer: A

Explanation: Activity Explorer can provide detailed information about supported AI activities. Viewing prompt, response, and referenced-file content requires the appropriate Microsoft Purview permissions and role-group membership.

Question 4

Which Microsoft Purview capability is primarily responsible for identifying sensitive information in AI prompts and responses?

A. Microsoft Purview eDiscovery
B. Microsoft Purview Data Lifecycle Management
C. Microsoft Purview data classification
D. Microsoft Purview resource locks

Answer: C

Explanation: Data classification uses sensitive information types, trainable classifiers, and other classification mechanisms to identify sensitive information in supported AI interactions.

Question 5

An organization wants to capture supported Copilot prompts and responses so they can be analyzed for security and compliance purposes. What should the organization configure?

A. An Azure subscription lock
B. A Microsoft Entra access package
C. A network security group
D. An appropriate Microsoft Purview AI interaction collection policy

Answer: D

Explanation: Some AI interaction scenarios require collection policies to capture prompts and responses. The collected information can then be used by supported Purview solutions for investigation, compliance, and risk analysis.

Question 6

A security team wants to detect potentially risky behavior such as prompt injection attempts and attempts to access protected material. Which Microsoft Purview capability is most relevant?

A. Data Lifecycle Management
B. Insider Risk Management
C. Records Management
D. Information Barriers only

Answer: B

Explanation: Microsoft Purview Insider Risk Management can use AI-related signals and a risky AI usage policy template to help identify potentially risky or suspicious user behavior.

Question 7

Which statement best describes the relationship between DSPM and Data Loss Prevention?

A. DSPM replaces all DLP policies.
B. DLP identifies all AI applications, while DSPM blocks them.
C. DSPM helps identify risks and recommend actions, while DLP can enforce data-sharing controls.
D. DSPM and DLP are identical capabilities with different names.

Answer: C

Explanation: DSPM provides visibility, assessments, analytics, and recommendations. DLP is used to detect, warn about, or block certain activities involving sensitive information.

Question 8

An organization wants to investigate whether employees are using consumer AI websites and submitting sensitive company information. Which combination may be required for supported third-party AI scenarios?

A. Microsoft Purview capabilities, appropriate collection or network integration, and device onboarding where required
B. Azure Bastion and Azure Firewall only
C. Azure Backup and resource locks
D. Microsoft Defender for Containers and Azure Kubernetes Service

Answer: A

Explanation: Visibility into third-party AI usage depends on supported integrations and configuration. Some scenarios require network-based discovery, the Microsoft Purview browser extension, and onboarded devices.

Question 9

An administrator sees an increase in sensitive AI interactions in a DSPM dashboard. What should the administrator do next?

A. Immediately delete all AI applications.
B. Investigate the detailed activities and determine the appropriate remediation.
C. Disable Microsoft Entra ID for all users.
D. Remove all sensitivity labels.

Answer: B

Explanation: A dashboard finding is an indicator of potential risk, not necessarily proof of malicious activity. The administrator should investigate the affected users, applications, data, and circumstances before selecting a remediation.

Question 10

Which statement about viewing AI prompts and responses in Microsoft Purview is correct?

A. Every Microsoft 365 administrator can automatically view all prompt and response content.
B. Prompt and response content is always publicly visible to all security analysts.
C. Prompt and response content can be viewed only by the AI application owner.
D. Access to detailed content is controlled by Microsoft Purview permissions and applicable role groups.

Answer: D

Explanation: Detailed AI interaction content is protected by role-based access controls. Administrators need the appropriate permissions and role-group membership to view prompts, responses, and referenced files where supported.

Go to the SC-500 Exam Prep Hub main page

AI Governance, AI Security, azure, Microsoft Certification, SC-500, security

Analyze blast radius for security risks related to Entra Agent ID by using Defender XDR (SC-500 Exam Prep)

 
This post is a part of the "SC-500: Implementing End-to-End Security Controls for Cloud and AI Workloads" Exam Prep Hub.
This topic falls under these sections:
Secure compute (20–25%)
   --> Implement security for AI
      --> Analyze blast radius for security risks related to Entra Agent ID by using Defender XDR

Note that there are 10 practice questions (with answers) at the end of each section to help you solidify your knowledge of the material. Also, there are 4 practice tests with 30 questions each available from the hub's main page below the exam topics section.

Overview

AI agents can access data, invoke tools, call APIs, and perform actions across an organization. If an agent identity is compromised, the impact may extend far beyond the agent itself.

For example, an agent might have permission to:

  • Read confidential documents.
  • Access a customer database.
  • Modify records in a business application.
  • Call privileged APIs.
  • Access other identities or resources.
  • Use knowledge sources containing sensitive information.

The blast radius of an agent represents the potential impact of compromising that agent identity. It helps security teams understand what an attacker might be able to reach or control by abusing the agent’s permissions, connected resources, and relationships.

Microsoft Defender XDR provides an AI agent inventory, posture-risk information, and attack-path analysis to help security teams discover agents and assess the consequences of a compromised agent identity.

What Is Microsoft Entra Agent ID?

Microsoft Entra Agent ID provides identity capabilities for AI agents. Instead of treating every agent as an unidentified application process, an organization can represent an agent with a distinct identity that can be:

  • Authenticated.
  • Assigned permissions.
  • Governed.
  • Monitored.
  • Investigated.
  • Disabled or remediated when risky.

An agent identity should be treated as a security principal with a defined owner, purpose, permission set, and lifecycle.

This is important because an AI agent may have more effective access than its name or user interface suggests. The agent’s actual risk depends on what it can access and what actions it can perform—not merely on what the agent was designed to do.

What Is Blast Radius?

The blast radius is the set of resources, identities, applications, data, and systems that could potentially be affected if an agent identity were compromised.

A blast-radius assessment asks questions such as:

  • What permissions does the agent have?
  • Which applications and APIs can it access?
  • Which data sources are available to it?
  • Can it read or modify sensitive data?
  • Can it invoke tools that perform destructive actions?
  • Can it access privileged business systems?
  • Can it reach other identities or resources through existing relationships?
  • Are there attack paths from the agent to critical assets?

Example

Suppose an AI agent has:

  • Read access to a document repository.
  • Write access to a purchasing application.
  • Permission to call an external API.
  • Access to a knowledge source containing confidential business information.

If the agent is compromised, the attacker might be able to:

  1. Read confidential documents.
  2. Extract sensitive information.
  3. Submit unauthorized purchasing requests.
  4. Use the external API to transfer data.
  5. Reach additional resources through the agent’s permissions.

The agent’s blast radius is therefore larger than the agent itself.

Why AI Agents Create Unique Blast-Radius Risks

AI agents introduce additional risk because they can dynamically determine which tools to use and which actions to perform.

Traditional applications often follow fixed workflows. Agents may instead:

  • Interpret natural-language instructions.
  • Retrieve information from multiple sources.
  • Select tools dynamically.
  • Chain several actions together.
  • Act autonomously.
  • Use permissions inherited from a user or application.
  • Operate without continuous human approval.

A compromised or manipulated agent may therefore use legitimate permissions in unintended ways.

Important AI-related risks include:

  • Over-privileged agent identities.
  • Excessive access to sensitive data.
  • Unrestricted tool invocation.
  • Indirect prompt injection.
  • Weak or missing authentication.
  • Agents that can operate without human approval.
  • Privileged access to business systems.
  • Active threats or alerts associated with the agent.

Microsoft Defender assesses agent posture using risk indicators derived from configuration, permissions, tools, runtime activity, settings, and associated security alerts.

Microsoft Defender XDR AI Agent Inventory

Microsoft Defender XDR provides a centralized inventory of AI agents in the organization.

Depending on the available integrations and supported platforms, the inventory can include agents built with:

  • Microsoft Copilot Studio.
  • Microsoft Foundry.
  • Microsoft 365.
  • Supported non-Microsoft platforms.
  • Local AI agents discovered on endpoint devices.

The inventory can provide information about:

  • Agent identity.
  • Agent type.
  • Agent configuration.
  • Connected tools.
  • Knowledge sources.
  • Risk level.
  • Risk indicators.
  • Security recommendations.
  • Related alerts.
  • Security context.

To review agents in the Microsoft Defender portal, navigate to:

Assets → AI agents → Agents

The exact portal experience may change as Microsoft’s AI security capabilities evolve.

Agent Risk Level Versus Blast Radius

These concepts are related but are not identical.

Agent risk level

The risk level represents the overall security risk associated with an agent. Microsoft Defender combines active risk indicators to determine an overall risk level.

Possible risk levels include:

  • High
  • Medium
  • Low
  • No known risk
  • Not evaluated

Risk indicators may include:

  • Weak instructions.
  • Indirect prompt-injection exposure.
  • Privileged business-system access.
  • High usage.
  • Active threats.
  • Lack of human approval.
  • Access to sensitive data.

The risk level is influenced by both the severity and combination of active indicators.

Blast radius

Blast radius focuses on the potential impact if the agent is compromised.

An agent could have a high blast radius even if no active threat has been detected. For example, an agent may be operating as designed but have broad permissions to critical systems.

Conversely, an agent may have a low blast radius but still be actively compromised.

Therefore:

Risk level describes the likelihood and seriousness of the agent’s security exposure. Blast radius describes what could be affected if the agent were compromised.

Security teams should evaluate both.

Key Risk Indicators

Microsoft Defender uses risk indicators to provide context about an agent’s exposure.

Privileged business-system access

This indicates that an agent has write access to important business systems.

Examples include:

  • Creating or modifying financial transactions.
  • Changing customer records.
  • Updating inventory.
  • Modifying business-critical configurations.
  • Accessing administrative APIs.

An agent with write access generally has a greater blast radius than an agent with read-only access.

Indirect prompt-injection exposure

An agent may retrieve content containing hidden instructions from:

  • Email.
  • Documents.
  • Web pages.
  • Knowledge bases.
  • External data sources.

The content may attempt to manipulate the agent into performing unintended actions.

This risk is especially important when the agent can access sensitive data or invoke powerful tools.

Weak instructions

Weak or incomplete instructions may fail to establish safe operating boundaries for the agent.

For example, an agent may not be clearly instructed to:

  • Refuse unauthorized requests.
  • Avoid exposing secrets.
  • Request approval before destructive actions.
  • Validate tool parameters.
  • Restrict access to approved resources.

High-usage agent

An agent used by many people may be important to business operations. A compromise could affect a large number of users or business processes.

High usage does not necessarily mean the agent is insecure, but it increases the importance of careful review.

Active threat

An active threat indicator means that security alerts are associated with the agent.

An agent with both an active threat and privileged access should receive immediate attention because the likelihood and potential impact of compromise may both be significant.

Understanding Attack Paths

An attack path is a possible sequence of relationships or permissions that could allow an attacker to move from a compromised entity to a target resource.

For an agent, an attack path might look like:

Compromised agent identity → application permission → sensitive database → confidential data

Another example could be:

Compromised agent → privileged API → business application → administrative action

Attack-path analysis helps identify indirect exposure that may not be obvious when reviewing the agent’s permissions individually.

A single permission may appear harmless, but a sequence of permissions and relationships may create a significant route to a critical asset.

Microsoft Defender graphs use nodes and edges to represent entities and relationships. Attack-path analysis can show potential routes between a source entity and a target asset.

How to Analyze an Agent’s Blast Radius

Step 1: Discover the agent

Open the Microsoft Defender portal and review the AI agent inventory.

Identify:

  • The agent name.
  • The agent type.
  • Its associated identity.
  • Its owner.
  • Its environment.
  • Its connected tools.
  • Its knowledge sources.
  • Its risk level.

The inventory is the starting point for understanding which agents exist and which require further investigation.

Step 2: Review the agent’s configuration

Examine how the agent is configured.

Important questions include:

  • Is the agent autonomous?
  • Does it act on behalf of a user?
  • Can it operate without human approval?
  • Which tools can it invoke?
  • Which applications can it access?
  • Does it have write or administrative capabilities?
  • Does it use external services?
  • Does it retrieve content from untrusted sources?

Configuration weaknesses can increase the likelihood that an agent will be manipulated or misused.

Step 3: Review permissions and identities

Determine the permissions assigned to the agent identity.

Review:

  • Microsoft Entra roles.
  • Application permissions.
  • Delegated permissions.
  • API scopes.
  • Resource access.
  • Group memberships.
  • Access packages.
  • Privileged assignments.
  • Permissions inherited through applications or users.

The goal is to determine what the agent can actually do, not merely what it is intended to do.

Step 4: Review knowledge sources

Knowledge sources can significantly increase an agent’s blast radius.

Review whether the agent can access:

  • Confidential documents.
  • Customer information.
  • Financial data.
  • Internal policies.
  • Credentials or secrets.
  • Sensitive databases.
  • External content.
  • Data belonging to multiple departments.

An agent with read access to a broad knowledge source may expose more information than expected, even if it cannot modify the underlying data.

Step 5: Review connected tools

Tools determine what actions the agent can perform.

Examples include tools that:

  • Query databases.
  • Send email.
  • Create support tickets.
  • Modify records.
  • Call external APIs.
  • Execute workflows.
  • Access storage.
  • Provision resources.

A tool with write, delete, or administrative capability can substantially increase the agent’s potential impact.

Step 6: Review blueprint configuration

Agent identity blueprints can provide a consistent way to create and manage agent identities.

Review blueprint configuration to determine whether it establishes:

  • Appropriate identity settings.
  • Required governance.
  • Permission boundaries.
  • Consistent security controls.
  • Appropriate ownership.
  • Secure defaults.

A poorly configured blueprint may create multiple agents with the same excessive permissions or weak security settings.

Step 7: Review risk indicators and recommendations

Review the agent’s active risk indicators and any available security recommendations.

Risk indicators describe the agent’s exposure. Recommendations identify actionable changes that may reduce that exposure.

A high-risk agent may not always have an available recommendation, and a lower-risk agent may still have a recommendation that should be implemented. Therefore, review the risk level and recommendations together.

Step 8: Analyze attack paths

Use the available Defender graph and attack-path capabilities to investigate possible routes from the agent to sensitive resources.

Look for paths involving:

  • Privileged identities.
  • Sensitive applications.
  • Critical databases.
  • Storage accounts.
  • Administrative roles.
  • High-value business systems.
  • External access.
  • Lateral movement.

The objective is to identify not only direct access but also indirect routes that could lead to compromise of critical assets.

Step 9: Prioritize remediation

Prioritize agents that combine several high-impact characteristics, such as:

  • High risk.
  • Privileged access.
  • Access to sensitive data.
  • Autonomous operation.
  • External exposure.
  • Active security alerts.
  • Write access to critical systems.
  • Multiple attack paths to important assets.

Defender Blast-Radius Graphs

Microsoft Defender can display graph-based views of entities and potential attack paths.

A graph generally contains:

  • Nodes, representing entities or assets.
  • Edges, representing relationships or connections.
  • Paths, representing possible routes between entities.

For an incident, investigators can select an entity and choose View blast radius when the capability is available. The graph can show highly rated attack paths and a list of reachable targets. Investigators can select a target to inspect the potential path leading to it.

What the graph can help identify

The graph may reveal:

  • A compromised identity’s reachable resources.
  • Indirect paths to critical assets.
  • Relationships between identities and applications.
  • Potential lateral movement.
  • Privilege-escalation routes.
  • Access to sensitive data.
  • Connections between an agent and other entities.

Important limitations

Blast-radius graphs are an approximation of possible attack reach.

They may be limited by:

  • The number of hops analyzed.
  • Data freshness.
  • The attack techniques modeled.
  • The viewer’s RBAC scope.
  • Missing or incomplete relationships.
  • Changes in the environment that have not yet been reflected.

The graph shows possible paths. It does not guarantee that an attacker will use every path shown.

Interpreting the Blast Radius Correctly

A blast-radius graph should not be interpreted as proof that a compromise has occurred.

Instead, it answers:

“If this identity were compromised, what resources might be reachable through known relationships and permissions?”

The graph is useful for:

  • Prioritizing remediation.
  • Identifying excessive permissions.
  • Understanding lateral movement.
  • Finding critical assets exposed through an agent.
  • Supporting incident investigation.
  • Designing Conditional Access policies.
  • Improving agent architecture.

It should be combined with:

  • Actual sign-in and activity logs.
  • Security alerts.
  • Agent configuration.
  • Permission reviews.
  • Data classification.
  • Business criticality.
  • Incident-response procedures.

Example Scenario

A company deploys an autonomous finance agent.

The agent can:

  • Read invoices.
  • Query a financial database.
  • Submit payment requests.
  • Access a shared document repository.
  • Call a payment-processing API.

Defender identifies the following risk indicators:

  • Privileged business-system access.
  • Indirect prompt-injection exposure.
  • Ability to operate without human approval.
  • Access to sensitive financial data.

An attack-path analysis shows:

Agent identity → payment API → financial system

It also shows:

Agent identity → shared repository → confidential financial documents

The security team should consider:

  1. Removing unnecessary write permissions.
  2. Requiring human approval for payment actions.
  3. Restricting the agent to approved APIs.
  4. Limiting access to financial documents.
  5. Reviewing prompt-injection protections.
  6. Applying Conditional Access to high-risk agent identities.
  7. Monitoring related alerts and activity.
  8. Reassessing the blast radius after remediation.

Relationship to Conditional Access

Conditional Access and blast-radius analysis work together.

Blast-radius analysis helps answer:

  • Which agents are high impact?
  • Which agents have privileged access?
  • Which resources should be protected?
  • Which agents should be restricted or blocked?

Conditional Access can then enforce policies such as:

  • Block high-risk agent identities.
  • Restrict selected agents from sensitive applications.
  • Separate development and production agents.
  • Apply policies based on agent attributes.
  • Restrict access to selected resources.

Microsoft Entra ID Protection can detect risky agent behavior. When an agent is confirmed as compromised, its risk can be set to High, allowing a Conditional Access policy configured to block high agent risk to prevent access to resources.

Relationship to Microsoft Defender for Cloud and Microsoft Purview

Blast-radius analysis is not the same as every other security capability.

Microsoft Defender XDR

Used for:

  • AI agent inventory.
  • Agent risk assessment.
  • Identity investigation.
  • Attack-path analysis.
  • Security alerts.
  • Incident investigation.

Microsoft Defender for Cloud

Used more broadly for:

  • Cloud security posture management.
  • Workload protection.
  • Security recommendations.
  • Cloud resource security.
  • AI workload protection.

Microsoft Purview

Used for:

  • Data classification.
  • Sensitivity labels.
  • Data security posture management.
  • Data-loss prevention.
  • Compliance and information protection.

Microsoft Entra Conditional Access

Used for:

  • Evaluating access conditions.
  • Blocking risky agent identities.
  • Restricting access to selected resources.
  • Enforcing identity-based access policies.

These capabilities complement one another. No single control provides complete protection for AI agents.

Best Practices

Use dedicated agent identities

Avoid sharing a broad identity across unrelated agents. Separate identities improve accountability and reduce the impact of a single compromise.

Apply least privilege

Grant only the permissions required for the agent’s purpose.

Minimize write and administrative permissions

Read-only access generally creates a smaller blast radius than the ability to modify or delete data.

Restrict tools

Every connected tool expands the agent’s potential attack surface. Remove tools that are not required.

Use approval gates

Require human approval for:

  • Financial transactions.
  • Data deletion.
  • Permission changes.
  • External communications.
  • Production changes.
  • Other high-impact actions.

Protect knowledge sources

Limit the data available to the agent and ensure that sensitive sources are properly secured.

Separate environments

Development and test agents should not automatically have access to production resources.

Review blueprints

Ensure that agent identity blueprints do not create agents with excessive or inconsistent permissions.

Monitor active threats

An agent with active alerts and privileged access should be investigated immediately.

Reassess after changes

Recalculate or review the agent’s exposure after changing:

  • Permissions.
  • Tools.
  • Knowledge sources.
  • Identity configuration.
  • Resource access.
  • Blueprint settings.

Treat graphs as possible paths

Do not assume that every path shown is an active attack or that every possible path is displayed.

Common Exam Traps

Blast radius is not the same as risk level

Risk level describes the agent’s overall security exposure. Blast radius describes the potential impact of compromise.

An agent does not need to be compromised to have a large blast radius

An agent may be configured with excessive permissions even when no threat has been detected.

Read access and write access are different

Write access to critical business systems generally creates a greater potential impact than read-only access.

Attack paths show possibilities

A graph shows possible routes based on known relationships and data. It does not prove that an attacker has used the route.

Conditional Access does not remove permissions

Conditional Access controls whether access is allowed under specified conditions. It does not replace least-privilege authorization.

Risk indicators and recommendations are different

Risk indicators contribute to the agent’s risk assessment. Recommendations identify available actions that may improve security posture.

A high-risk agent may not have a recommendation

Risk level and available recommendations are calculated separately.

Missing graph paths do not prove that no risk exists

Graphs have scope, freshness, and modeling limitations.

Practice Exam Questions

Question 1

What does the blast radius of a Microsoft Entra agent identity primarily describe?

A. The number of users who have interacted with the agent
B. The amount of compute capacity assigned to the agent
C. The potential resources and systems affected if the agent identity is compromised
D. The number of prompts processed by the agent

Correct answer: C

Explanation: Blast radius describes the potential impact of compromising the agent, including reachable data, applications, identities, and systems.

Question 2

Which Microsoft Defender capability provides a centralized view of AI agents and their security context?

A. Azure Cost Management
B. Azure Resource Graph only
C. Microsoft Purview retention management
D. AI agent inventory

Correct answer: D

Explanation: The AI agent inventory in Microsoft Defender provides visibility into agents, configuration, identities, risk indicators, tools, and related security information.

Question 3

An agent has no active security alerts but can modify a critical financial system. What should the security team conclude?

A. The agent has no security risk
B. The agent has a potentially large blast radius even though no compromise has been detected
C. The agent must be deleted immediately
D. The agent cannot be protected by Conditional Access

Correct answer: B

Explanation: Blast radius is based on potential impact. Privileged access can create significant exposure even when no active threat has been detected.

Question 4

Which risk indicator most directly suggests that an agent can affect important business operations?

A. High usage
B. Weak instructions
C. Indirect prompt-injection exposure
D. Privileged business-system access

Correct answer: D

Explanation: Privileged business-system access indicates that the agent can write to or otherwise affect important business systems.

Question 5

What is the purpose of analyzing attack paths for an agent identity?

A. To determine the model’s response quality
B. To identify possible routes from the agent to other resources or critical assets
C. To calculate the agent’s monthly operating cost
D. To configure the agent’s natural-language instructions

Correct answer: B

Explanation: Attack-path analysis identifies possible relationships and permission chains that could allow access to additional resources or critical assets.

Question 6

Which statement best distinguishes an agent’s risk level from its blast radius?

A. Risk level measures potential impact only, while blast radius measures prompt quality
B. Risk level applies only to human users, while blast radius applies only to applications
C. Risk level reflects overall security exposure, while blast radius reflects potential impact if compromised
D. They are two names for exactly the same measurement

Correct answer: C

Explanation: Risk level combines active risk indicators. Blast radius focuses on what could be affected if the agent identity were compromised.

Question 7

A Defender blast-radius graph displays a path from an agent to a sensitive database. What does this mean?

A. The agent has definitely been compromised
B. The database has already been accessed
C. The graph identifies a possible route based on known relationships and permissions
D. The agent must be assigned a database administrator role

Correct answer: C

Explanation: A blast-radius graph shows possible attack paths. It does not prove that compromise or access has occurred.

Question 8

Which change would most directly reduce an agent’s blast radius?

A. Remove unnecessary write permissions and restrict the agent to required resources
B. Increase the agent’s model size
C. Add more knowledge sources
D. Allow the agent to use additional administrative APIs

Correct answer: A

Explanation: Reducing permissions and limiting resource access directly reduces what the agent could affect if compromised.

Question 9

Why should security teams review an agent’s knowledge sources during blast-radius analysis?

A. Knowledge sources determine the agent’s compute pricing
B. Knowledge sources may expose confidential or sensitive information to the agent
C. Knowledge sources automatically grant Global Administrator access
D. Knowledge sources eliminate the need for identity protection

Correct answer: B

Explanation: Knowledge sources may contain sensitive information. The agent’s access to those sources can significantly increase the impact of compromise or misuse.

Question 10

Which statement about Microsoft Defender blast-radius graphs is accurate?

A. They show every possible attack path with complete certainty
B. They prove that all displayed paths have been exploited
C. They replace permission reviews and incident investigation
D. They show possible paths and may be limited by data freshness, scope, and modeled attack techniques

Correct answer: D

Explanation: Blast-radius graphs are useful approximations, but they have limitations involving data freshness, RBAC scope, hop limits, and known attack vectors.

Go to the SC-500 Exam Prep Hub main page

AI Governance, AI Security, Cybersecurity, Microsoft Certification, SC-500, security

Configure and deploy AI Gateway in Azure API Management for Microsoft Foundry (SC-500 Exam Prep)

 
This post is a part of the "SC-500: Implementing End-to-End Security Controls for Cloud and AI Workloads" Exam Prep Hub.
This topic falls under these sections:
Secure compute (20–25%)
   --> Implement security for AI
      --> Configure and deploy AI Gateway in Azure API Management for Microsoft Foundry

Note that there are 10 practice questions (with answers) at the end of each section to help you solidify your knowledge of the material. Also, there are 4 practice tests with 30 questions each available from the hub's main page below the exam topics section.

Overview

Microsoft Foundry provides services for developing, deploying, and operating generative AI applications, models, and agents. As organizations adopt AI at scale, they need a controlled way to manage access to models and AI tools.

An AI Gateway uses Azure API Management to provide a governed entry point between applications or agents and AI backends. It can centralize authentication, authorization, traffic control, token usage, monitoring, routing, and security policies.

For SC-500, the important concept is that the AI Gateway is not simply another model endpoint. It is a security and governance layer placed between AI consumers and the services they access.

Exam focus: Understand how to connect Microsoft Foundry to Azure API Management, configure the gateway, import models or tools, apply policies, and verify that traffic is actually being mediated by the gateway.

What Is an AI Gateway?

An AI Gateway is a set of capabilities in Azure API Management that helps organizations manage AI-related backends.

These backends may include:

  • Models deployed in Microsoft Foundry.
  • Azure OpenAI deployments.
  • Other supported model providers.
  • OpenAI-compatible model endpoints.
  • Remote Model Context Protocol (MCP) servers.
  • Agent-to-agent APIs.
  • Custom AI services.
  • Self-hosted models and endpoints.

The AI Gateway extends the existing API Management gateway. It is not a completely separate gateway product. Existing API Management capabilities, including policies, authentication, routing, monitoring, and networking, are used to govern AI traffic.

Why use an AI Gateway?

Without a gateway, each application or agent may connect directly to an AI model or tool. This can lead to:

  • Duplicated authentication logic.
  • Inconsistent security policies.
  • Uncontrolled model consumption.
  • Difficulty enforcing quotas.
  • Limited visibility into usage.
  • Excessive exposure of backend endpoints.
  • Different teams implementing different controls.
  • Difficulty changing model providers.

An AI Gateway provides a centralized control point for these concerns.

For example, several applications might use different model deployments, but all requests can pass through API Management where the organization applies:

  • Authentication.
  • Authorization.
  • Rate limits.
  • Token quotas.
  • IP restrictions.
  • Content safety policies.
  • Request and response transformations.
  • Logging and metrics.
  • Backend routing.
  • Load balancing.
  • Caching, where appropriate.

AI Gateway Architecture

A typical architecture contains the following components:

  1. AI consumer
    • Application.
    • Copilot.
    • Agent.
    • Development tool.
    • Automated workload.
  2. Microsoft Foundry resource or project
    • Hosts or manages model deployments, agents, and tools.
  3. Azure API Management instance
    • Acts as the AI Gateway.
    • Receives requests from consumers.
    • Applies policies.
    • Routes requests to the appropriate backend.
  4. AI backend
    • Microsoft Foundry model.
    • Azure OpenAI deployment.
    • External model provider.
    • MCP server.
    • Other supported AI endpoint.
  5. Monitoring and governance services
    • API Management logs and metrics.
    • Application Insights, where configured.
    • Microsoft Foundry telemetry.
    • Security monitoring and auditing.

The gateway sits between the client and the AI backend. This allows the organization to enforce common controls without requiring every client application to implement those controls independently.

AI Gateway in Microsoft Foundry

Microsoft Foundry can be integrated with an Azure API Management instance as an AI Gateway.

This integration allows organizations to govern AI resources from within the Foundry environment while retaining access to the more advanced configuration capabilities of Azure API Management.

Depending on the supported feature and configuration, the gateway can help govern:

Models

The gateway can provide:

  • Token quotas.
  • Rate limits.
  • Authentication.
  • Routing.
  • Usage monitoring.
  • Model access control.
  • Centralized governance across model deployments.

When AI Gateway is used with Foundry, model requests can be routed through the associated API Management instance. Model limits can be configured at the project level, helping prevent one project or team from consuming all available capacity.

Agents

Agents can be registered and governed through Microsoft Foundry. Governance can include:

  • Centralized inventory.
  • Traffic policies.
  • Throttling.
  • Content safety controls.
  • Monitoring.
  • Access management.

The exact capabilities depend on the agent type and the integration being used.

Tools

MCP tools can be routed through an AI Gateway so that requests pass through a controlled endpoint.

Policies can be applied to MCP traffic, including:

  • Authentication.
  • Rate limiting.
  • IP filtering.
  • Correlation IDs.
  • Logging and metrics.
  • Routing controls.

However, the Foundry MCP gateway integration has limitations. For example, only eligible MCP tools created after the gateway is connected may be routed through the gateway. Existing tools are not automatically changed to use the gateway.

Prerequisites

Before configuring an AI Gateway for Microsoft Foundry, verify the following.

Azure API Management instance

You need an Azure API Management instance that meets the requirements for the selected integration.

Supported service tiers and networking requirements can vary depending on:

  • Whether the gateway is public or private.
  • Whether the Foundry resource has public network access disabled.
  • Whether private endpoints are required.
  • Whether advanced networking is needed.
  • Whether the organization is using the dedicated AI Gateway tier preview.

The dedicated AI Gateway tier is a public preview feature. Preview capabilities, supported regions, limits, and service behavior may change. Organizations should validate preview features carefully before using them for critical production workloads.

Required permissions

The administrator configuring the integration generally needs permission to manage the API Management instance.

For some Foundry gateway scenarios, the required role is:

  • API Management Service Contributor, or
  • Owner

The exact permissions depend on whether the administrator is connecting an existing gateway, creating an instance, importing models, or managing policies.

Networking

If the Foundry resource has public network access disabled, the API Management instance must also be able to access the private Foundry resource.

Depending on the architecture, this may require:

  • A private endpoint.
  • A supported API Management tier.
  • Virtual network integration or injection.
  • Appropriate private DNS configuration.
  • Network rules that permit the required traffic.

A gateway cannot securely mediate traffic to a private backend if the gateway itself cannot reach that backend.

Backend access

The administrator must have access to the model, deployment, or tool backend being added.

For managed identity authentication, the managed identity must also have the required permissions on the backend resource.

Creating or Associating an AI Gateway

The exact portal experience can change, but the general process is:

  1. Sign in to Microsoft Foundry.
  2. Open the appropriate Foundry administration or resource configuration area.
  3. Open the AI Gateway configuration.
  4. Select Add AI Gateway.
  5. Select the Foundry resource to associate with the gateway.
  6. Select an existing API Management instance or create one if supported.
  7. Confirm the required permissions and networking configuration.
  8. Save the association.
  9. Add or import models, agents, or eligible tools.
  10. Configure API Management policies.
  11. Test requests through the gateway.
  12. Verify telemetry and policy enforcement.

The Microsoft Foundry portal provides an integrated configuration experience, while advanced policies and networking settings are managed in Azure API Management.

Importing Models into the AI Gateway

Azure API Management can import models from supported providers, including Microsoft Foundry and Azure OpenAI.

When importing a model, the administrator typically configures:

  • The model provider.
  • The backend endpoint.
  • The model or deployment name.
  • The API format.
  • Authentication.
  • Required headers.
  • Backend routing.
  • Policies.
  • Monitoring settings.

For Microsoft Foundry deployments, the import wizard can discover deployments automatically in supported scenarios.

OpenAI-compatible APIs

Many applications are designed to use the OpenAI API format. API Management can expose supported backends through OpenAI-compatible routes.

For example, an OpenAI-compatible model endpoint may use a route similar to:

/default/models/openai/v1/chat/completions

The exact gateway URL and route depend on the API Management configuration and the provider API format.

The important exam concept is that the client can use a consistent gateway endpoint while API Management handles the connection to the underlying model backend.

Authentication Options

Authentication must be configured separately for:

  1. The client calling the gateway.
  2. The gateway calling the backend.

These are not necessarily the same authentication mechanism.

Client-to-gateway authentication

The client may authenticate to API Management using:

  • An API Management subscription key.
  • Microsoft Entra authentication.
  • OAuth.
  • Another supported API authentication method.

For example, a client may send an API Management subscription key in a header expected by the API definition or policy.

Gateway-to-backend authentication

The gateway can authenticate to AI backends using:

  • Managed identity.
  • API keys.
  • Provider-specific credentials.
  • Other supported authentication mechanisms.

Managed identity is often preferable because it avoids embedding long-lived API keys in applications or configuration files. The managed identity must have the appropriate role or permissions on the backend.

Managed identity benefits

Using managed identity can:

  • Avoid storing API keys in application code.
  • Reduce credential rotation requirements.
  • Integrate with Microsoft Entra access control.
  • Support centralized identity governance.
  • Reduce the risk of accidental credential exposure.

However, managed identity does not automatically grant access. The identity must still be authorized on the target resource.

API Management Policies

API Management policies are XML-based rules that execute in the gateway.

Policies can operate on:

  • Inbound requests.
  • Backend requests.
  • Backend responses.
  • Outbound responses.
  • Errors.

They can validate, transform, secure, route, or limit API traffic. API Management policies are different from Azure Policy. API Management policies run at API request time, while Azure Policy evaluates and governs Azure resources.

Important AI Gateway policies

Rate limiting

Rate limiting restricts the number of requests a client can make during a defined period.

Example uses include:

  • Limiting requests per application.
  • Limiting requests per user.
  • Preventing excessive tool calls.
  • Protecting backend capacity.
  • Reducing abuse.

A rate-limit-by-key policy can use a key such as:

  • Client IP address.
  • Subscription key.
  • Application identifier.
  • User identifier.
  • Custom request value.

The key should be selected carefully. IP-based limiting may be inappropriate when many users share the same outbound address.

Token quotas

AI model consumption is often measured in tokens rather than only requests.

Token quotas can help control:

  • Cost.
  • Capacity.
  • Fair usage.
  • Project-level consumption.
  • Large prompt abuse.
  • Excessive response generation.

A request-per-minute limit alone may not prevent a client from sending extremely large prompts. Token-based controls are therefore important for AI workloads.

IP filtering

IP filtering can restrict requests to trusted networks or addresses.

For example, an organization may allow gateway access only from:

  • Corporate networks.
  • Private application subnets.
  • Approved build environments.
  • Trusted automation services.

IP filtering should not be treated as a replacement for identity-based authentication. Network location alone is not sufficient to establish who is authorized to use an AI service.

Authentication and authorization

Policies can validate tokens, inspect claims, and enforce access rules.

For example, a policy may:

  • Validate a Microsoft Entra token.
  • Check the token audience.
  • Restrict access to specific application IDs.
  • Require a subscription key.
  • Reject unauthenticated requests.
  • Route different consumers to different backends.

Content safety

API Management can apply policies that integrate with Azure AI Content Safety to moderate prompts or responses.

Content safety controls may help detect or block content such as:

  • Hate.
  • Violence.
  • Sexual content.
  • Self-harm content.
  • Other unsafe material, depending on the configured policy and service capabilities.

Content safety is not a complete AI security solution. It should be combined with identity, authorization, data protection, logging, and runtime controls.

Correlation IDs

A correlation ID allows related requests to be traced across systems.

A gateway can add a unique identifier to a request so that administrators can correlate:

  • Client requests.
  • Gateway logs.
  • Backend requests.
  • Application logs.
  • Security investigations.

Correlation IDs are particularly useful when an application invokes multiple models or tools during one user interaction.

Request and response transformation

Policies can modify requests or responses, including:

  • Headers.
  • URLs.
  • Query parameters.
  • Payloads.
  • Backend routing.
  • Response formatting.

Transformations should be used carefully with AI APIs because changing required headers or payload structures can cause model or tool calls to fail.

Governing MCP Tools

The Model Context Protocol allows agents to interact with external tools and data sources.

Examples of MCP tools include:

  • Search tools.
  • File access tools.
  • Database tools.
  • Business application tools.
  • Automation tools.
  • Custom enterprise tools.

Routing MCP traffic through an AI Gateway provides a centralized point for:

  • Authentication.
  • Rate limiting.
  • IP restrictions.
  • Audit logging.
  • Routing.
  • Policy enforcement.

The gateway can apply controls without requiring changes to the MCP server or agent code.

Important MCP limitations

For the Foundry-integrated MCP gateway experience:

  • The feature is in preview.
  • Only eligible MCP tools are routed through the gateway.
  • Existing tools may not be automatically migrated.
  • Tools using managed OAuth may not be eligible for the same routing flow.
  • API Management policies are configured in Azure API Management.
  • Gateway logs may not contain complete tool-level traces.
  • MCP server logs may still be required for detailed tool investigation.

If a tool was created before the gateway was connected, it may continue to call the MCP server directly. In that situation, recreate the tool after the gateway is connected if the tool is eligible for gateway routing.

Monitoring and Observability

An AI Gateway provides a central location for monitoring AI traffic.

Useful telemetry may include:

  • Request counts.
  • Response codes.
  • Latency.
  • Backend failures.
  • Token usage.
  • Rate-limit events.
  • Authentication failures.
  • Policy violations.
  • Correlation IDs.
  • Model or backend usage.
  • Gateway errors.

Telemetry can be viewed through API Management monitoring capabilities and, where configured, Microsoft Foundry or Application Insights.

Monitoring helps answer questions such as:

  • Which applications are using a model?
  • Which projects consume the most tokens?
  • Are requests being rejected?
  • Is a backend unavailable?
  • Are clients exceeding quotas?
  • Are unusual traffic patterns occurring?
  • Are policies blocking legitimate workloads?
  • Are sensitive tools being called unexpectedly?

Gateway telemetry should be combined with application, model, agent, and backend logs because the gateway may not capture every detail of an AI interaction.

Security Design Considerations

Use a single governed entry point

Where practical, route approved AI traffic through the gateway rather than allowing every application to call model endpoints directly.

This improves consistency and visibility.

Avoid exposing backend credentials

Prefer managed identity or centrally managed credentials rather than embedding API keys in application code.

Apply least privilege

The gateway’s identity should have only the permissions required to access the configured backend.

The client should also receive only the permissions required to call the gateway APIs.

Separate environments

Use separate configurations or gateways for:

  • Development.
  • Testing.
  • Staging.
  • Production.

This helps prevent development applications from accessing production models or sensitive tools.

Apply quotas by project or consumer

Quotas should reflect business requirements. A shared global quota may allow one application to consume capacity needed by other teams.

Restrict sensitive tools

Tools that can:

  • Modify databases.
  • Send email.
  • Change permissions.
  • Deploy resources.
  • Access confidential data.
  • Execute commands.

should receive stronger controls than read-only tools.

Protect private backends

If a Foundry resource is private, ensure the gateway has appropriate private connectivity. Do not assume that associating the resources automatically solves networking requirements.

Test policies before enforcement

Use testing and staged rollout to ensure that policies do not:

  • Remove required authentication headers.
  • Break model payloads.
  • Block legitimate clients.
  • Prevent required tool calls.
  • Cause unexpected latency.
  • Interfere with streaming responses.

Example Scenario

A company has three AI applications:

  • A customer-service assistant.
  • A financial reporting application.
  • An internal research assistant.

Each application currently calls a model endpoint directly.

The security team deploys Azure API Management as an AI Gateway and configures:

  1. Microsoft Entra authentication for approved applications.
  2. Managed identity authentication from the gateway to the model backend.
  3. Separate API products or subscriptions for each application.
  4. Token quotas for each project.
  5. Rate limits to prevent excessive requests.
  6. IP restrictions for internal applications.
  7. Content safety checks.
  8. Correlation IDs for tracing.
  9. Monitoring and alerts for failures and abnormal usage.

The financial reporting application receives a lower quota but stronger access restrictions because it processes sensitive information. The research assistant is allowed to use several approved models but cannot access production business tools.

This design provides centralized security while allowing different applications to have different access and usage policies.

Common Exam Comparisons

CapabilityPrimary purpose
Azure API Management AI GatewayGovern and secure traffic to AI models, agents, and tools
Microsoft FoundryDevelop, deploy, and operate AI resources
Microsoft Entra IDAuthenticate identities and authorize access
Managed identityProvide Azure-managed authentication without embedded credentials
API Management policyApply runtime request and response controls
Azure PolicyGovern Azure resource configuration and compliance
Azure AI Content SafetyDetect or moderate unsafe content
Application InsightsMonitor application and gateway-related telemetry
Microsoft SentinelCentralize security events and investigation workflows
Agent identityRepresent an AI agent as an identity
MCP serverExpose tools or context to compatible AI clients

Exam Tips

Remember these key points:

  • An AI Gateway is implemented using Azure API Management capabilities.
  • The gateway is a control point between AI consumers and AI backends.
  • It can govern models, agents, and eligible MCP tools.
  • The gateway is not a replacement for Microsoft Entra authentication.
  • Client-to-gateway authentication and gateway-to-backend authentication are separate concerns.
  • Managed identity can reduce the need to store backend API keys.
  • API Management policies are runtime rules, not Azure Policy definitions.
  • Rate limits control request volume; token quotas control AI consumption.
  • Content safety policies address unsafe content but do not replace identity security.
  • Existing MCP tools may not automatically begin using a newly connected gateway.
  • API Management policies are configured in API Management, not necessarily in the Foundry portal.
  • Private Foundry resources require compatible private connectivity from the gateway.
  • Preview features may have changing capabilities, limits, and supported regions.
  • Monitoring should include gateway telemetry and backend or application logs.
  • Always verify that traffic actually passes through the gateway after configuration.

Practice Exam Questions

Question 1

What is the primary purpose of using Azure API Management as an AI Gateway for Microsoft Foundry?

A. To replace Microsoft Entra ID
B. To train foundation models
C. To provide a centralized point for securing, governing, and monitoring AI traffic
D. To permanently store model training data

Answer: C

Explanation: An AI Gateway provides a centralized control point between AI consumers and backends. It can enforce authentication, quotas, rate limits, routing, monitoring, and other policies. It does not replace Microsoft Entra ID or train models.

Question 2

An organization wants the AI Gateway to authenticate to a Microsoft Foundry backend without storing an API key in application code. Which option should it consider?

A. Managed identity
B. Azure resource lock
C. Public IP address filtering only
D. A storage account access key

Answer: A

Explanation: Managed identity allows the gateway to authenticate to supported Azure services without embedding long-lived credentials in application code. The identity must still be granted the required permissions on the backend.

Question 3

Which statement correctly describes Azure API Management policies?

A. They are Azure resource-compliance definitions evaluated by Azure Policy
B. They are runtime rules that can validate, transform, secure, limit, or route API requests and responses
C. They are Microsoft Entra role assignments
D. They are model-training instructions

Answer: B

Explanation: API Management policies execute in the gateway and can control inbound requests, backend requests, responses, and errors. They are different from Azure Policy, which governs Azure resource configuration.

Question 4

A company wants to prevent one Foundry project from consuming all available model capacity. Which control is most directly relevant?

A. Azure Bastion
B. Microsoft Entra access reviews
C. Token quotas
D. Azure resource locks

Answer: C

Explanation: Token quotas limit AI consumption based on token usage. They are useful for cost control, capacity management, and preventing one project from monopolizing model capacity.

Question 5

An administrator connects an AI Gateway to a Foundry resource. An MCP tool created several weeks earlier continues to call the MCP server directly. What is the most likely explanation?

A. API Management cannot govern MCP tools
B. The tool must be recreated after the gateway is connected if it is eligible for gateway routing
C. The Foundry resource must be deleted
D. The MCP server must be converted into a virtual machine

Answer: B

Explanation: In the preview Foundry MCP gateway integration, gateway routing is applied when eligible tools are created after the gateway is connected. Existing tools are not automatically migrated.

Question 6

Which control is most appropriate for restricting AI Gateway requests to approved corporate networks?

A. IP filtering
B. Token quota
C. Model fine-tuning
D. Agent blueprint inheritance

Answer: A

Explanation: IP filtering can allow or deny requests based on source IP addresses or ranges. It should supplement, not replace, identity-based authentication and authorization.

Question 7

An organization wants to trace a request from an application through API Management to the model backend. Which feature is most useful?

A. Azure resource locks
B. Correlation IDs
C. Disk encryption
D. Azure Policy remediation

Answer: B

Explanation: Correlation IDs provide a common identifier that can be recorded in gateway, application, and backend logs, making it easier to trace a request across multiple components.

Question 8

A Foundry resource has public network access disabled. What must be verified before associating it with an AI Gateway?

A. The gateway has an appropriate private network path to the Foundry resource
B. The model has been fine-tuned
C. All clients use anonymous access
D. The gateway is deployed outside Azure

Answer: A

Explanation: A private Foundry resource requires compatible private connectivity from the API Management instance. The gateway must be able to reach the backend through the required private networking configuration.

Question 9

Which statement best describes the difference between rate limiting and token quotas?

A. Rate limiting controls request volume, while token quotas control AI token consumption
B. Rate limiting authenticates users, while token quotas encrypt traffic
C. Rate limiting governs Azure resources, while token quotas manage virtual machines
D. Rate limiting disables models, while token quotas create agents

Answer: A

Explanation: Rate limiting restricts the number of requests over a period. Token quotas restrict the amount of model consumption, which is important because requests can vary greatly in prompt and response size.

Question 10

An administrator applies an API Management policy that removes a required authentication header before forwarding the request to an MCP server. What is the likely result?

A. The MCP server automatically repairs the header
B. The request is converted into a model-training job
C. The request may fail because required authentication information was removed
D. The gateway automatically grants anonymous access

Answer: C

Explanation: API Management policies can modify headers, but removing a required authentication header can cause the backend or MCP server to reject the request. Policies must be tested carefully to avoid breaking required authentication and protocol behavior.

Final Exam Point

A very important exam theme is that Azure API Management provides the enforcement and governance layer, while Microsoft Foundry provides the AI resource and application environment. Together, they allow organizations to centralize access control, usage management, monitoring, and security for AI workloads.

Go to the SC-500 Exam Prep Hub main page

AI Governance, AI Security, Microsoft Certification, SC-500, security

Enable Defender for AI Service in Cloud Workload Protection in Defender for Cloud (SC-500 Exam Prep)

 
This post is a part of the "SC-500: Implementing End-to-End Security Controls for Cloud and AI Workloads" Exam Prep Hub.
This topic falls under these sections:
Secure compute (20–25%)
   --> Implement security for AI
      --> Enable Defender for AI Service in Cloud Workload Protection in Defender for Cloud

Note that there are 10 practice questions (with answers) at the end of each section to help you solidify your knowledge of the material. Also, there are 4 practice tests with 30 questions each available from the hub's main page below the exam topics section.

Overview

Artificial intelligence workloads can introduce security risks that are different from those associated with traditional applications. Examples include unauthorized access to AI services, suspicious model usage, abuse of AI endpoints, anomalous activity, and attacks against applications that consume Azure AI services.

Microsoft Defender for AI Services is a workload protection capability in Microsoft Defender for Cloud designed to detect threats targeting Azure AI services workloads. It complements identity controls, network security, data protection, AI guardrails, and security posture management.

This topic is part of the Secure compute → Implement security for AI area of the SC-500 exam.

What Is Defender for AI Services?

Defender for AI Services provides security monitoring and threat protection for supported Azure AI services workloads. It is part of the broader Cloud Workload Protection Platform capabilities in Microsoft Defender for Cloud.

Its purpose is to help security teams:

  • Detect suspicious activity involving Azure AI services.
  • Identify potential threats targeting AI service resources.
  • Investigate security alerts in the Microsoft Defender portal.
  • Review AI security posture and coverage.
  • Combine AI workload protection with broader Defender for Cloud capabilities.
  • Correlate AI-related security information with other incidents and alerts.

Defender for AI Services is not a replacement for Microsoft Foundry guardrails, Azure AI Content Safety, Microsoft Entra ID, Azure Policy, or network controls. Instead, it adds a security monitoring and threat-detection layer to the AI workload.

AI Workload Security: Posture Versus Runtime Protection

A key exam concept is the difference between security posture management and runtime threat protection.

Cloud Security Posture Management

Cloud Security Posture Management, or CSPM, focuses on identifying and reducing configuration risks before they result in an incident.

Examples include:

  • An AI service that permits unnecessary public network access.
  • Local authentication being enabled when Microsoft Entra authentication should be used.
  • Excessive permissions assigned to an application or identity.
  • Missing security configuration or governance controls.
  • Resources that do not comply with organizational policies.

Cloud Workload Protection

Cloud Workload Protection, or CWP, focuses on detecting threats and suspicious behavior while workloads are operating.

Examples include:

  • Suspicious activity targeting an AI service.
  • Abnormal usage patterns.
  • Potential attempts to exploit an AI workload.
  • Threat indicators associated with an AI service resource.
  • Runtime activity that requires investigation.

Microsoft Defender for Cloud combines discovery, posture management, and runtime protection to provide broader visibility into AI environments.

Exam distinction

If a question asks which capability identifies a misconfiguration, think primarily of CSPM.

If it asks which capability detects a threat or suspicious activity during operation, think primarily of CWP, including Defender for AI Services.

Supported AI Workload Context

The learning material specifically associates this capability with Azure AI services workloads, including services such as:

  • Azure OpenAI-related workloads.
  • Microsoft Foundry and AI service resources.
  • AI model deployments and related service endpoints.
  • Applications that consume Azure AI services.

The exact supported resource types and detections can change as Microsoft expands the service. Therefore, organizations should verify current service coverage and supported regions before designing a production deployment.

Defender for AI Services should be considered part of a layered security architecture rather than a single control that secures every component of an AI solution.

Prerequisites

Before enabling Defender for AI Services, administrators should have:

  • An Azure subscription containing the AI workloads to protect.
  • Microsoft Defender for Cloud enabled for the subscription.
  • Appropriate permissions to configure Defender for Cloud plans.
  • Familiarity with Azure AI services and model deployments.
  • Familiarity with the Azure portal and Microsoft Defender portal.

The associated Microsoft Learn module identifies an Owner or Contributor role on the target subscription as a prerequisite for the configuration exercise. In production environments, organizations should use the least-privileged role that provides the required administrative capability.

Enable Defender for AI Services

The plan is enabled from the Defender for Cloud environment settings.

Step 1: Open Microsoft Defender for Cloud

  1. Sign in to the Azure portal.
  2. Search for and open Microsoft Defender for Cloud.
  3. Select Environment settings.

Step 2: Select the subscription

  1. Select the Azure subscription that contains the AI workloads.
  2. Review the available Defender for Cloud plans.

Defender for Cloud plans can be enabled at the subscription level. Enabling a plan at subscription scope generally applies the protection to applicable resources within that subscription.

Step 3: Enable the AI Services plan

  1. Locate the plan for Defender for AI Services.
  2. Turn the plan on.
  3. Review any available plan-specific configuration options.
  4. Select Save.

The exact portal labels and available configuration options may change as the service evolves. The important exam concept is that Defender for AI Services is enabled as a Defender for Cloud workload protection plan, rather than by installing a traditional agent on each AI service resource.

Configure Plan Components

After enabling the plan, review its available components and configuration settings.

Depending on the current service capabilities, configuration may include:

  • Selecting which AI workloads are covered.
  • Reviewing supported AI service resource types.
  • Enabling or disabling available protection components.
  • Configuring notification and monitoring integrations.
  • Reviewing the subscription’s protection status.
  • Confirming that the required security data is available.

Microsoft continuously adds capabilities to Defender for Cloud plans. Azure Policy includes a built-in initiative named Configure Microsoft Defender threat protection for AI Services to be enabled, which can help ensure that newly created or existing subscriptions remain configured according to organizational requirements.

Important distinction

The Defender for AI Services plan provides the protection capability. Azure Policy can help enforce or audit the desired configuration.

These are different functions:

CapabilityPrimary purpose
Defender for AI ServicesDetect threats targeting AI services workloads
Azure PolicyAudit or enforce resource configuration
Microsoft Defender for Cloud CSPMIdentify security posture weaknesses
Microsoft Foundry guardrailsApply controls to AI inputs, outputs, and model behavior
Microsoft Entra IDAuthenticate and authorize users, applications, and identities
Private Link and network controlsReduce network exposure

Monitor AI Security with the Data and AI Security Dashboard

After the plan is enabled, use the Data and AI security dashboard in Microsoft Defender for Cloud to review AI security information.

The dashboard is intended to provide visibility into areas such as:

  • AI resources discovered in the environment.
  • Security posture information.
  • Protection coverage.
  • Security recommendations.
  • AI-related alerts and findings.
  • Potential risks affecting AI workloads.

The dashboard helps security teams understand whether AI resources are being protected and where additional action may be required.

Recommended monitoring process

  1. Review the AI resource inventory.
  2. Confirm that expected subscriptions and resources are represented.
  3. Review recommendations and unresolved security issues.
  4. Investigate active alerts.
  5. Determine whether the issue is a configuration problem, an identity problem, a network problem, or a runtime threat.
  6. Remediate the issue.
  7. Confirm that the resource returns to the expected protection state.

Investigate AI Threat Protection Alerts

Defender for AI Services can generate security alerts when suspicious activity associated with supported AI workloads is detected.

When investigating an alert, review:

  • The affected subscription.
  • The affected AI service or resource.
  • The alert severity.
  • The detection time.
  • The activity associated with the alert.
  • The identity or application involved, when available.
  • Related resources and incidents.
  • Recommended remediation actions.

AI-related alerts can be investigated through the Microsoft Defender portal. Defender for Cloud alerts can also integrate with Microsoft Defender XDR, allowing security operations teams to correlate cloud alerts with identity, endpoint, email, and other security signals.

Example investigation workflow

A security analyst notices suspicious activity associated with an AI service.

  1. Open the alert in the Defender portal.
  2. Review the affected AI resource.
  3. Examine the evidence and activity timeline.
  4. Identify the application, identity, or network source involved.
  5. Determine whether the activity is expected.
  6. Disable or restrict a compromised identity if necessary.
  7. Rotate exposed credentials.
  8. Review network access and authentication configuration.
  9. Investigate related resources and incidents.
  10. Document the remediation and verify that the threat is no longer present.

Relationship to Other AI Security Controls

Defender for AI Services should be deployed as part of defense in depth.

Microsoft Entra ID

Use Microsoft Entra ID to control who or what can access AI services.

Recommended controls include:

  • Microsoft Entra authentication.
  • Managed identities.
  • Role-based access control.
  • Conditional Access where applicable.
  • Least-privilege permissions.
  • Removal of unnecessary credentials.

Defender for AI Services may detect suspicious activity, but it does not replace proper identity configuration.

Azure AI Content Safety and Foundry Guardrails

Guardrails help control unsafe or undesirable AI inputs and outputs. They address risks such as:

  • Harmful content.
  • Prompt-based abuse.
  • Inappropriate model responses.
  • Content filtering requirements.
  • Certain application-level AI risks.

Runtime threat protection and AI guardrails address different security concerns. A workload can have guardrails configured and still require threat monitoring.

Azure Policy

Azure Policy can audit or enforce requirements such as:

  • AI services should have local authentication disabled.
  • AI services should restrict network access.
  • Defender for AI Services should be enabled.

For example, Microsoft provides policy definitions related to disabling key-based access and restricting network access for Azure AI Services resources.

Network security

Network controls can reduce exposure by using:

  • Private endpoints.
  • Virtual network integration where supported.
  • Network access restrictions.
  • Firewall rules.
  • Private DNS configuration.
  • Restricted administrative access.

Network restrictions reduce the attack surface, while Defender for AI Services helps detect threats against the workload.

Microsoft Defender XDR

Defender XDR can provide a broader incident investigation experience by correlating AI workload alerts with other security signals.

Subscription-Level Enablement and Scale

Defender for Cloud plans are commonly configured at subscription scope. Organizations with many subscriptions should consider centralized governance.

Possible approaches include:

  • Enabling the plan on individual subscriptions.
  • Using management groups to organize subscriptions.
  • Applying Azure Policy initiatives.
  • Auditing plan coverage.
  • Reviewing coverage workbooks.
  • Establishing a standard for newly created subscriptions.

The Defender for Cloud coverage workbook helps administrators understand which plans are enabled across subscriptions and resources.

Why centralized governance matters

Without centralized governance, an organization may have:

  • AI resources deployed in subscriptions without protection.
  • Inconsistent security configurations.
  • Newly created resources that are not covered.
  • Different teams using different security standards.
  • Gaps between development, test, and production environments.

Azure Policy can help maintain consistency, but policy compliance should be verified rather than assumed.

Common Troubleshooting Issues

The plan is not visible

Possible causes include:

  • The wrong subscription or environment was selected.
  • The user lacks sufficient permissions.
  • The capability is not available in the selected region.
  • The service or plan name has changed.
  • The feature is subject to preview or availability limitations.

AI resources are not appearing in the dashboard

Check:

  • Whether the correct subscription is selected.
  • Whether the plan is enabled.
  • Whether the resource type is supported.
  • Whether the resource is in a supported region.
  • Whether sufficient time has passed for discovery and data collection.
  • Whether the resource is excluded by configuration or policy.

Alerts are not appearing

Check:

  • Whether the plan is enabled for the correct subscription.
  • Whether the activity matches a supported detection.
  • Whether the resource is covered.
  • Whether the alert is being viewed in the correct portal.
  • Whether filters are hiding the alert.
  • Whether the issue is a posture recommendation rather than a runtime alert.

A resource is secure but still has recommendations

This may occur because:

  • The recommendation has not refreshed.
  • The resource has another unresolved configuration issue.
  • A policy assignment requires a different setting.
  • The resource is evaluated against a broader security standard.
  • The recommendation applies to a different component of the workload.

Best Practices

Enable protection before production deployment

Do not wait until an AI service is compromised before enabling monitoring and threat protection.

Use least privilege

Assign only the permissions required to configure Defender for Cloud and manage AI resources.

Combine CSPM and CWP

Use CSPM to reduce misconfigurations and CWP to detect suspicious runtime activity.

Restrict network exposure

Use private endpoints and network restrictions where supported and appropriate.

Prefer Microsoft Entra authentication

Avoid unnecessary use of static keys. Use managed identities or Microsoft Entra authentication when supported.

Enforce configuration with Azure Policy

Use policy to audit or enforce requirements such as:

  • Defender for AI Services being enabled.
  • Local authentication being disabled.
  • Network access being restricted.

Monitor the Data and AI dashboard

Review coverage, recommendations, and alerts regularly.

Integrate with incident response

Ensure that AI security alerts are routed to the appropriate security operations team and correlated with other incidents.

Do not assume that one control solves every AI risk

AI security requires multiple layers, including:

  • Identity.
  • Network security.
  • Data protection.
  • Application security.
  • Guardrails.
  • Runtime threat detection.
  • Logging and monitoring.
  • Governance and compliance.

Exam-Focused Comparisons

Exam conceptCorrect interpretation
Defender for AI ServicesRuntime threat protection for supported Azure AI services workloads
AI workloads planDefender for Cloud plan used to protect AI workloads
Data and AI security dashboardView AI security posture, resources, and protection information
CSPMIdentifies configuration and posture weaknesses
CWPDetects threats and suspicious runtime activity
Azure PolicyAudits or enforces Azure resource configuration
Foundry guardrailsControls AI behavior, inputs, and outputs
Microsoft Entra IDProvides authentication and authorization
Defender XDRCorrelates and investigates security signals across workloads
Coverage workbookHelps verify Defender for Cloud plan coverage

Practice Exam Questions

Question 1

An organization uses Azure AI services for a customer-support application. The security team wants to detect suspicious activity targeting the AI service while the application is running. Which capability should the team enable?

A. Azure Policy
B. Microsoft Defender for AI Services
C. Microsoft Entra Privileged Identity Management
D. Azure Resource Manager locks

Answer: B

Explanation: Microsoft Defender for AI Services is designed to detect threats targeting supported Azure AI services workloads. Azure Policy governs configuration, PIM manages privileged access, and resource locks help prevent accidental deletion or modification.

Question 2

Where should an administrator go to enable Defender for AI Services for an Azure subscription?

A. Microsoft Foundry project settings
B. Azure Monitor Workbooks
C. Microsoft Defender portal Incidents page
D. Microsoft Defender for Cloud Environment settings

Answer: D

Explanation: Defender for Cloud workload protection plans are enabled through Microsoft Defender for Cloud → Environment settings, where the administrator selects the appropriate subscription and enables the required plan.

Question 3

A security engineer wants to identify an AI service that has an insecure configuration, such as unnecessary public network access. Which Defender for Cloud capability is most directly relevant?

A. Cloud Security Posture Management
B. Cloud Workload Protection
C. Microsoft Defender XDR incident correlation
D. Azure Bastion

Answer: A

Explanation: CSPM identifies configuration weaknesses and security posture risks. CWP focuses on runtime threats, Defender XDR supports investigation and correlation, and Azure Bastion provides secure administrative access to virtual machines.

Question 4

After enabling Defender for AI Services, which feature should an administrator use to review AI resource insights, security posture, and protection information?

A. Azure Service Health
B. Azure Advisor only
C. Data and AI security dashboard
D. Azure Cost Management

Answer: C

Explanation: The Data and AI security dashboard in Defender for Cloud provides visibility into AI resources, security posture, and related protection information.

Question 5

An organization wants to ensure that Defender for AI Services remains enabled across newly created subscriptions. Which approach is most appropriate?

A. Configure a resource lock on every AI service
B. Create a custom Microsoft Entra authentication method
C. Enable Azure Bastion
D. Use Azure Policy to audit or deploy the required Defender for AI Services configuration

Answer: D

Explanation: Azure Policy can help audit or enforce the desired Defender for Cloud plan configuration across a defined scope. Resource locks, authentication methods, and Bastion do not ensure that the Defender for AI Services plan is enabled.

Question 6

Which statement best describes the relationship between Defender for AI Services and Microsoft Foundry guardrails?

A. Defender for AI Services replaces all Foundry guardrails
B. Defender for AI Services detects workload threats, while guardrails help control AI inputs, outputs, and behavior
C. Foundry guardrails are used only to enable Azure subscriptions
D. Defender for AI Services is required only for virtual machines

Answer: B

Explanation: These controls address different risks. Defender for AI Services provides workload threat protection, while Foundry guardrails help manage AI behavior and content-related risks.

Question 7

A security analyst receives an alert involving suspicious activity against an Azure AI service. Where should the analyst investigate the alert?

A. Microsoft Defender portal
B. Azure Storage Explorer
C. Azure Resource Graph only
D. Microsoft Entra Domain Services

Answer: A

Explanation: Defender for AI Services alerts can be investigated in the Microsoft Defender portal. Defender for Cloud alerts can also integrate with Microsoft Defender XDR for broader correlation and investigation.

Question 8

Which statement about Defender for AI Services is correct?

A. It eliminates the need for identity and network controls
B. It encrypts every prompt and model response automatically
C. It provides runtime threat protection for supported Azure AI services workloads
D. It is an Azure resource lock mechanism

Answer: C

Explanation: Defender for AI Services is a workload protection capability. It does not replace authentication, authorization, encryption, network restrictions, or other defense-in-depth controls.

Question 9

An administrator enables Defender for AI Services but does not see a particular AI resource in the dashboard. What should the administrator check first?

A. Whether the resource is supported, in the correct subscription, and in a supported region
B. Whether the resource has an Azure Bastion host
C. Whether the resource has a resource lock
D. Whether the application uses a virtual machine scale set

Answer: A

Explanation: Missing resource visibility can result from unsupported resource types, incorrect subscription selection, regional availability, or discovery delays. Bastion, resource locks, and VM scale sets are not prerequisites for discovering an AI service resource.

Question 10

Which combination provides the most complete defense-in-depth approach for an Azure AI workload?

A. Resource locks and Azure Cost Management
B. Azure Bastion and storage replication
C. Azure Policy only
D. Microsoft Entra authentication, network restrictions, AI guardrails, Defender for Cloud posture management, and Defender for AI Services runtime protection

Answer: D

Explanation: AI workloads require multiple complementary controls. Identity protects access, network restrictions reduce exposure, guardrails address AI behavior, CSPM identifies configuration weaknesses, and Defender for AI Services detects runtime threats.

Key Takeaways

For the SC-500 exam, remember the following:

  1. Defender for AI Services is a Defender for Cloud workload protection capability.
  2. It focuses on detecting threats targeting supported Azure AI services workloads.
  3. Enable it through Microsoft Defender for Cloud → Environment settings.
  4. Use the Data and AI security dashboard to monitor AI security information.
  5. Investigate alerts in the Microsoft Defender portal.
  6. Use CSPM for configuration and posture risks.
  7. Use CWP for runtime threat detection.
  8. Use Azure Policy to audit or enforce plan configuration.
  9. Defender for AI Services complements—not replaces—identity, network, guardrail, and data security controls.
  10. Treat AI security as a defense-in-depth responsibility rather than a single-product task.

Go to the SC-500 Exam Prep Hub main page

AI, AI Governance, AI Security, Databases, DP-800, Microsoft Certification, security, SQL

Interpret the security impact of using AI-assisted tools (DP-800 Exam Prep)

 
This post is a part of the DP-800: Developing AI-Enabled Database Solutions Exam Prep Hub.
This topic falls under these sections:
Design and develop database solutions (35–40%)
   --> Design and implement SQL solutions by using AI-assisted tools
      --> Interpret security impact of using AI-assisted tools

Note that there are 10 practice questions (with answers) at the end of each section to help you solidify your knowledge of the material. Also, there are 4 practice tests with 30 questions each available from the hub's main page below the exam topics section.

Introduction

Unlike many traditional SQL development topics, this objective focuses less on writing T-SQL and more on understanding how AI coding assistants affect security, privacy, compliance, and governance throughout the software development lifecycle.

For the DP-800 exam, you should understand:

  • Security risks associated with AI coding assistants
  • Responsible use of AI-generated code
  • Protection of confidential data
  • Compliance considerations
  • Secure prompt engineering
  • Human review requirements
  • Organizational governance for AI-assisted development
  • Microsoft AI tooling security capabilities

Why Security Matters When Using AI-Assisted Tools

Modern AI assistants such as:

  • Microsoft Copilot
  • GitHub Copilot
  • Azure AI Foundry
  • Microsoft Fabric Copilot
  • SQL Database Copilot experiences
  • Azure Data Studio AI extensions
  • Visual Studio AI-assisted development

can dramatically improve developer productivity.

However, they also introduce new risks.

AI systems often process:

  • prompts
  • source code
  • database schema
  • stored procedures
  • configuration files
  • API definitions
  • infrastructure code
  • documentation

If developers expose sensitive information to an AI system, that information could violate organizational security policies.

Therefore:

AI should improve developer productivity—not weaken database security.

Primary Security Risks

The exam expects candidates to recognize several categories of risk.

1. Exposure of Sensitive Information

Never include confidential information inside prompts.

Examples include:

  • passwords
  • connection strings
  • API keys
  • access tokens
  • customer data
  • Personally Identifiable Information (PII)
  • Protected Health Information (PHI)
  • financial records
  • encryption keys

Bad example:

“Optimize this stored procedure that accesses CustomerCreditCards.”

Better:

Replace confidential objects with generic examples.

CustomerTable
OrderTable
SalesTable

instead of production names.

2. Leakage of Intellectual Property

Many organizations consider:

  • SQL code
  • stored procedures
  • business rules
  • AI models
  • algorithms
  • database architecture

to be proprietary.

Developers should avoid submitting confidential business logic into public AI services unless organizational policy permits it.

3. AI Hallucinations

AI-generated code may:

  • invent SQL syntax
  • generate nonexistent functions
  • misuse permissions
  • recommend deprecated features
  • introduce vulnerabilities

Example:

AI may suggest:

GRANT CONTROL TO PUBLIC

This is almost never appropriate.

Always validate AI-generated SQL.

4. Insecure Code Generation

AI sometimes generates code that:

  • lacks input validation
  • uses dynamic SQL unsafely
  • ignores least privilege
  • omits error handling
  • exposes excessive permissions

Example:

Unsafe:

SET @sql =
'SELECT * FROM Orders WHERE CustomerID=' + @CustomerID
EXEC(@sql)

Preferred:

sp_executesql

with parameters.

5. Compliance Violations

Many industries have regulations governing data usage.

Examples:

  • GDPR
  • HIPAA
  • PCI DSS
  • ISO 27001
  • SOC 2

Uploading regulated information into unauthorized AI services may violate compliance requirements.

Human Review is Required

One of the most important DP-800 concepts:

AI assists developers—it does not replace secure code review.

Every AI-generated recommendation should be reviewed for:

  • correctness
  • performance
  • security
  • compliance
  • maintainability

Human approval remains essential.

Secure Prompt Engineering

Prompt engineering also has security implications.

Good prompts avoid exposing sensitive information.

Instead of:

“Here’s our production database schema.”

Use:

“Here’s a simplified example schema.”

Good prompts:

  • remove customer data
  • remove passwords
  • remove secrets
  • anonymize identifiers
  • generalize business logic

Protecting Secrets

Never place secrets into AI prompts.

Examples include:

  • Azure SQL passwords
  • Azure Storage keys
  • SAS tokens
  • API keys
  • OAuth tokens
  • certificates
  • encryption keys

Instead:

<ConnectionString>

or

<MyAPIKey>

as placeholders.

Protect Customer Data

Sensitive customer information includes:

  • names
  • addresses
  • SSNs
  • passport numbers
  • emails
  • phone numbers
  • medical records
  • payment information

Instead of:

John Smith

Use:

Customer A

Instead of:

4111-1111-1111-1111

Use:

<CardNumber>

AI and Least Privilege

Generated SQL should follow the Principle of Least Privilege.

Avoid:

GRANT CONTROL

Prefer:

GRANT SELECT

or

GRANT EXECUTE

only when necessary.

AI suggestions should always be reviewed for excessive permissions.

Verify AI-Generated Security Recommendations

AI may recommend:

  • indexes
  • permissions
  • encryption
  • authentication methods
  • firewall rules

Always verify recommendations against:

  • Microsoft documentation
  • organizational standards
  • security policies
  • current SQL Server capabilities

Secure Development Lifecycle (SDL)

AI should support—not bypass—the Secure Development Lifecycle.

Typical workflow:

  1. Developer writes prompt
  2. AI generates code
  3. Developer reviews
  4. Static code analysis
  5. Security scanning
  6. Peer review
  7. Testing
  8. Deployment

AI does not eliminate security reviews.

AI-Generated SQL Must Still Be Tested

Always test:

  • SQL injection protection
  • permissions
  • transactions
  • rollback behavior
  • concurrency
  • performance
  • indexing
  • execution plans

Never deploy AI-generated code without testing.

Microsoft Copilot Security

Microsoft enterprise AI offerings provide important security capabilities.

Examples include:

  • enterprise authentication
  • Microsoft Entra ID integration
  • tenant isolation
  • role-based access control
  • compliance features
  • auditing
  • encryption
  • responsible AI safeguards

Organizations should understand which AI services are approved for handling sensitive information.

Governance of AI Usage

Organizations should establish governance policies that define:

  • approved AI tools
  • acceptable prompts
  • prohibited data types
  • review requirements
  • logging
  • auditing
  • approval workflows
  • compliance responsibilities

Developers should follow organizational AI usage policies.

Common Security Best Practices

When using AI-assisted SQL development:

  • Never share passwords or secrets.
  • Remove customer information from prompts.
  • Anonymize production schemas when possible.
  • Validate every AI-generated query.
  • Review permissions carefully.
  • Use parameterized queries instead of string concatenation.
  • Test AI-generated code before deployment.
  • Perform peer reviews.
  • Follow organizational governance policies.
  • Verify AI recommendations against Microsoft documentation.

Exam Tips

Know the differences between:

ConceptKey Point
AI AssistanceImproves productivity but requires review
Human ReviewAlways required before deployment
Sensitive DataNever include in prompts
ComplianceAI usage must satisfy organizational regulations
SecretsNever expose passwords, keys, or tokens
Least PrivilegeAI-generated permissions should be minimal
GovernanceOrganizations define approved AI usage
Responsible AIAI outputs must be validated for security and correctness

DP-800 Exam Tips

Expect scenario-based questions such as:

  • Is this prompt safe?
  • Which information should be removed before using Copilot?
  • Which AI recommendation should be rejected?
  • Which code introduces SQL injection?
  • Which permission follows least privilege?
  • How should confidential schemas be shared?
  • What review is still required after AI generates code?
  • Which compliance issue exists?
  • Which AI-generated recommendation is safest?
  • Which governance practice should be followed?

The correct answer almost always favors:

  • protecting sensitive information,
  • minimizing permissions,
  • validating AI-generated code,
  • following organizational security policies, and
  • requiring human review before deployment.

Practice Exam Questions

Question 1

A developer wants to use an AI coding assistant to optimize a stored procedure. Which information should NOT be included in the prompt?

A. Sample table names

B. Production connection string containing credentials

C. Database version

D. Execution plan summary

Correct Answer: B

Explanation:
Connection strings containing usernames, passwords, or other credentials are sensitive secrets and should never be shared with AI tools. Replace them with placeholders before submitting prompts.

Question 2

Which security principle should always be applied when reviewing AI-generated SQL permissions?

A. Full administrative access

B. Principle of Least Privilege

C. Maximum compatibility

D. Public access

Correct Answer: B

Explanation:
AI-generated code should grant only the permissions necessary to perform the required task. Avoid overly broad permissions such as CONTROL or db_owner unless absolutely required.

Question 3

An AI assistant generates a stored procedure that concatenates user input into a SQL statement. What should the developer do?

A. Deploy it because AI generated it

B. Ignore it

C. Replace it with parameterized SQL

D. Disable indexing

Correct Answer: C

Explanation:
Dynamic SQL created through string concatenation is vulnerable to SQL injection. Use parameterized queries or sp_executesql to safely pass user input.

Question 4

A company must comply with GDPR. Which prompt represents the safest practice?

A. Replace customer information with anonymized sample data

B. Include production payment records

C. Upload an entire production database backup

D. Include customer names and addresses

Correct Answer: A

Explanation:
Personally identifiable information should be removed or anonymized before using AI-assisted development tools to reduce compliance and privacy risks.

Question 5

Why should developers review AI-generated SQL before deploying it?

A. AI-generated code is always optimized

B. AI may generate incorrect or insecure code

C. AI always follows organizational standards

D. AI automatically performs penetration testing

Correct Answer: B

Explanation:
AI-generated code can contain logical errors, security vulnerabilities, deprecated syntax, or poor performance choices. Human review remains essential.

Question 6

Which item is generally appropriate to include in an AI prompt?

A. Encryption keys

B. Customer Social Security numbers

C. Generic sample schema with fictional table names

D. Production API tokens

Correct Answer: C

Explanation:
Generic schemas without confidential business information allow AI to provide useful assistance while protecting sensitive organizational data.

Question 7

Which activity remains part of the Secure Development Lifecycle even when AI generates most of the SQL code?

A. Eliminating peer review

B. Skipping security testing

C. Removing code reviews

D. Performing security validation and testing

Correct Answer: D

Explanation:
AI accelerates development but does not replace testing, peer reviews, static analysis, or security validation.

Question 8

What is the primary purpose of organizational AI governance policies?

A. Increase CPU utilization

B. Define approved and secure use of AI tools

C. Eliminate documentation

D. Replace database administrators

Correct Answer: B

Explanation:
Governance policies establish which AI tools are approved, what data may be shared, required review processes, auditing requirements, and compliance expectations.

Question 9

An AI assistant recommends granting CONTROL permissions to simplify application development. What should the developer do first?

A. Apply the recommendation immediately

B. Replace CONTROL with db_owner

C. Review whether a lower permission satisfies the requirement

D. Disable authentication

Correct Answer: C

Explanation:
Broad permissions should be carefully reviewed. Following the Principle of Least Privilege helps reduce security risks by granting only the minimum required permissions.

Question 10

Which statement best describes responsible use of AI-assisted database development?

A. AI-generated code is production-ready without review.

B. AI eliminates the need for security testing.

C. AI guarantees compliance with regulations.

D. AI improves productivity, but developers remain responsible for validating security, correctness, and compliance.

Correct Answer: D

Explanation:
AI is a productivity tool, not an autonomous developer. Developers remain accountable for verifying code quality, security, regulatory compliance, and organizational standards before deployment.

Go to the DP-800 Exam Prep Hub main page

AB-620, AI, AI Governance, Azure AI, Microsoft Certification

Create a test set (AB-620 Exam Prep)

 
This post is a part of the AB-620: Designing and Building Integrated AI Agent Solutions in Copilot Studio Exam Prep Hub.
This topic falls under these sections:
Test and manage agents (20–25%)
   --> Evaluate agent performance
      --> Create a test set

Note that there are 10 practice questions (with answers) at the end of each section to help you solidify your knowledge of the material. Also, there are 4 practice tests with 30 questions each available from the hub's main page below the exam topics section.

Introduction

One of the most important responsibilities of an AI Agent Builder is ensuring that an agent consistently produces accurate, relevant, and safe responses. As agents become more sophisticated and rely on multiple knowledge sources, tools, and generative AI models, manual testing alone is no longer sufficient.

Microsoft Copilot Studio provides test sets that allow developers to systematically validate agent behavior against expected outcomes. Test sets enable repeatable evaluation of an agent after configuration changes, prompt updates, knowledge source modifications, or model upgrades.

For the AB-620 exam, you should understand:

  • What test sets are
  • Why they are important
  • How to create and manage them
  • How they integrate with agent evaluation
  • Best practices for maintaining reliable test coverage

What Is a Test Set?

A test set is a collection of predefined test cases that evaluate how an AI agent responds to expected user requests.

Each test case generally contains:

  • A sample user prompt
  • The expected behavior or outcome
  • Evaluation criteria
  • Pass/fail results after execution

Instead of manually asking the same questions every time changes are made, developers can rerun the entire test set to determine whether the agent continues to behave correctly.

Why Test Sets Matter

Without structured testing:

  • New prompts may unintentionally break previous functionality.
  • Updated knowledge sources may introduce incorrect answers.
  • Tool changes may fail silently.
  • Model updates may alter response quality.

Test sets provide confidence that the agent still behaves correctly after changes.

Benefits include:

  • Repeatable testing
  • Faster validation
  • Regression testing
  • Improved response quality
  • Easier troubleshooting
  • Better release confidence

Test Set vs Manual Testing

Manual TestingTest Set
Performed interactivelyExecuted repeatedly
Difficult to reproduceFully repeatable
Human remembers questionsQuestions stored permanently
Time consumingAutomated evaluation
Easy to miss scenariosCovers many scenarios consistently

When Should You Create a Test Set?

Create a test set whenever:

  • Building a new agent
  • Adding new topics
  • Adding knowledge sources
  • Adding tools
  • Integrating APIs
  • Updating prompts
  • Deploying a new version
  • Performing regression testing

Components of a Test Case

A typical test case includes several important elements.

1. User Input

The question or request submitted to the agent.

Example:

“Show me my remaining vacation balance.”

2. Expected Behavior

The desired outcome.

Examples include:

  • Calls HR connector
  • Retrieves employee record
  • Returns vacation balance
  • Does not hallucinate data

3. Expected Response

Depending on the evaluation method, expected responses may include:

  • Specific wording
  • Required information
  • Correct tool usage
  • Accurate citation
  • Proper formatting

4. Evaluation Result

After execution the test produces results such as:

  • Pass
  • Fail
  • Partial success
  • Confidence score (where applicable)

Types of Test Cases

A comprehensive test set should include multiple categories.

Happy Path Tests

Expected user behavior.

Example:

“Reset my password.”

Alternative Wording

Different ways users ask the same question.

Examples:

  • I forgot my password
  • Help me log in
  • I can’t sign in

Edge Cases

Unusual but valid requests.

Example:

“Can I reset someone else’s password?”

Invalid Requests

Questions the agent should decline.

Example:

“Delete every employee record.”

Ambiguous Questions

The agent should ask follow-up questions.

Example:

“Book a meeting.”

Expected behavior:

“Who should I invite?”

Tool Failure Tests

Verify graceful handling of failures.

Example:

API unavailable.

Expected response:

“The HR system is temporarily unavailable.”

Knowledge Tests

Ensure retrieval from enterprise knowledge.

Example:

“What is the travel reimbursement policy?”

Security Tests

Confirm proper authorization.

Example:

Employee requests another employee’s payroll information.

Expected behavior:

Access denied.

Creating a Test Set

The general workflow is:

Step 1

Open the agent in Copilot Studio.

Step 2

Navigate to testing or evaluation features.

Step 3

Create a new test set.

Step 4

Add individual test cases.

Each includes:

  • Prompt
  • Expected behavior
  • Expected response

Step 5

Save the test set.

Step 6

Run the evaluation.

Step 7

Review results.

Step 8

Improve the agent if failures occur.

Step 9

Run the test set again.

Organizing Test Sets

Large enterprise agents often use multiple test sets.

Examples:

  • HR Agent
  • Finance Agent
  • IT Help Desk
  • Customer Service
  • Sales Support

Within each, additional test groups may cover:

  • Authentication
  • Knowledge retrieval
  • API actions
  • Escalation
  • Security
  • Generative responses

Regression Testing

Regression testing verifies that new changes do not introduce unexpected problems.

Example:

Original agent answers:

“How do I request PTO?”

A new HR connector is added.

Running the existing test set confirms the answer still works correctly.

Without regression testing, developers may unknowingly introduce defects.

Testing Knowledge Retrieval

Knowledge-based agents should verify:

  • Correct document selected
  • Correct section retrieved
  • Accurate citation
  • Relevant answer
  • No hallucinated content

Example test:

Question:

“What is the expense reimbursement limit?”

Expected:

  • Searches indexed documents
  • Retrieves finance policy
  • Returns correct limit
  • Includes citation if configured

Testing Tool Invocation

For action-based agents, verify that the correct tool is selected.

Example:

User:

“Create a support ticket.”

Expected:

  • IT connector invoked
  • Ticket created
  • Ticket number returned

Failure examples:

  • Wrong connector called
  • No connector called
  • Hallucinated confirmation

Testing Multi-Agent Solutions

If delegation is used, verify:

  • Correct child agent selected
  • Successful delegation
  • Response returned
  • Parent continues conversation properly

Testing Generative AI

Generative responses require additional evaluation.

Verify:

  • Factual accuracy
  • Completeness
  • Grounding
  • Tone
  • Safety
  • Relevance

Evaluating Test Results

After execution, review:

  • Overall pass rate
  • Failed cases
  • Tool execution
  • Knowledge retrieval
  • Response quality
  • Latency
  • Error messages

Common questions include:

  • Did the correct tool run?
  • Was the answer accurate?
  • Was sensitive data protected?
  • Was grounding successful?

Common Reasons Tests Fail

Failures often result from:

  • Prompt changes
  • Missing connector permissions
  • API failures
  • Incorrect tool selection
  • Poor grounding
  • Hallucinations
  • Missing documents
  • Authentication problems
  • Incorrect routing

Best Practices

Microsoft recommends several best practices.

Build Early

Create test cases while building the agent.

Cover Real User Questions

Use production-like prompts whenever possible.

Include Variations

People ask the same question differently.

Test all common variations.

Test Negative Scenarios

Don’t only verify success.

Test:

  • Errors
  • Permission failures
  • Invalid input
  • Ambiguous requests

Keep Test Sets Updated

Whenever the agent changes:

  • Add new tests
  • Remove obsolete tests
  • Update expected responses

Run Tests Frequently

Execute the full test set:

  • Before deployment
  • After model updates
  • After connector updates
  • After knowledge updates
  • After prompt revisions

Exam Tips

For the AB-620 exam, remember:

  • Test sets enable repeatable evaluation.
  • They support regression testing.
  • Good test cases include expected behavior.
  • Test sets should include positive, negative, and edge-case scenarios.
  • Multi-agent solutions require delegation testing.
  • Tool-based agents require tool invocation validation.
  • Knowledge agents require grounding verification.
  • Test sets improve deployment confidence.

Practice Exam Questions

Question 1

Why is creating a test set preferable to relying solely on manual testing?

A. It permanently stores conversation history for users.

B. It provides repeatable, consistent evaluation of agent behavior.

C. It automatically retrains the language model.

D. It removes the need for production monitoring.

Answer: B

Explanation: Test sets allow the same scenarios to be executed repeatedly, making regression testing and validation much more reliable than manual testing.

Question 2

Which type of scenario should always be included in a comprehensive test set?

A. Only successful user interactions

B. Only connector failures

C. Positive, negative, and edge-case scenarios

D. Only knowledge retrieval questions

Answer: C

Explanation: Comprehensive testing includes normal requests, invalid inputs, ambiguous questions, security scenarios, and failure conditions.

Question 3

A developer updates an HR connector used by an agent. What is the best next step?

A. Run the existing test set to perform regression testing.

B. Delete all previous test cases.

C. Retrain the foundation model.

D. Create a new environment.

Answer: A

Explanation: Regression testing verifies that previously working functionality continues to operate after changes.

Question 4

Which component defines what a successful test should accomplish?

A. Conversation history

B. Agent version

C. Workspace settings

D. Expected behavior

Answer: D

Explanation: Expected behavior specifies the desired outcome that the agent should achieve during the test.

Question 5

A knowledge-based agent answers a company policy question using outdated information. Which area of testing should identify this issue?

A. User authentication testing

B. Knowledge retrieval testing

C. Network latency testing

D. Adaptive Card rendering

Answer: B

Explanation: Knowledge retrieval tests verify that the correct documents are located and that accurate, grounded information is returned.

Question 6

When testing an action that creates a support ticket, what should the evaluation confirm?

A. Only that the response is grammatically correct

B. Only that the response is polite

C. That the correct tool or connector was invoked successfully

D. That the conversation contains at least three turns

Answer: C

Explanation: Action-based tests should verify successful tool invocation and the expected outcome of that action.

Question 7

Why should multiple phrasings of the same request be included in a test set?

A. To increase the size of the knowledge base

B. To improve authentication

C. To ensure the agent recognizes natural language variations

D. To reduce connector latency

Answer: C

Explanation: Users ask the same question in many different ways, and the agent should respond correctly to common variations.

Question 8

Which situation best represents an edge-case test?

A. “Reset my password.”

B. “Show today’s weather.”

C. “Create a support ticket.”

D. “Can I reset another employee’s password?”

Answer: D

Explanation: This unusual but valid request tests whether the agent correctly handles authorization and security.

Question 9

An agent delegates requests to multiple child agents. What should testing verify?

A. That delegation occurs to the appropriate child agent and responses are returned correctly

B. That every child agent uses the same prompt

C. That delegation is disabled after deployment

D. That all child agents share one knowledge source

Answer: A

Explanation: Multi-agent testing ensures that routing, delegation, and response aggregation function as designed.

Question 10

Which statement best describes the primary purpose of regression testing?

A. Measuring internet bandwidth

B. Evaluating user satisfaction surveys

C. Ensuring that recent changes have not broken existing functionality

D. Generating additional knowledge documents

Answer: C

Explanation: Regression testing validates that existing capabilities continue to work correctly after updates to prompts, connectors, tools, or knowledge sources.

Go to the AB-620 Exam Prep Hub main page

AB-620, Agentic AI, AI, AI Governance, AI Security, Microsoft Certification

Configure and monitor computer use for an agent (AB-620 Exam Prep)

 
This post is a part of the AB-620: Designing and Building Integrated AI Agent Solutions in Copilot Studio Exam Prep Hub.
This topic falls under these sections:
Integrate and extend agents in Copilot Studio (40–45%)
   --> Add tools to agents
      --> Configure and monitor computer use for an agent

Note that there are 10 practice questions (with answers) at the end of each section to help you solidify your knowledge of the material. Also, there are 4 practice tests with 30 questions each available from the hub's main page below the exam topics section.

Introduction

Many organizations still rely on legacy applications that do not expose REST APIs, Microsoft Power Platform connectors, or Model Context Protocol (MCP) servers. Employees may need to interact with desktop applications, web portals, or line-of-business systems that require clicking buttons, typing into forms, navigating menus, and downloading files.

Computer Use enables AI agents to perform these user interface (UI) interactions by observing and manipulating an application’s graphical interface, much like a human user would.

Rather than integrating through APIs, the agent interacts directly with the application’s user interface.

This capability expands the types of business processes that Copilot Studio agents can automate.

What is Computer Use?

Computer Use is an AI capability that allows an agent to:

  • Observe the user interface
  • Identify interface elements
  • Move the mouse
  • Click buttons
  • Enter text
  • Select menu options
  • Scroll pages
  • Navigate applications
  • Execute repetitive workflows

Instead of calling an API, the agent completes tasks by interacting with the application’s visual interface.

Why Computer Use Exists

Many enterprise applications:

  • have no API
  • expose limited APIs
  • use legacy technologies
  • require manual interaction
  • contain proprietary interfaces

Examples include:

  • Legacy ERP systems
  • Internal HR portals
  • Desktop accounting software
  • Government websites
  • Vendor portals
  • Older Windows applications

Computer Use provides automation where traditional integrations are unavailable or impractical.

Computer Use vs. API Integration

Computer UseAPI Integration
Interacts with UIInteracts with services
Uses mouse and keyboard actionsUses HTTP requests
Suitable for legacy systemsSuitable for modern systems
More susceptible to UI changesGenerally more stable
May execute more slowlyUsually faster
Requires visible interfaceWorks without a user interface

Exam Tip: Microsoft recommends using APIs, connectors, or MCP servers when available. Computer Use is typically used when no suitable programmatic interface exists.

Typical Computer Use Architecture

User Request
↓
Copilot Studio Agent
↓
Computer Use Tool
↓
AI analyzes screen
↓
Identifies UI elements
↓
Executes mouse/keyboard actions
↓
Application responds
↓
Agent verifies results
↓
Response returned to user

Common Business Scenarios

Computer Use is valuable in situations where employees currently perform repetitive manual tasks.

Invoice Processing

An agent can:

  • Open an accounting application
  • Enter invoice data
  • Select suppliers
  • Save records
  • Confirm successful submission

Employee Onboarding

The agent can:

  • Open HR software
  • Create employee records
  • Complete forms
  • Assign departments
  • Generate confirmation numbers

Customer Support

The agent may:

  • Open a CRM system
  • Search for customers
  • Update account information
  • Create service tickets
  • Retrieve order history

Data Entry

Computer Use can automate:

  • Copying information between systems
  • Completing repetitive forms
  • Updating spreadsheets
  • Entering records into legacy databases

Web Portal Automation

Examples include:

  • Vendor portals
  • Government portals
  • Insurance websites
  • Banking systems
  • Regulatory reporting portals

Computer Use Workflow

A typical execution follows these steps:

  1. The user submits a request.
  2. The agent determines that Computer Use is required.
  3. The application launches (if necessary).
  4. The AI observes the current screen.
  5. UI elements are identified.
  6. The agent performs actions.
  7. The application responds.
  8. The agent validates the result.
  9. The workflow continues or finishes.
  10. A response is returned to the user.

How the Agent Understands the Screen

Unlike API integrations, Computer Use relies on visual understanding.

The AI analyzes:

  • Buttons
  • Text boxes
  • Menus
  • Tables
  • Checkboxes
  • Drop-down lists
  • Icons
  • Dialog boxes
  • Navigation controls

This allows it to interact with applications even when source code or APIs are unavailable.

Typical User Actions

A Computer Use agent may perform actions such as:

  • Click
  • Double-click
  • Right-click
  • Type text
  • Press keyboard shortcuts
  • Scroll
  • Select menu items
  • Drag objects
  • Navigate windows
  • Confirm dialog boxes
  • Upload files
  • Download files

Configuring Computer Use

Configuration generally involves:

  • Enabling the Computer Use capability
  • Selecting or configuring the target environment
  • Defining the workflow
  • Specifying execution permissions
  • Testing interactions
  • Publishing the agent

Administrators should verify that the environment meets all prerequisites before deployment.

Designing Reliable Automations

Because UI-based automation depends on visual elements, reliability is critical.

Good designs:

  • Follow predictable navigation paths
  • Minimize unnecessary clicks
  • Use consistent workflows
  • Verify intermediate results
  • Handle unexpected dialogs
  • Include recovery logic

Reliable automation reduces failures caused by interface changes.

Authentication Considerations

Many applications require authentication before automation can begin.

Possible authentication methods include:

  • Microsoft Entra ID
  • Organizational credentials
  • Multi-factor authentication (where supported)
  • Session-based authentication
  • Single Sign-On (SSO)

Organizations should follow their security policies when storing or accessing credentials. Avoid embedding usernames, passwords, or secrets directly within agent logic.

Permissions

The agent should operate using the principle of least privilege.

Grant only the permissions necessary to complete the intended tasks.

Examples:

  • Read-only access when updates are unnecessary
  • Department-specific permissions
  • Limited application roles
  • Restricted administrative privileges

Limiting permissions reduces security risks.

Security Considerations

Computer Use interacts directly with enterprise applications, making security especially important.

Administrators should consider:

  • Authentication
  • Authorization
  • Audit logging
  • Data protection
  • Session management
  • Access reviews
  • Conditional access policies
  • Secure credential storage

Sensitive Data Handling

Computer Use workflows may encounter:

  • Personally identifiable information (PII)
  • Financial records
  • Medical information
  • Customer data
  • Employee records

Organizations should:

  • Follow compliance requirements
  • Minimize unnecessary data exposure
  • Log actions appropriately
  • Restrict access to sensitive workflows
  • Monitor privileged automations

Common Limitations

Computer Use is powerful but has limitations.

Examples include:

UI Changes

If a button moves or is renamed, automation may fail.

Dynamic Pages

Pages that change frequently can reduce reliability.

Pop-up Windows

Unexpected dialogs may interrupt execution.

Performance Delays

Slow applications may require waiting or retry logic.

Unsupported Controls

Some proprietary interface components may be difficult to automate consistently.

When NOT to Use Computer Use

Avoid Computer Use when:

  • A REST API is available.
  • A Microsoft Power Platform connector exists.
  • An MCP server provides direct integration.
  • A supported enterprise connector is available.
  • A direct database integration is appropriate.

API-based integrations are generally more reliable, scalable, and maintainable than UI automation.

Best Practices

Prefer Native Integrations

Use:

  • Connectors
  • APIs
  • MCP
  • Power Automate

before choosing Computer Use.

Keep Workflows Simple

Smaller workflows are easier to maintain and troubleshoot.

Validate Each Step

Confirm that each action succeeds before proceeding.

Handle Unexpected Screens

Prepare for:

  • Error messages
  • Session timeouts
  • Login prompts
  • Confirmation dialogs

Use Stable Interfaces

Applications with consistent layouts produce more reliable automations.

Test Regularly

Retest automations after:

  • Application upgrades
  • UI redesigns
  • Security updates
  • Browser updates
  • Operating system updates

Common Enterprise Use Cases

Organizations commonly use Computer Use for:

  • HR onboarding
  • Invoice entry
  • Insurance claims
  • CRM updates
  • Legacy ERP automation
  • Procurement workflows
  • Compliance reporting
  • Financial reconciliation
  • Customer service operations
  • Data migration between systems

Common Exam Mistakes

Candidates often assume that Computer Use is the preferred integration method.

Remember:

  • Computer Use is not the first choice.
  • APIs and connectors should be used whenever available.
  • Computer Use fills the gap when direct integrations are unavailable.

Another common mistake is assuming Computer Use is immune to application changes. Because it relies on the user interface, modifications to screens, layouts, or controls can affect automation reliability.

AB-620 Exam Tips

Remember these key points:

  • Computer Use automates interactions through an application’s graphical interface.
  • It is intended primarily for systems without suitable APIs or connectors.
  • UI automation is generally more fragile than API-based integrations.
  • Secure authentication and least-privilege access are essential.
  • Validate each interaction to improve reliability.
  • Design workflows to tolerate delays and unexpected dialogs.
  • Monitor and maintain automations as application interfaces evolve.

Quick Orientation Summary

In the topics above, we explored the fundamentals of Computer Use in Microsoft Copilot Studio, including its purpose, architecture, configuration process, execution model, and how it differs from API-based automation. The topics below focus on monitoring, governance, security, optimization, troubleshooting.

Monitoring Computer Use Sessions

Unlike API tools, Computer Use performs visual interactions with applications. Because of this, monitoring becomes especially important.

Administrators should monitor:

  • Session success rates
  • Failed execution steps
  • Time required to complete tasks
  • Screen recognition failures
  • Authentication failures
  • Unexpected application behavior
  • Agent execution history
  • Resource consumption
  • Retry frequency

Monitoring enables organizations to:

  • Detect broken workflows
  • Identify application UI changes
  • Improve reliability
  • Measure automation performance
  • Support compliance audits

Execution Logs

Each Computer Use execution produces detailed logs.

Typical information includes:

  • Workflow start time
  • Workflow completion time
  • Individual action history
  • Screens visited
  • Click locations
  • Typed text
  • Variables used
  • Error messages
  • Retry attempts
  • Completion status

These logs assist with:

  • Troubleshooting
  • Performance tuning
  • Security investigations
  • Compliance reporting

Screenshots and Visual Evidence

Many implementations capture screenshots throughout execution.

Screenshots help identify:

  • Missing buttons
  • Incorrect pages
  • Unexpected pop-ups
  • Login failures
  • Permission issues
  • Validation errors
  • UI redesigns

Visual evidence greatly reduces troubleshooting time.

Performance Metrics

Useful metrics include:

Success Rate

Percentage of successful executions.

Example:

  • 98 successful runs
  • 2 failed runs

Success rate:

98%

Average Completion Time

Tracks workflow efficiency.

Example:

  • Average runtime: 22 seconds

If runtime suddenly increases:

  • Network latency
  • Slow applications
  • UI delays
  • Infrastructure issues

may be responsible.

Retry Frequency

Measures how often automation must repeat actions.

High retry counts often indicate:

  • Unstable interfaces
  • Slow page loading
  • Timing problems
  • UI recognition issues

Failure Categories

Failures should be categorized.

Examples include:

  • Authentication failures
  • Missing elements
  • Timeout errors
  • Permission issues
  • Application crashes
  • Network failures
  • Validation errors

This helps prioritize improvements.

Alerts and Notifications

Organizations often configure alerts for:

  • Multiple workflow failures
  • Authentication problems
  • High error rates
  • Excessive execution time
  • Agent unavailability
  • Service interruptions

Early alerts reduce downtime.

Security Best Practices

Computer Use automation may interact with sensitive enterprise applications.

Recommended practices include:

Principle of Least Privilege

Grant only the permissions required.

Avoid:

  • Global Administrator
  • System Administrator

unless absolutely necessary.

Secure Credential Storage

Never hardcode:

  • passwords
  • API keys
  • connection strings

Instead use:

  • secure connections
  • credential vaults
  • managed identities where applicable

Data Protection

Protect:

  • customer records
  • financial data
  • HR information
  • healthcare information

Avoid displaying unnecessary sensitive information during automated sessions.

Network Security

Protect communication through:

  • HTTPS
  • encrypted connections
  • VPNs
  • private networking
  • firewall policies

Audit Logging

Maintain complete audit trails showing:

  • who started automation
  • when it ran
  • what actions occurred
  • whether it succeeded
  • data accessed

Governance Considerations

Large organizations should establish governance policies.

Examples include:

Approved Automation Catalog

Document:

  • automation purpose
  • owner
  • business unit
  • data sources
  • permissions
  • dependencies

Change Management

Whenever an application UI changes:

  • test automation
  • validate workflows
  • update selectors
  • redeploy safely

Never assume automation continues working after software upgrades.

Environment Separation

Maintain separate environments:

  • Development
  • Test
  • Production

This prevents accidental production disruptions.

Version Control

Maintain versions of:

  • Topics
  • Flows
  • Computer Use configurations
  • Prompt changes
  • Connectors

Versioning simplifies rollback.

Optimizing Computer Use

Optimization improves reliability.

Recommendations include:

Prefer Stable UI Elements

Avoid selecting:

  • moving icons
  • temporary banners
  • advertisements
  • notifications

Instead select:

  • permanent buttons
  • labeled controls
  • predictable navigation

Reduce Unnecessary Clicks

Instead of:

Home
→ Menu
→ Settings
→ Reports
→ Monthly

navigate directly when possible.

Fewer actions reduce failure risk.

Wait for Application Readiness

Do not click immediately after loading.

Allow sufficient time for:

  • pages
  • dialogs
  • data grids
  • forms

to finish loading.

Validate Before Continuing

Verify:

  • page loaded
  • expected button exists
  • confirmation displayed

before moving to the next step.

Handle Exceptions

Good automation plans for:

  • pop-up windows
  • invalid input
  • unavailable services
  • expired sessions
  • disconnected networks

Graceful recovery greatly improves reliability.

Common Troubleshooting Scenarios

Problem

Button cannot be found.

Possible causes:

  • UI changed
  • page not loaded
  • screen resolution changed
  • localization differences

Possible solutions:

  • retrain selector
  • increase wait time
  • verify application version

Problem

Automation clicks wrong location.

Possible causes:

  • window resized
  • scaling changed
  • UI redesign

Possible solutions:

  • use stable visual anchors
  • update automation
  • standardize display settings

Problem

Workflow times out.

Possible causes:

  • slow network
  • server delays
  • large reports
  • authentication latency

Possible solutions:

  • increase timeout
  • optimize workflow
  • improve infrastructure

Problem

Authentication repeatedly fails.

Possible causes:

  • expired credentials
  • password changes
  • MFA requirements
  • permission changes

Possible solutions:

  • update credentials
  • review authentication policies
  • validate permissions

Computer Use vs Traditional Automation

FeatureComputer UseAPI Automation
Works without APIsYesNo
Uses screen interactionYesNo
Faster executionUsually NoYes
More reliableLowerHigher
Sensitive to UI changesYesNo
Easier for legacy systemsYesSometimes
Structured responsesLimitedExcellent
PerformanceModerateHigh

More AB-620 Exam Tips

Remember these key points:

  • Computer Use automates graphical user interfaces.
  • It should generally be used only when APIs or connectors are unavailable or impractical.
  • UI changes can break automation.
  • Monitoring execution logs is essential for troubleshooting.
  • Apply least-privilege access.
  • Separate development, testing, and production environments.
  • Validate screen state before performing actions.
  • Use retries and exception handling to improve reliability.
  • Maintain audit logs for governance and compliance.
  • Prefer API-based automation when possible for performance and reliability.

AB-620 Practice Exam Questions

Question 1

A company must automate a legacy desktop application that provides no APIs or connectors. Which capability is the best choice?

A. Azure AI Search

B. Computer Use

C. Adaptive Cards

D. Generative Answers

Answer: B

Explanation:
Computer Use enables an agent to interact directly with a graphical user interface, making it suitable for legacy applications that lack APIs or connectors.

Question 2

Which monitoring metric is most useful for identifying whether an application’s interface has recently changed?

A. Number of licensed users

B. Storage capacity

C. Sudden increase in failed element recognition

D. Number of environments

Answer: C

Explanation:
A sudden rise in element recognition failures often indicates that the application’s user interface has changed, causing automation to fail.

Question 3

An administrator wants to minimize security risks when configuring Computer Use. What is the recommended approach?

A. Assign Global Administrator permissions to every automation account.

B. Store passwords directly in topics.

C. Disable audit logging.

D. Grant only the permissions required for the automation.

Answer: D

Explanation:
Following the principle of least privilege reduces security risks by limiting permissions to only those necessary for the automation.

Question 4

A workflow repeatedly fails because pages have not completely loaded before the next click occurs. Which change would most likely resolve the issue?

A. Reduce timeout values.

B. Disable logging.

C. Add waits or validation that the page has fully loaded before continuing.

D. Increase screen resolution.

Answer: C

Explanation:
Adding waits or verifying that a page is fully loaded helps prevent actions from occurring before the interface is ready.

Question 5

Which scenario is the strongest candidate for Computer Use?

A. Reading information from a well-documented REST API.

B. Querying Azure SQL Database through a connector.

C. Automating a Windows desktop application with no automation interface.

D. Calling a Power Automate flow.

Answer: C

Explanation:
Computer Use is designed for interacting with applications through their graphical interface when APIs or connectors are unavailable.

Question 6

What is the primary reason organizations maintain execution logs for Computer Use sessions?

A. To increase processor speed.

B. To improve internet bandwidth.

C. To provide troubleshooting, auditing, and compliance information.

D. To replace application backups.

Answer: C

Explanation:
Execution logs provide a record of actions, errors, timings, and outcomes that support troubleshooting, auditing, and regulatory compliance.

Question 7

Which practice improves the reliability of Computer Use automations?

A. Clicking elements immediately after opening every page.

B. Selecting temporary notification banners as navigation points.

C. Avoiding validation of page state.

D. Using stable interface elements and reducing unnecessary navigation.

Answer: D

Explanation:
Stable UI elements are less likely to change, and minimizing navigation reduces opportunities for failures.

Question 8

A company deploys Computer Use automations directly into production without testing. What is the greatest risk?

A. Faster execution.

B. Increased automation reliability.

C. Unexpected failures affecting production users.

D. Reduced logging information.

Answer: C

Explanation:
Skipping testing increases the likelihood that defects or UI incompatibilities will disrupt production processes.

Question 9

Which event is most likely to require updates to a Computer Use automation?

A. Increasing storage capacity.

B. A redesign of the target application’s user interface.

C. Adding another Microsoft 365 user.

D. Renaming a Dataverse table unrelated to the workflow.

Answer: B

Explanation:
Computer Use relies on visual interface elements. UI redesigns often require selectors or interaction logic to be updated.

Question 10

Why is API-based automation generally preferred over Computer Use when both options are available?

A. APIs require more manual interaction.

B. APIs always display a graphical interface.

C. APIs are typically faster, more reliable, and less affected by UI changes.

D. APIs cannot return structured data.

Answer: C

Explanation:
API-based automation communicates directly with backend services, avoiding screen interactions and making it more efficient and resilient than UI automation.

Go to the AB-620 Exam Prep Hub main page

AB-620, Agentic AI, AI, AI Governance, Microsoft Certification

Monitor agent flows (AB-620 Exam Prep)

 
This post is a part of the AB-620: Designing and Building Integrated AI Agent Solutions in Copilot Studio Exam Prep Hub.
This topic falls under these sections:
Plan and configure agent solutions (30–35%)
   --> Create and monitor agent flows in Copilot Studio
      --> Monitor agent flows

Note that there are 10 practice questions (with answers) at the end of each section to help you solidify your knowledge of the material. Also, there are 4 practice tests with 30 questions each available from the hub's main page below the exam topics section.

Introduction

Building an AI agent is only the first step in delivering business value. After deployment, organizations must continuously monitor agent flows to ensure they are functioning correctly, meeting business objectives, providing accurate responses, and operating securely.

Monitoring agent flows involves observing how conversations and automated workflows perform, identifying failures and bottlenecks, measuring business outcomes, and continuously improving the agent based on real-world usage. In Microsoft Copilot Studio, monitoring combines built-in analytics, Power Platform monitoring capabilities, Power Automate run history, Azure monitoring services (where applicable), and organizational governance processes.

For the AB-620 certification exam, you should understand what metrics to monitor, how to troubleshoot agent flows, how monitoring supports Responsible AI, and how continuous improvement helps maximize the value of AI solutions.

What Is Agent Flow Monitoring?

Agent flow monitoring is the ongoing process of observing, measuring, analyzing, and improving the execution of conversational and automated workflows.

Monitoring helps answer questions such as:

  • Are conversations completing successfully?
  • Are actions executing correctly?
  • Are connectors functioning properly?
  • Are users achieving their goals?
  • Are approvals completing on time?
  • Are errors increasing?
  • Are APIs responding efficiently?
  • Are enterprise integrations performing reliably?

Monitoring is an essential part of the agent lifecycle.

Goals of Monitoring

Effective monitoring helps organizations:

  • Improve user satisfaction
  • Detect failures quickly
  • Maintain service reliability
  • Optimize performance
  • Improve AI accuracy
  • Identify automation opportunities
  • Support compliance
  • Validate business outcomes
  • Reduce operational costs
  • Improve future agent versions

What Should Be Monitored?

Several aspects of an agent should be monitored.

Conversation Performance

Track:

  • Conversation success rate
  • Conversation completion rate
  • Abandonment rate
  • Average conversation duration
  • User satisfaction
  • Escalation rate
  • Conversation volume
  • Session length

These metrics indicate whether users are successfully completing tasks.

Agent Flow Performance

Monitor:

  • Flow execution time
  • Flow completion rate
  • Average processing time
  • Successful executions
  • Failed executions
  • Retry frequency
  • Timeout frequency

This helps identify inefficient workflows.

Action Performance

Monitor each configured action.

Examples include:

  • Success rate
  • Failure rate
  • Average execution time
  • Authentication failures
  • Permission failures
  • API response times

Poor-performing actions often affect the overall user experience.

Connector Health

External systems are critical dependencies.

Monitor:

  • Connector availability
  • API latency
  • Service outages
  • Authentication issues
  • Rate limiting
  • Failed requests
  • Connection health

Connector monitoring allows administrators to detect external issues before users report them.

Power Automate Monitoring

Many Copilot Studio agent flows invoke Power Automate.

Administrators should monitor:

  • Run history
  • Failed runs
  • Duration
  • Approval status
  • Retry attempts
  • Trigger failures
  • Flow bottlenecks

Power Automate provides detailed execution histories that simplify troubleshooting.

Error Monitoring

Errors should be categorized for faster diagnosis.

Common categories include:

Authentication Errors

Examples:

  • Invalid credentials
  • Expired tokens
  • Missing permissions

Authorization Errors

Examples:

  • Access denied
  • Role restrictions
  • DLP violations

API Errors

Examples:

  • HTTP 404
  • HTTP 500
  • HTTP 429
  • Service unavailable

Business Logic Errors

Examples:

  • Missing required fields
  • Invalid input
  • Failed validation
  • Duplicate records

Timeout Errors

Examples:

  • Slow APIs
  • Network delays
  • Long-running workflows

User Experience Metrics

Monitoring should include business-focused metrics.

Examples include:

  • Customer satisfaction
  • Resolution rate
  • First-contact resolution
  • Average handling time
  • Conversation quality
  • Task completion rate

These metrics measure business success rather than technical performance alone.

Human-in-the-Loop Monitoring

For approval-based workflows, monitor:

  • Approval completion time
  • Approval rate
  • Rejection rate
  • Escalation frequency
  • Timeout frequency
  • Manual intervention rate

Long approval delays may indicate process inefficiencies.

Responsible AI Monitoring

Responsible AI requires ongoing evaluation after deployment.

Monitor for:

  • Harmful outputs
  • Biased responses
  • Hallucinations
  • Toxic language
  • Unsafe recommendations
  • Privacy violations
  • Prompt injection attempts
  • Unexpected behavior

Responsible AI is an ongoing operational responsibility—not a one-time configuration.

Security Monitoring

Security monitoring should include:

  • Failed authentication attempts
  • Privilege escalation attempts
  • Unusual connector usage
  • Unauthorized access
  • Sensitive data exposure
  • DLP policy violations
  • Audit log activity

Security events should be investigated promptly.

Audit Logs

Audit logs record administrative and operational events.

Examples include:

  • Agent publication
  • Configuration changes
  • Connector updates
  • Authentication events
  • User access
  • Administrative actions
  • Flow executions

Audit logs support compliance and forensic investigations.

Performance Monitoring

Performance metrics include:

  • API response times
  • Connector latency
  • Flow duration
  • AI response generation time
  • Resource utilization
  • Queue lengths

Performance optimization improves overall user experience.

Capacity Monitoring

Organizations should monitor system capacity.

Examples include:

  • Number of conversations
  • Peak usage periods
  • Concurrent users
  • API quotas
  • Licensing consumption
  • Connector limits

Capacity planning helps prevent service degradation during periods of high demand.

Monitoring Knowledge Sources

If agents use enterprise knowledge sources, monitor:

  • Search accuracy
  • Citation quality
  • Document freshness
  • Index update frequency
  • Failed searches
  • Retrieval latency

Poor knowledge quality directly impacts AI response quality.

Alerts and Notifications

Administrators should configure alerts for critical events.

Examples include:

  • Flow failures
  • Connector outages
  • High error rates
  • Authentication failures
  • Approval delays
  • Service degradation

Early notification reduces downtime.

Root Cause Analysis

When failures occur, investigate systematically.

Typical steps:

  1. Identify the failed flow.
  2. Review execution history.
  3. Examine error messages.
  4. Verify connector health.
  5. Validate authentication.
  6. Review input data.
  7. Test affected actions.
  8. Confirm resolution.

Root cause analysis prevents recurring issues.

Continuous Improvement

Monitoring supports continuous optimization.

Typical improvements include:

  • Simplifying conversations
  • Reducing API calls
  • Improving prompts
  • Optimizing Power Automate flows
  • Updating knowledge sources
  • Improving error handling
  • Refining approval workflows
  • Improving connector performance

Continuous improvement is a core operational practice.

Monitoring Dashboards

Organizations often build dashboards displaying:

  • Conversation volume
  • Success rates
  • Failed flows
  • Approval statistics
  • Connector health
  • API performance
  • User satisfaction
  • Trend analysis

Dashboards provide operational visibility for administrators.

Common Monitoring Tools

Depending on the solution architecture, monitoring may involve:

  • Copilot Studio analytics
  • Power Platform Admin Center
  • Power Automate run history
  • Microsoft Dataverse analytics
  • Azure Monitor
  • Application Insights
  • Microsoft Purview Audit (where applicable)
  • Microsoft Defender tools (for security monitoring)

Different tools provide different operational insights.

Best Practices

  • Monitor both technical and business metrics.
  • Establish performance baselines.
  • Configure proactive alerts.
  • Monitor external dependencies.
  • Review failed conversations regularly.
  • Investigate recurring errors.
  • Continuously improve prompts and flows.
  • Track Responsible AI metrics.
  • Audit security events.
  • Review monitoring dashboards routinely.

Common Mistakes

Avoid:

  • Monitoring only technical metrics
  • Ignoring user satisfaction
  • Waiting for users to report failures
  • Ignoring connector performance
  • Missing security events
  • Overlooking approval bottlenecks
  • Failing to investigate recurring errors
  • Neglecting audit logs

Exam Tips

For the AB-620 exam, remember these key points:

  • Monitoring continues throughout the agent’s operational lifecycle.
  • Measure both business outcomes and technical performance.
  • Monitor conversations, flows, connectors, APIs, approvals, and knowledge sources.
  • Power Automate run history is valuable for troubleshooting workflow execution.
  • Configure alerts for failures, outages, and abnormal behavior.
  • Responsible AI requires ongoing monitoring for bias, harmful outputs, hallucinations, and unsafe responses.
  • Audit logs support governance, compliance, and troubleshooting.
  • Security monitoring includes authentication failures, unauthorized access attempts, and DLP policy violations.
  • Capacity monitoring helps prevent service degradation during peak usage.
  • Continuous improvement is driven by insights gathered through monitoring.

Practice Exam Questions

Question 1

An administrator wants to determine whether users are successfully completing conversations with a Copilot Studio agent. Which metric is the most appropriate?

A. Conversation completion rate

B. Number of published topics

C. Number of connector definitions

D. Environment storage capacity

Correct Answer: A

Explanation: Conversation completion rate measures how often users successfully finish their intended interactions, making it a key indicator of agent effectiveness.

Question 2

A Copilot Studio agent invokes a Power Automate flow that unexpectedly fails. Which tool should an administrator review first?

A. Microsoft Word

B. Power Automate run history

C. Outlook calendar

D. Microsoft Teams chat history

Correct Answer: B

Explanation: Power Automate run history provides detailed execution information, including failed steps, error messages, duration, and retry attempts.

Question 3

Which metric best measures the responsiveness of an external connector?

A. Conversation abandonment rate

B. Approval rate

C. API response time

D. Number of published agents

Correct Answer: C

Explanation: API response time directly reflects the performance of external services accessed through connectors.

Question 4

Which monitoring activity best supports Responsible AI?

A. Tracking only conversation volume

B. Monitoring for harmful responses, hallucinations, bias, and unsafe outputs

C. Monitoring storage capacity only

D. Counting published topics

Correct Answer: B

Explanation: Responsible AI requires continuous evaluation of AI-generated responses to detect bias, hallucinations, harmful content, and other undesirable behaviors.

Question 5

A manager consistently takes several days to approve purchase requests, causing business delays. Which metric would best identify this issue?

A. Approval completion time

B. Number of conversation topics

C. Connector authentication type

D. AI model version

Correct Answer: A

Explanation: Approval completion time measures how long human approval steps take and helps identify bottlenecks in human-in-the-loop workflows.

Question 6

Why should organizations configure alerts for flow failures?

A. To increase licensing capacity

B. To automatically create new agents

C. To notify administrators quickly so issues can be investigated and resolved

D. To eliminate audit logs

Correct Answer: C

Explanation: Proactive alerts enable administrators to respond quickly to failures, minimizing downtime and improving service reliability.

Question 7

Which monitoring activity is most useful for identifying recurring authentication problems?

A. Reviewing failed authentication events and audit logs

B. Counting conversation variables

C. Reviewing Adaptive Card layouts

D. Measuring conversation length only

Correct Answer: A

Explanation: Authentication failures and audit logs help identify expired credentials, permission issues, or unauthorized access attempts.

Question 8

What is the primary purpose of performing root cause analysis after a failed agent flow?

A. To increase API quotas

B. To determine why the failure occurred and prevent similar issues in the future

C. To redesign all conversation topics

D. To replace all connectors

Correct Answer: B

Explanation: Root cause analysis identifies the underlying cause of failures, allowing organizations to implement permanent corrective actions.

Question 9

Which metric helps determine whether an agent is providing business value rather than simply functioning correctly?

A. User satisfaction and task completion rate

B. Number of connector configurations

C. Number of environment variables

D. Count of published solutions

Correct Answer: A

Explanation: Business-oriented metrics such as user satisfaction and task completion measure how effectively the agent meets organizational objectives.

Question 10

Why is capacity monitoring important for Copilot Studio agents?

A. It prevents all API errors.

B. It eliminates connector authentication.

C. It helps organizations understand usage patterns, anticipate peak demand, and avoid service degradation.

D. It automatically optimizes prompts.

Correct Answer: C

Explanation: Capacity monitoring tracks conversation volume, concurrent users, licensing usage, and API quotas, enabling organizations to scale resources appropriately and maintain reliable performance.

Go to the AB-620 Exam Prep Hub main page

AB-620, Agentic AI, AI, AI Governance, Microsoft Certification

Create a human-in-the-loop agent flow (AB-620 Exam Prep)

 
This post is a part of the AB-620: Designing and Building Integrated AI Agent Solutions in Copilot Studio Exam Prep Hub.
This topic falls under these sections:
Plan and configure agent solutions (30–35%)
   --> Create and monitor agent flows in Copilot Studio
      --> Create a human-in-the-loop agent flow

Note that there are 10 practice questions (with answers) at the end of each section to help you solidify your knowledge of the material. Also, there are 4 practice tests with 30 questions each available from the hub's main page below the exam topics section.

Introduction

While AI agents can automate many business processes, not every task should be completed autonomously. Many enterprise workflows require human judgment, approval, verification, or intervention before an action is completed. This design pattern is known as Human-in-the-Loop (HITL).

In Microsoft Copilot Studio, a human-in-the-loop agent flow combines AI-driven automation with human decision-making. The AI agent performs repetitive, deterministic, or data-intensive tasks, while a human reviews, approves, rejects, or modifies actions that require discretion or accountability.

Human-in-the-loop workflows are especially important in regulated industries, high-value transactions, legal processes, healthcare, finance, and any scenario where AI recommendations should be reviewed before execution.

For the AB-620 exam, you should understand when to use human-in-the-loop workflows, how to design them, how they integrate with Power Automate and enterprise systems, and how they support Responsible AI and governance.

What Is Human-in-the-Loop?

Human-in-the-loop (HITL) is a workflow pattern in which an AI agent collaborates with one or more human users to complete a business process.

Instead of allowing the AI to make every decision independently, the workflow pauses when human judgment is required.

Typical process:

  1. User submits a request.
  2. AI gathers information.
  3. AI performs automated tasks.
  4. AI requests human review or approval.
  5. Human approves, rejects, or modifies the request.
  6. AI completes the remaining workflow.

Why Human-in-the-Loop Is Important

Human review provides additional oversight for actions that may have financial, legal, ethical, or operational consequences.

Benefits include:

  • Improved accuracy
  • Better decision-making
  • Regulatory compliance
  • Reduced business risk
  • Increased accountability
  • Human oversight of AI recommendations
  • Better customer outcomes
  • Support for Responsible AI principles

Common Human-in-the-Loop Scenarios

Examples include:

  • Expense approvals
  • Vacation requests
  • Purchase requests
  • Contract approvals
  • Loan applications
  • Insurance claims
  • Medical referrals
  • Employee onboarding approvals
  • High-value refund requests
  • Customer complaint escalations

In each scenario, AI assists the process while humans retain final authority.

Human-in-the-Loop vs Fully Automated Flows

Fully Automated FlowHuman-in-the-Loop Flow
No human interventionHuman review required
Best for routine tasksBest for judgment-based tasks
Faster executionGreater oversight
Lower operational costHigher confidence
Suitable for deterministic processesSuitable for exceptions and sensitive decisions

Components of a Human-in-the-Loop Flow

A typical workflow includes several stages.

1. User Request

The user initiates the process.

Examples:

  • Submit expense report
  • Request refund
  • Approve invoice
  • Create purchase request

2. Data Collection

The agent gathers all required information.

Examples:

  • Employee ID
  • Customer account
  • Purchase amount
  • Supporting documents
  • Business justification

The AI validates the information before proceeding.

3. Automated Processing

The agent performs automated work such as:

  • Looking up records
  • Checking policies
  • Calculating totals
  • Retrieving customer information
  • Validating eligibility
  • Calling enterprise APIs

Automation reduces manual effort before human review.

4. Decision Point

At a predefined point, the workflow determines whether human review is necessary.

Conditions may include:

  • Amount exceeds approval limit
  • Sensitive customer information
  • Regulatory requirement
  • Confidence score below threshold
  • Exception detected
  • Policy violation
  • Missing information

If no review is required, automation may continue.

5. Human Review

A human reviewer receives the request.

Common reviewers include:

  • Manager
  • Supervisor
  • HR representative
  • Finance approver
  • Compliance officer
  • Customer support specialist

The reviewer evaluates the request.

6. Human Decision

Possible outcomes include:

  • Approve
  • Reject
  • Request additional information
  • Modify request
  • Escalate

The workflow resumes after the decision.

7. Completion

The agent completes the remaining tasks.

Examples:

  • Update database
  • Notify user
  • Create record
  • Send confirmation email
  • Archive documents

Approval Workflows

One of the most common human-in-the-loop scenarios is approval processing.

Examples:

  • Expense approval
  • Purchase approval
  • Leave approval
  • Document approval
  • Contract approval

Power Automate provides built-in approval capabilities that integrate well with Copilot Studio.

Power Automate Integration

Many human-in-the-loop workflows delegate approval logic to Power Automate.

Typical process:

Copilot Studio

↓

Power Automate

↓

Approval

↓

Manager decision

↓

Return result to agent

Power Automate simplifies:

  • Approval routing
  • Notifications
  • Escalations
  • Timeouts
  • Audit history

Notifications

Human reviewers must be informed when action is required.

Notifications may be sent through:

  • Microsoft Teams
  • Outlook email
  • Mobile notifications
  • Power Automate
  • Business applications

Prompt notification reduces workflow delays.

Handling Timeouts

Human reviewers may not respond immediately.

Possible timeout strategies include:

  • Send reminder
  • Escalate to another approver
  • Cancel request
  • Auto-close request
  • Retry notification

Timeout planning improves workflow reliability.

Escalation

Organizations often define escalation rules.

Examples:

  • Manager unavailable
  • Approval exceeds time limit
  • High-priority request
  • Compliance review required

Escalations ensure requests continue moving through the process.

Exception Handling

Human-in-the-loop workflows should anticipate exceptions.

Examples:

  • Missing documents
  • Invalid requests
  • Authentication failures
  • API errors
  • Approval system unavailable
  • Reviewer unavailable

Graceful exception handling improves reliability.

Responsible AI Considerations

Human oversight is an important Responsible AI practice.

Humans should review:

  • High-impact recommendations
  • Financial decisions
  • Medical information
  • Legal recommendations
  • Employment decisions
  • Sensitive customer interactions

AI assists—not replaces—human judgment in these scenarios.

Security Considerations

Human-in-the-loop workflows often involve sensitive data.

Security planning should include:

  • Microsoft Entra ID authentication
  • Role-Based Access Control (RBAC)
  • Least privilege
  • Secure approval routing
  • Audit logging
  • Data Loss Prevention (DLP)
  • Secure connectors

Only authorized reviewers should approve requests.

Audit Logging

Approval workflows should maintain complete audit trails.

Logs may include:

  • Requestor
  • Approver
  • Timestamp
  • Decision
  • Comments
  • Workflow status
  • System actions

Audit logs support compliance and troubleshooting.

Designing Effective Human Reviews

Human review steps should be:

  • Clearly defined
  • Easy to complete
  • Limited to necessary information
  • Consistent
  • Secure
  • Well documented

Overly complex approval processes reduce efficiency.

Best Practices

When designing human-in-the-loop agent flows:

  • Automate repetitive tasks.
  • Involve humans only where judgment is required.
  • Define clear approval criteria.
  • Use Power Automate approvals when appropriate.
  • Notify reviewers promptly.
  • Plan escalation paths.
  • Handle timeouts gracefully.
  • Log every decision.
  • Protect sensitive information.
  • Continuously monitor workflow performance.

Common Design Mistakes

Avoid:

  • Requiring unnecessary approvals
  • Allowing AI to make high-risk decisions autonomously
  • Missing audit logs
  • Ignoring timeout scenarios
  • Poor notification design
  • Overcomplicated approval chains
  • Excessive reviewer permissions
  • Missing exception handling

Monitoring Human-in-the-Loop Flows

Monitor metrics such as:

  • Average approval time
  • Approval rate
  • Rejection rate
  • Escalation frequency
  • Timeout frequency
  • Workflow completion rate
  • Automation success rate
  • User satisfaction

These metrics help optimize workflow efficiency.

Exam Tips

For the AB-620 exam, remember the following:

  • Human-in-the-loop combines AI automation with human decision-making.
  • Use HITL for high-impact, judgment-based, or regulated business processes.
  • Power Automate approvals commonly support human review workflows.
  • Decision points determine whether human intervention is required.
  • Approval workflows should include notifications, escalation, and timeout handling.
  • Responsible AI encourages human oversight for sensitive decisions.
  • Audit logging is essential for governance and compliance.
  • Apply RBAC and least-privilege access to reviewers.
  • Monitor approval times and workflow performance after deployment.
  • Automate routine work while reserving human effort for decisions requiring expertise.

Practice Exam Questions

Question 1

An organization wants managers to approve employee expense reports before reimbursement is issued. Which workflow design is most appropriate?

A. A fully autonomous AI agent that always approves expenses

B. A human-in-the-loop agent flow with a manager approval step

C. A public chatbot with anonymous access

D. A static FAQ topic

Correct Answer: B

Explanation: Expense approvals involve financial accountability and often require managerial judgment. A human-in-the-loop workflow allows the AI to automate data collection and validation while the manager makes the final approval decision.

Question 2

At what point in a human-in-the-loop workflow should the process pause?

A. Immediately after the user opens the conversation

B. Before collecting any information

C. When a predefined condition indicates that human review is required

D. After the workflow has already completed

Correct Answer: C

Explanation: Human review should occur only when predefined business rules, policy requirements, or confidence thresholds indicate that human judgment is needed.

Question 3

Which Microsoft service is commonly used to implement approval workflows that integrate with Copilot Studio?

A. Microsoft Paint

B. Azure Virtual Machines

C. Microsoft Word

D. Power Automate

Correct Answer: D

Explanation: Power Automate provides built-in approval actions, notification capabilities, escalation options, and workflow orchestration that integrate seamlessly with Copilot Studio.

Question 4

Which scenario is the best candidate for a fully automated agent flow instead of a human-in-the-loop workflow?

A. Approving multi-million-dollar contracts

B. Determining employee disciplinary actions

C. Retrieving a customer’s order status

D. Reviewing legal agreements

Correct Answer: C

Explanation: Retrieving order status is a deterministic task that typically requires no human judgment, making it ideal for full automation.

Question 5

Why is audit logging especially important in human-in-the-loop workflows?

A. It reduces authentication requirements.

B. It records approval decisions, timestamps, and workflow history for compliance and accountability.

C. It eliminates the need for notifications.

D. It replaces business policies.

Correct Answer: B

Explanation: Audit logs provide a record of who approved or rejected requests, when decisions were made, and how the workflow progressed, supporting governance and regulatory compliance.

Question 6

A workflow requires a supervisor to review refund requests over $5,000. What determines whether the approval step is executed?

A. Conversation greeting

B. Adaptive Card color

C. A conditional decision within the workflow

D. Conversation transcript length

Correct Answer: C

Explanation: Conditional logic evaluates predefined business rules—such as refund amount—to determine whether human approval is required.

Question 7

Which Responsible AI principle is most directly supported by human-in-the-loop workflows?

A. Eliminating all human involvement

B. Allowing AI to make all decisions independently

C. Providing human oversight for high-impact decisions

D. Preventing workflow automation

Correct Answer: C

Explanation: Human oversight helps ensure that important decisions involving ethics, safety, legal requirements, or significant business impact are reviewed by qualified individuals.

Question 8

A manager does not respond to an approval request within the required timeframe. What should a well-designed human-in-the-loop workflow do?

A. Wait indefinitely

B. Automatically delete the request

C. Skip the approval and continue processing

D. Execute a timeout strategy such as sending reminders or escalating the request

Correct Answer: D

Explanation: Timeout handling helps prevent workflows from stalling indefinitely by sending reminders, escalating to another approver, or taking another predefined action.

Question 9

Which security practice is most appropriate for reviewers participating in a human-in-the-loop workflow?

A. Grant every reviewer Global Administrator permissions

B. Allow anonymous approvals

C. Apply role-based access control and least-privilege permissions

D. Disable authentication to simplify approvals

Correct Answer: C

Explanation: Reviewers should only receive the permissions necessary to perform their approval responsibilities, reducing security risk while maintaining accountability.

Question 10

Which statement best describes the purpose of a human-in-the-loop agent flow?

A. To eliminate human participation from business processes

B. To automate routine work while incorporating human judgment where appropriate

C. To replace enterprise approval systems entirely

D. To prevent AI from interacting with external systems

Correct Answer: B

Explanation: Human-in-the-loop workflows combine the speed and efficiency of AI automation with human expertise for decisions that require judgment, compliance, or accountability.

Go to the AB-620 Exam Prep Hub main page

AB-620, Agentic AI, AI, AI Governance, AI Strategy, Microsoft Certification

Plan reusable agent components (AB-620 Exam Prep)

 
This post is a part of the AB-620: Designing and Building Integrated AI Agent Solutions in Copilot Studio Exam Prep Hub.
This topic falls under these sections:
Plan and configure agent solutions (30–35%)
   --> Plan an agent solution
      --> Plan reusable agent components

Note that there are 10 practice questions (with answers) at the end of each section to help you solidify your knowledge of the material. Also, there are 4 practice tests with 30 questions each available from the hub's main page below the exam topics section.

Introduction

One of the primary goals of enterprise software development is reuse. Rather than recreating the same functionality multiple times, organizations design components that can be shared across projects, reducing development effort, improving consistency, and simplifying maintenance.

This principle is equally important when designing AI agents in Microsoft Copilot Studio. Organizations often build multiple agents for different departments—such as HR, IT, Finance, Sales, Customer Service, and Operations—that perform similar tasks or use the same enterprise resources. By planning reusable agent components, organizations can reduce duplication, accelerate development, improve governance, and provide a consistent user experience.

For the AB-620 exam, you should understand how to identify reusable components, determine when they should be shared, and plan architectures that maximize reuse while maintaining security, scalability, and maintainability.

What Are Reusable Agent Components?

Reusable agent components are features, resources, or capabilities that can be used by multiple AI agents instead of being recreated for each solution.

Examples include:

  • Knowledge sources
  • Topics
  • Prompt templates
  • Tools
  • Connectors
  • REST API definitions
  • Child agents
  • Connected agents
  • Variables
  • Adaptive Card templates
  • Power Automate flows
  • Authentication configurations
  • Security policies
  • Conversation patterns

Rather than building these repeatedly, they can be designed once and leveraged across multiple AI solutions.

Why Reusability Matters

Planning reusable components provides numerous benefits.

Benefits include:

  • Faster development
  • Reduced maintenance
  • Lower implementation costs
  • Consistent user experience
  • Improved governance
  • Easier testing
  • Better security
  • Simplified updates
  • Reduced duplication
  • Greater scalability

Instead of updating ten separate implementations, developers update a single reusable component.

Characteristics of Good Reusable Components

Reusable components should be:

  • Modular
  • Independent
  • Well documented
  • Secure
  • Configurable
  • Maintainable
  • Reliable
  • Scalable
  • Versioned

Components should solve a specific problem without being tightly coupled to a single AI agent.

Identifying Reusable Functionality

During planning, architects should identify common business capabilities.

Examples include:

  • Password reset
  • Employee directory lookup
  • Leave balance retrieval
  • Knowledge search
  • Ticket creation
  • Appointment scheduling
  • Customer profile lookup
  • Product search
  • Status inquiries
  • FAQ responses

If multiple agents require the same capability, it is a strong candidate for reuse.

Reusable Topics

Topics define conversation logic within Copilot Studio.

Examples of reusable topics include:

  • Greeting users
  • Authentication
  • Collecting user information
  • Escalating to human agents
  • Error handling
  • Help requests
  • Feedback collection

Instead of recreating these conversations for every agent, organizations can standardize their design.

Benefits include:

  • Consistent conversations
  • Easier updates
  • Reduced testing effort

Reusable Prompt Templates

Many agents use similar prompts when interacting with generative AI.

Examples include:

  • Summarization prompts
  • Email drafting prompts
  • Translation prompts
  • Sentiment analysis prompts
  • Document analysis prompts
  • Classification prompts

Prompt templates provide:

  • Consistency
  • Improved AI output quality
  • Easier prompt engineering
  • Simplified maintenance

Planning reusable prompts also supports Responsible AI by promoting consistent instructions and reducing prompt variability.

Reusable Knowledge Sources

Enterprise knowledge is often shared across multiple departments.

Examples include:

  • HR policies
  • Employee handbook
  • Product documentation
  • Technical documentation
  • Internal procedures
  • Company FAQs

Rather than duplicating these resources, multiple agents can reference the same approved knowledge repositories.

Knowledge sources may include:

  • SharePoint
  • Microsoft Dataverse
  • Azure AI Search indexes
  • Approved websites
  • Internal document libraries

Shared knowledge promotes consistency and reduces conflicting answers.

Reusable Tools

Tools enable AI agents to perform actions.

Examples include:

  • Connector-based tools
  • REST API tools
  • Custom actions
  • Power Automate flows
  • Model Context Protocol (MCP) tools

Reusable tools can perform common business functions such as:

  • Create support tickets
  • Retrieve customer information
  • Update CRM records
  • Send notifications
  • Query inventory
  • Schedule appointments

A single tool can be shared across multiple agents.

Reusable Connectors

Many organizations connect agents to the same enterprise systems.

Examples include:

  • Microsoft Dynamics 365
  • Microsoft Dataverse
  • Microsoft SharePoint
  • Microsoft Teams
  • Microsoft Outlook
  • SAP
  • ServiceNow
  • Salesforce

Instead of creating multiple integrations, organizations should reuse existing connectors whenever possible.

Benefits include:

  • Lower maintenance
  • Consistent authentication
  • Simplified governance

Reusable Power Automate Flows

Power Automate flows often encapsulate business logic that multiple agents require.

Examples include:

  • Creating approval requests
  • Sending notifications
  • Updating databases
  • Creating tickets
  • Synchronizing systems
  • Processing forms

Rather than embedding identical logic into every agent, reusable flows centralize business processes.

Child Agents

One of the most powerful reusable components in Copilot Studio is the child agent.

A child agent performs specialized tasks on behalf of one or more parent agents.

Example:

A company has:

  • HR Agent
  • IT Agent
  • Finance Agent
  • Facilities Agent

All four agents require identity verification before completing sensitive requests.

Instead of implementing verification four times, a reusable Identity Verification Child Agent performs authentication for every parent agent.

Benefits include:

  • Centralized maintenance
  • Consistent behavior
  • Reduced duplication
  • Easier governance

Connected Agents

Connected agents enable multiple specialized agents to collaborate.

Rather than creating one large monolithic agent, organizations build smaller agents that focus on specific business domains.

Example:

Customer Service Agent

↓

Delegates to:

  • Billing Agent
  • Shipping Agent
  • Product Support Agent

Each specialized agent becomes reusable across multiple solutions.

Adaptive Card Templates

Adaptive Cards frequently display:

  • Forms
  • Approval requests
  • Employee information
  • Order summaries
  • Customer records

Instead of redesigning these interfaces repeatedly, organizations create reusable templates.

Benefits include:

  • Consistent UI
  • Easier maintenance
  • Faster development

Reusable Authentication

Authentication workflows are excellent candidates for reuse.

Examples include:

  • Microsoft Entra ID authentication
  • OAuth authentication
  • User verification
  • Multi-Factor Authentication (MFA)
  • Single Sign-On (SSO)

Using standardized authentication components improves both security and consistency.

Reusable Conversation Patterns

Many conversation patterns appear repeatedly.

Examples include:

  • Greeting users
  • Asking clarification questions
  • Confirming actions
  • Handling errors
  • Escalating conversations
  • Ending conversations

Standardizing these interactions improves the overall user experience.

Versioning Reusable Components

Reusable components evolve over time.

Organizations should maintain versions of:

  • Child agents
  • Prompt templates
  • Power Automate flows
  • API definitions
  • Knowledge sources

Versioning enables:

  • Safe updates
  • Rollback capabilities
  • Controlled deployments
  • Backward compatibility

Governance Considerations

Shared components should follow governance standards.

Planning should include:

  • Ownership
  • Documentation
  • Approval process
  • Version control
  • Security reviews
  • Testing
  • Monitoring
  • Change management

Clear governance prevents uncontrolled modifications.

Security Considerations

Reusable components often access enterprise resources.

Architects should ensure:

  • Least privilege permissions
  • Secure authentication
  • Secure connectors
  • Data Loss Prevention (DLP)
  • Audit logging
  • Role-Based Access Control (RBAC)

Security should never be sacrificed for reuse.

Designing Modular Components

Good reusable components follow modular design principles.

Each component should:

  • Perform one primary function
  • Have clearly defined inputs
  • Produce predictable outputs
  • Avoid unnecessary dependencies
  • Support multiple use cases

Modularity simplifies testing and maintenance.

When Not to Reuse

Not every component should be reused.

Avoid reuse when:

  • Logic is highly specific to one department.
  • Security requirements differ significantly.
  • Regulatory requirements require isolation.
  • Business rules are unique.
  • Performance would be negatively affected.

Reuse should never compromise maintainability or security.

Common Mistakes

Avoid these common mistakes:

  • Duplicating identical functionality across agents
  • Creating overly complex reusable components
  • Ignoring version control
  • Hardcoding configuration values
  • Sharing components without documentation
  • Reusing components with excessive permissions
  • Failing to test shared components after updates
  • Not assigning ownership

Best Practices

When planning reusable agent components:

  • Identify common functionality early in the design process.
  • Build modular, independent components.
  • Reuse child agents for specialized tasks.
  • Reuse connectors and Power Automate flows whenever possible.
  • Centralize enterprise knowledge sources.
  • Standardize prompt templates and conversation patterns.
  • Use Adaptive Card templates for consistent user interfaces.
  • Implement version control and governance.
  • Document reusable components thoroughly.
  • Continuously monitor and maintain shared assets.

Exam Tips

For the AB-620 exam, remember the following:

  • Reusable components reduce duplication and improve maintainability.
  • Child agents are ideal for reusable specialized business capabilities.
  • Connected agents enable collaboration between specialized AI agents.
  • Prompt templates improve consistency and simplify prompt engineering.
  • Shared knowledge sources help reduce inconsistent responses.
  • Power Automate flows encapsulate reusable business logic.
  • Adaptive Card templates provide reusable user interfaces.
  • Reusable connectors simplify enterprise integrations.
  • Version control is essential for shared components.
  • Reuse should improve efficiency without compromising security or governance.

Practice Exam Questions

Question 1

An organization has five different AI agents that all need to verify a user’s identity before performing sensitive operations. What is the most effective reusable design?

A. Implement separate identity verification logic within each agent.

B. Create a reusable child agent that performs identity verification for all parent agents.

C. Require each department to create its own authentication workflow.

D. Disable authentication to simplify the user experience.

Correct Answer: B

Explanation: A child agent is designed to encapsulate specialized functionality that can be reused by multiple parent agents. Centralizing identity verification improves consistency, reduces duplication, and simplifies maintenance.

Question 2

Which component is best suited for encapsulating reusable business processes such as sending approval requests or updating records in multiple systems?

A. Adaptive Card template

B. Conversation variable

C. Power Automate flow

D. Greeting topic

Correct Answer: C

Explanation: Power Automate flows encapsulate business logic and integrations, allowing multiple agents to reuse the same automated processes without duplicating implementation.

Question 3

Why should organizations use reusable prompt templates when developing multiple AI agents?

A. They eliminate the need for enterprise knowledge sources.

B. They reduce authentication requirements.

C. They ensure consistent AI instructions and simplify prompt maintenance.

D. They automatically create connectors.

Correct Answer: C

Explanation: Reusable prompt templates provide consistent instructions to the AI model, improve maintainability, and reduce the effort required to update prompts across multiple agents.

Question 4

Multiple AI agents need access to the same employee handbook and HR policies. What is the best architectural approach?

A. Copy the documents into each individual agent.

B. Store separate versions for each department.

C. Use different knowledge sources for every agent.

D. Use a shared enterprise knowledge repository that all authorized agents can access.

Correct Answer: D

Explanation: A centralized knowledge source ensures that all agents provide consistent, up-to-date information while reducing duplication and maintenance effort.

Question 5

Which characteristic is most important for a reusable agent component?

A. It should be tightly coupled to one specific business process.

B. It should perform a single well-defined function with minimal dependencies.

C. It should contain multiple unrelated capabilities.

D. It should require administrator permissions regardless of purpose.

Correct Answer: B

Explanation: Reusable components should be modular, focused on a single responsibility, and loosely coupled so they can be easily maintained and reused.

Question 6

Which reusable component helps standardize the appearance and layout of forms, approval requests, and information cards across multiple agents?

A. Adaptive Card template

B. REST API definition

C. Azure AI Search index

D. Environment variable

Correct Answer: A

Explanation: Adaptive Card templates provide reusable user interface layouts that ensure consistency while reducing duplicate design work.

Question 7

An organization wants specialized Billing, Shipping, and Technical Support agents to collaborate with a Customer Service agent. Which design approach best supports this requirement?

A. Create one large monolithic agent that handles every task.

B. Use connected agents that delegate requests to specialized agents.

C. Duplicate billing logic into every agent.

D. Build independent agents with no communication between them.

Correct Answer: B

Explanation: Connected agents allow specialized agents to collaborate, improving scalability, maintainability, and reuse across multiple business scenarios.

Question 8

Why is version control important for reusable agent components?

A. It eliminates the need for documentation.

B. It prevents components from being shared.

C. It enables controlled updates, rollback capabilities, and compatibility management.

D. It automatically creates new AI models.

Correct Answer: C

Explanation: Version control allows organizations to safely update shared components, roll back changes when necessary, and manage compatibility across multiple dependent agents.

Question 9

Which planning consideration helps ensure reusable components remain secure?

A. Grant every reusable component global administrator permissions.

B. Allow all agents unrestricted access to every connector.

C. Avoid documenting shared components.

D. Apply least-privilege permissions, RBAC, and governance policies to shared components.

Correct Answer: D

Explanation: Reusable components should follow the same security principles as any enterprise solution by using least privilege, role-based access control, and established governance practices.

Question 10

Which situation is least appropriate for creating a reusable component?

A. Multiple agents need the same ticket creation process.

B. Several departments use the same authentication workflow.

C. A business process is highly specialized, unique to one department, and subject to different regulatory requirements.

D. Multiple agents display the same approval form.

Correct Answer: C

Explanation: Reuse is most beneficial for common functionality. Highly specialized or regulated processes that differ significantly between departments are often better implemented as separate components to avoid unnecessary complexity or compliance risks.

Go to the AB-620 Exam Prep Hub main page