Tag: Microsoft Defender for Cloud Apps

azure, Azure AI, Microsoft Certification, SC-500, security

Enable and configure real-time protection for Microsoft Copilot Studio agents (SC-500 Exam Prep)

 
This post is a part of the "SC-500: Implementing End-to-End Security Controls for Cloud and AI Workloads" Exam Prep Hub.
This topic falls under these sections:
Secure compute (20–25%)
   --> Implement security for AI
      --> Enable and configure real-time protection for Microsoft Copilot Studio agents

Note that there are 10 practice questions (with answers) at the end of each section to help you solidify your knowledge of the material. Also, there are 4 practice tests with 30 questions each available from the hub's main page below the exam topics section.

Introduction

This topic covers how to use Microsoft Defender for Cloud Apps and Microsoft Defender XDR to provide runtime protection for agents created with Microsoft Copilot Studio.

You should understand how to:

  • Describe the security risks associated with AI agents.
  • Enable real-time protection for Copilot Studio agents.
  • Coordinate configuration between Microsoft Defender and Power Platform.
  • Configure the required Microsoft Entra application ID.
  • Understand how suspicious agent actions are detected and blocked.
  • Review agent inventory, alerts, incidents, and Advanced Hunting data.
  • Distinguish runtime protection from post-event investigation and governance.

Why Copilot Studio agents require runtime protection

AI agents can do more than generate text. Depending on their configuration, they may:

  • Retrieve information from enterprise data sources.
  • Invoke connectors and tools.
  • Call APIs.
  • Execute workflows.
  • Send messages.
  • Create or update records.
  • Perform actions on behalf of users.
  • Make decisions based on natural-language instructions.

This introduces risks that are different from those associated with a traditional application. An attacker or malicious user may attempt to manipulate an agent into performing an unsafe action, accessing information it should not use, or disclosing sensitive data.

Examples include:

  • Prompt injection.
  • Cross-prompt injection attacks.
  • Malicious or unexpected tool invocation.
  • Attempts to access protected information.
  • Data exfiltration.
  • Use of an agent to perform unauthorized actions.
  • Abuse of excessive agent permissions.

Real-time protection helps reduce these risks by evaluating agent activity during runtime and blocking suspicious actions before they execute. Microsoft Defender for Cloud Apps provides this protection for supported Copilot Studio agent scenarios.

What is real-time protection?

Real-time protection is a security capability that evaluates an AI agent’s activity while the agent is operating.

For Copilot Studio agents, protection evaluates tool invocations before the tools execute. If Microsoft Defender identifies suspicious behavior or a supported attack pattern, the proposed action can be blocked.

The protection process can be summarized as follows:

  1. A user sends a prompt to an agent.
  2. The agent interprets the request.
  3. The agent considers invoking a tool, connector, or action.
  4. Microsoft Defender evaluates the proposed invocation.
  5. If the action is considered safe, the agent continues.
  6. If the action is considered risky, the invocation is blocked.
  7. Depending on the configuration and integration status, an alert or incident may be created in Microsoft Defender XDR.

This approach is designed to prevent unsafe actions rather than merely report them after they occur.

Microsoft Defender for Cloud Apps and Copilot Studio

The SC-500 learning objective identifies Microsoft Defender for Cloud Apps as the service used to provide runtime protection for Copilot Studio agents.

Microsoft Defender for Cloud Apps supplies the security integration, while Copilot Studio and Power Platform provide the agent runtime and configuration.

The integration requires coordination between:

  • A Microsoft Defender administrator.
  • A Power Platform administrator.
  • The Microsoft Entra application used by the agent integration.

The Defender administrator enables protection and provides configuration information. The Power Platform administrator completes the required onboarding steps in Power Platform. The application ID used during the process must match the application ID associated with the Microsoft Entra application.

Prerequisites

Before enabling protection, verify the following:

Microsoft Defender administration

The administrator should be familiar with:

  • The Microsoft Defender portal.
  • Microsoft Defender for Cloud Apps.
  • Microsoft Defender XDR.
  • Security for AI settings.
  • Alerts and incidents.
  • Advanced Hunting.

Copilot Studio and Power Platform

The organization should have:

  • Copilot Studio agents that require protection.
  • A Power Platform administrator available to complete onboarding.
  • The required agent configuration and application information.

Microsoft Entra application

The integration uses an application ID associated with a Microsoft Entra application. The application ID configured in Power Platform must match the application ID entered in the Defender portal.

Microsoft 365 app connector

The Microsoft 365 app connector should be connected when the organization wants protection outputs, such as alerts and incidents, to appear in Microsoft Defender. If the connector is not connected, runtime blocking may continue, but related alerts and incidents may not appear in the Defender portal.

Enabling real-time protection

The exact navigation may change as Microsoft updates the Defender portal, but the configuration process generally follows these steps.

Step 1: Open Microsoft Defender

Sign in to the Microsoft Defender portal with an account that has the required administrative permissions.

Step 2: Open Security for AI settings

Navigate to the Defender portal’s AI security settings. Depending on the current portal experience, this may appear under:

  • Settings
  • Security for AI
  • Copilot Studio
  • Real-time protection

Microsoft documentation has used different navigation labels as the feature has evolved. The important exam concept is that the configuration is performed in the Microsoft Defender portal, not exclusively in Copilot Studio.

Step 3: Check the Microsoft 365 app connector

Verify that the Microsoft 365 app connector is connected.

If it is not connected, enable or configure it according to the organization’s requirements.

The connector is important for Defender visibility, including alerts and incidents associated with protected agent activity. Runtime protection may still block suspicious actions even when the connector is not connected, but the corresponding security outputs may not be available in the Defender portal.

Step 4: Enable real-time protection

Turn on the real-time protection setting for Copilot Studio agents.

This enables Defender to inspect supported agent tool invocations during runtime.

Step 5: Provide the Power Platform integration URL

The Defender portal provides a URL or configuration value that must be shared with the Power Platform administrator.

The Power Platform administrator uses this information to complete the external threat detection and protection configuration for the Copilot Studio agents.

Step 6: Configure the integration in Power Platform

The Power Platform administrator completes the required onboarding steps in Power Platform.

This establishes the connection between the Copilot Studio agent environment and the external protection service.

Step 7: Confirm the application ID

The Power Platform administrator provides the application ID used by the integration.

The Defender administrator enters that value in the appropriate App ID field in the Defender portal.

The application ID must match the App ID used by the Microsoft Entra application. A mismatch can cause validation errors or prevent the integration from becoming connected.

Step 8: Save and verify the connection

Save the configuration and verify that the integration displays a connected status.

If the application ID was recently changed, the update may take a short time to propagate. Microsoft documentation indicates that propagation can take approximately one minute in some cases.

How runtime protection works

The runtime protection process is designed to evaluate agent activity before a potentially dangerous action occurs.

For example, an agent might receive a prompt such as:

“Find the customer records for this account and send them to an external address.”

The agent may attempt to invoke a connector or API. Before the tool invocation executes, Defender evaluates the proposed action.

If the action is permitted:

  • The tool invocation proceeds.
  • The agent continues processing.
  • The user generally does not see an interruption.

If the action is blocked:

  • The tool invocation does not execute.
  • The agent stops or interrupts the relevant processing.
  • The user is notified that the request or action was blocked.
  • An alert or incident may be generated, depending on the configuration and connector status.

This is an important distinction: protection occurs at the point where the agent is about to perform an action, rather than only after the action has completed.

Threats that runtime protection can address

Runtime protection is intended to help detect and block supported threats involving agent activity.

Prompt injection

A prompt injection attack attempts to manipulate the agent into ignoring its intended instructions or security boundaries.

For example, a user may attempt to instruct an agent to:

  • Ignore its system instructions.
  • Reveal hidden configuration.
  • Disclose protected data.
  • Invoke a tool for an unauthorized purpose.
  • Treat untrusted content as a trusted instruction.

Cross-prompt injection

Cross-prompt injection can occur when malicious instructions are introduced through content that the agent retrieves or processes.

For example, a document, web page, or data source may contain instructions designed to manipulate the agent when it reads the content.

Unsafe tool invocation

An agent may attempt to invoke a connector, API, or action in a way that creates a security risk.

Examples include:

  • Sending sensitive information to an unauthorized destination.
  • Modifying records without sufficient authorization.
  • Calling an unexpected external service.
  • Accessing information outside the intended business purpose.

Data exfiltration

Data exfiltration occurs when an agent is manipulated into transferring sensitive information to an unauthorized person, application, or destination.

Runtime protection can help prevent certain exfiltration attempts by blocking the tool invocation responsible for the transfer.

However, runtime protection should not be treated as the only security control. Organizations should also use least-privilege access, data policies, DLP, sensitivity labels, authentication controls, and appropriate agent design.

Reviewing protection outputs

After enabling protection, administrators should verify that the expected security information is available in Microsoft Defender XDR.

Important outputs include:

AI agent inventory

The AI agent inventory helps administrators discover and review agents operating in the environment.

Depending on the available experience, inventory information may include:

  • Agent name.
  • Agent type.
  • Agent owner.
  • Agent environment.
  • Security posture.
  • Protection status.
  • Related recommendations.

Alerts and incidents

When suspicious activity is detected, Defender may generate alerts or incidents.

These can help administrators investigate:

  • The affected agent.
  • The user or activity involved.
  • The type of detected threat.
  • The action that was blocked.
  • The related evidence.
  • The recommended response.

Advanced Hunting

Advanced Hunting can be used to search and analyze security telemetry associated with AI agents.

This supports activities such as:

  • Identifying repeated attacks.
  • Finding agents that frequently trigger detections.
  • Detecting patterns across users or environments.
  • Correlating agent activity with other security events.
  • Creating custom detections and investigations.

The SC-500 objective specifically expects administrators to verify that agent inventory, alerts, and Advanced Hunting data appear in Microsoft Defender XDR.

Runtime protection versus agent governance

Runtime protection is only one layer of AI security.

Runtime protection

Runtime protection focuses on what an agent is attempting to do while it is operating.

It can help:

  • Inspect tool invocations.
  • Detect suspicious behavior.
  • Block risky actions.
  • Generate security alerts.

Agent governance

Agent governance focuses on how agents are created, configured, published, owned, and managed.

Governance activities include:

  • Reviewing agent ownership.
  • Controlling who can create agents.
  • Reviewing agent permissions.
  • Applying data policies.
  • Managing environments.
  • Reviewing authentication.
  • Monitoring agent lifecycle.
  • Removing unused agents.

Data protection

Data protection focuses on the information that agents can access or process.

Relevant controls include:

  • Microsoft Purview sensitivity labels.
  • Data Loss Prevention.
  • Microsoft Purview auditing.
  • Insider Risk Management.
  • SharePoint permissions.
  • Microsoft Entra Conditional Access.
  • Least-privilege permissions.
  • Data classification.

A secure agent deployment requires all three layers:

  1. Secure agent design and governance.
  2. Protected data and controlled access.
  3. Runtime detection and blocking.

Copilot Studio built-in protection versus Defender protection

Copilot Studio includes built-in protections against certain threats, including prompt-injection-related attacks. External threat detection provides an additional layer of runtime monitoring and enforcement.

The external protection service evaluates proposed tool invocations and can return an allow or block decision.

The distinction is important:

  • Copilot Studio built-in protections are part of the agent platform.
  • Microsoft Defender protection provides an additional security and monitoring integration.
  • Microsoft Purview focuses on data security, compliance, classification, auditing, and information protection.
  • Microsoft Entra controls identity and access.
  • Microsoft Defender XDR provides centralized detection, investigation, and hunting experiences.

Protection status in Copilot Studio

Copilot Studio can display an agent-level protection status for published agents.

Possible statuses include:

  • Protected
  • Needs review
  • Unknown

The protection status can summarize categories such as:

  • Authentication.
  • Policies.
  • Content moderation.

A status of Needs review may indicate that the agent violates a policy or has an authentication issue. A status of Unknown means that the protection state cannot be confidently determined.

This status helps makers identify potential issues, but it does not replace centralized security monitoring in Microsoft Defender.

Operational best practices

Use least privilege

Give agents only the permissions and tools required for their intended business purpose.

Avoid granting broad access to:

  • SharePoint sites.
  • Dataverse tables.
  • Customer records.
  • Financial systems.
  • Administrative APIs.
  • External communication services.

Limit tool access

An agent should not have access to every connector or action available in its environment.

Use narrowly scoped tools and actions, and review them periodically.

Require appropriate authentication

Ensure that the agent’s authentication configuration is appropriate for the sensitivity of the data and actions involved.

Review agent ownership

Every production agent should have:

  • A business owner.
  • A technical owner.
  • A support contact.
  • A defined purpose.
  • A review schedule.

Monitor alerts and incidents

Do not enable protection and then ignore the resulting alerts. Repeated detections may indicate:

  • A malicious user.
  • A poorly designed agent.
  • An overly permissive connector.
  • A compromised account.
  • A legitimate workflow that requires adjustment.

Test before production deployment

Test agents with:

  • Normal business prompts.
  • Unexpected prompts.
  • Prompt injection attempts.
  • Requests for sensitive information.
  • Unauthorized tool requests.
  • Attempts to send information externally.

Keep protection enabled

Disabling runtime protection removes an important security layer. If protection must be disabled for troubleshooting, document the reason and re-enable it as soon as possible.

Troubleshooting considerations

The integration does not show Connected

Check:

  • Whether the Power Platform onboarding steps were completed.
  • Whether the correct App ID was entered.
  • Whether the App ID matches the Microsoft Entra application.
  • Whether the configuration has had enough time to propagate.
  • Whether the required administrators completed their respective tasks.

Alerts are not appearing

Check:

  • Whether the Microsoft 365 app connector is connected.
  • Whether the activity generated an alertable detection.
  • Whether the administrator has the required permissions.
  • Whether the agent is within the supported protection scope.
  • Whether the alert is available in the relevant Defender experience.

Runtime blocking may still occur even if alerts and incidents are not visible because the connector is not connected.

A legitimate action is blocked

Investigate:

  • The detection type.
  • The tool being invoked.
  • The data being accessed.
  • The user’s request.
  • The agent’s instructions.
  • The agent’s permissions.
  • Whether the workflow can be redesigned more safely.

Do not simply disable protection without understanding the cause.

Protection is not available for an agent

Verify:

  • The agent type is supported.
  • The agent is configured for the relevant runtime.
  • The required integration is enabled.
  • The tenant has the required licensing.
  • The agent is not a classic agent outside the supported external threat-detection scope.

Microsoft documentation states that the external threat detection integration applies to generative agents using generative orchestration and is skipped for classic agents.

Important exam distinctions

Defender for Cloud Apps versus Defender for Cloud

For this topic, runtime protection for Copilot Studio agents is associated with Microsoft Defender for Cloud Apps.

Do not confuse it with Microsoft Defender for Cloud capabilities used to protect Azure resources, AI services, containers, virtual machines, and cloud workloads.

Runtime protection versus investigation

Runtime protection attempts to block unsafe actions before execution.

Advanced Hunting and alert investigation are used to analyze activity and investigate threats.

Power Platform configuration versus Defender configuration

The integration requires work in both environments:

  • Defender enables and configures protection.
  • Power Platform completes the agent-side onboarding.
  • The Microsoft Entra App ID must match across the configuration.

Blocking versus auditing

A security system may be configured to observe or audit activity, or it may be configured to block specific detected actions.

Auditing provides visibility. Blocking provides preventive enforcement.

Protection versus data classification

Runtime protection evaluates agent behavior and tool invocations.

Data classification identifies sensitive information. The two capabilities address different parts of the security problem and should be used together.

Summary

To enable and configure real-time protection for Microsoft Copilot Studio agents:

  1. Open the Microsoft Defender portal.
  2. Navigate to the Security for AI settings.
  3. Verify the Microsoft 365 app connector.
  4. Enable real-time protection for Copilot Studio agents.
  5. Share the provided integration URL with the Power Platform administrator.
  6. Have the Power Platform administrator complete the onboarding process.
  7. Obtain the correct Microsoft Entra application ID.
  8. Enter the matching App ID in Defender.
  9. Save the configuration.
  10. Confirm the integration shows a connected status.
  11. Verify agent inventory, alerts, incidents, and Advanced Hunting data.
  12. Investigate and remediate blocked or suspicious activity.

The central exam concept is that Microsoft Defender for Cloud Apps can inspect supported Copilot Studio agent tool invocations during runtime and block suspicious actions before they execute.

Practice Exam Questions

Question 1

Which Microsoft service provides runtime protection for supported Microsoft Copilot Studio agents?

A. Microsoft Defender for Cloud Apps
B. Azure Backup
C. Microsoft Defender for Containers
D. Microsoft Purview Records Management

Answer: A

Explanation: Microsoft Defender for Cloud Apps provides the runtime protection integration for supported Copilot Studio agents. It evaluates agent activity and can block suspicious tool invocations.

Question 2

An administrator enables real-time protection in Microsoft Defender but does not complete the Power Platform configuration. What is the most likely result?

A. All Copilot Studio agents are automatically deleted.
B. The integration may not become connected or provide the expected protection outputs.
C. Microsoft Entra ID is disabled for the tenant.
D. All SharePoint permissions are removed.

Answer: B

Explanation: The onboarding process requires coordination between Defender and Power Platform. Enabling the Defender setting alone does not complete the integration.

Question 3

What must match between the Power Platform configuration and the Defender configuration?

A. The Azure subscription name
B. The SharePoint site URL
C. The Microsoft Entra application ID
D. The Microsoft Sentinel workspace name

Answer: C

Explanation: The App ID used by the Power Platform integration must match the App ID associated with the Microsoft Entra application and entered in the Defender portal.

Question 4

What does runtime protection primarily evaluate for Copilot Studio agents?

A. Azure virtual machine disk encryption
B. SharePoint retention labels
C. Tool invocations during agent execution
D. Microsoft Entra password expiration settings

Answer: C

Explanation: Runtime protection evaluates proposed agent tool invocations before they execute, helping detect and block suspicious actions.

Question 5

What happens when Defender identifies a suspicious tool invocation covered by a blocking protection rule?

A. The tool invocation is blocked before it executes.
B. The tool invocation always executes and is reviewed later.
C. The agent is permanently deleted.
D. The user is automatically assigned the Global Administrator role.

Answer: A

Explanation: The purpose of runtime protection is preventive enforcement. A suspicious action can be blocked before the tool executes.

Question 6

Which Microsoft Defender capability is useful for investigating patterns in AI agent security telemetry?

A. Azure Cost Management
B. Advanced Hunting
C. Azure Resource Locks
D. Microsoft Purview Data Lifecycle Management

Answer: B

Explanation: Advanced Hunting allows security teams to query and analyze security telemetry, identify repeated activity patterns, and investigate AI agent behavior.

Question 7

An organization wants alerts and incidents associated with protected Copilot Studio agent activity to appear in Microsoft Defender. Which component should the administrator verify?

A. Azure Bastion
B. Microsoft 365 app connector
C. Azure VPN Gateway
D. Microsoft Defender for Storage

Answer: B

Explanation: The Microsoft 365 app connector is important for Defender visibility. If it is not connected, runtime blocking may continue, but related alerts and incidents may not appear in the Defender portal.

Question 8

Which scenario is an example of prompt injection against an AI agent?

A. A user changes their Microsoft Entra password.
B. An administrator enables a resource lock.
C. A user attempts to manipulate the agent into ignoring its instructions and revealing protected information.
D. A security analyst exports an alert to a CSV file.

Answer: C

Explanation: Prompt injection attempts to manipulate an AI agent’s behavior by introducing instructions that conflict with its intended system instructions or security boundaries.

Question 9

Which statement best describes the relationship between runtime protection and Microsoft Purview?

A. Runtime protection and Microsoft Purview are identical services.
B. Runtime protection evaluates agent behavior, while Purview provides data security and compliance capabilities.
C. Microsoft Purview replaces all agent authentication controls.
D. Runtime protection is used only for Azure virtual machines.

Answer: B

Explanation: Runtime protection focuses on agent actions and tool invocations. Microsoft Purview supports data classification, sensitivity labels, DLP, auditing, Insider Risk Management, and other data-security and compliance capabilities.

Question 10

A Copilot Studio agent is configured as a classic agent rather than a generative agent using generative orchestration. What should the administrator understand about the external threat-detection integration?

A. It automatically converts the agent into a generative agent.
B. It applies only after the agent is deleted and recreated.
C. It is skipped for classic agents.
D. It requires Azure Bastion to be installed.

Answer: C

Explanation: Microsoft documentation states that the external threat-detection integration is called for generative agents using generative orchestration and is skipped for classic agents.

Go to the SC-500 Exam Prep Hub main page

AI Security, azure, Azure AI, Microsoft Certification, SC-500, security

Monitor AI security by using the Data and AI security dashboard in Defender for Cloud (SC-500 Exam Prep)

 
This post is a part of the "SC-500: Implementing End-to-End Security Controls for Cloud and AI Workloads" Exam Prep Hub.
This topic falls under these sections:
Secure compute (20–25%)
   --> Implement security for AI
      --> Monitor AI security by using the Data and AI security dashboard in Defender for Cloud

Note that there are 10 practice questions (with answers) at the end of each section to help you solidify your knowledge of the material. Also, there are 4 practice tests with 30 questions each available from the hub's main page below the exam topics section.

Overview

Artificial intelligence workloads introduce security risks that are different from those associated with traditional applications. AI systems may process sensitive data, use external tools, connect to storage and search services, expose model endpoints, and depend on containers, libraries, identities, and infrastructure-as-code configurations.

Microsoft Defender for Cloud provides capabilities for discovering AI workloads, assessing their security posture, detecting threats, and investigating security issues. The Data and AI security dashboard provides a centralized view of data and AI resources, their protection coverage, security recommendations, alerts, attack paths, and internet exposure.

For the SC-500 exam, the key concept is that the dashboard helps security teams answer three questions:

  1. What data and AI resources exist in the environment?
  2. What security risks or protection gaps affect those resources?
  3. What actions should be taken to reduce the risks?

The dashboard combines information from Defender for Cloud capabilities such as Cloud Security Posture Management, sensitive data discovery, Defender for Storage, Defender for Databases, and AI threat protection.

What Is the Data and AI Security Dashboard?

The Data and AI security dashboard is a centralized monitoring experience in Microsoft Defender for Cloud. It provides visibility into an organization’s data and AI estate and helps security teams identify resources that require attention.

The dashboard can display information about:

  • Storage resources
  • Managed databases
  • Hosted databases, including databases hosted on infrastructure
  • AI services and AI workloads
  • Sensitive data
  • Security recommendations
  • Security alerts
  • Attack paths
  • Internet-exposed resources
  • Protection coverage
  • AI threat detection activity

The dashboard is intended to support both proactive and reactive security activities:

  • Proactive security: Identify misconfigurations, exposed resources, missing protection, and potential attack paths.
  • Reactive security: Investigate alerts, identify affected resources, and respond to detected threats.

It is important to understand that the dashboard is not itself a replacement for all security controls. Instead, it provides a consolidated view of information collected by Defender for Cloud and related security services.

Relationship to AI Security Posture Management

Microsoft Defender for Cloud includes AI security posture management, which helps organizations discover AI workloads and identify security risks throughout the AI lifecycle.

AI security posture management can help identify:

  • AI applications and services
  • AI models and model deployments
  • Vulnerable AI-related libraries
  • Infrastructure-as-code misconfigurations
  • Internet-exposed AI endpoints
  • Weak or excessive identity permissions
  • Risks involving data used for grounding or fine-tuning
  • Potential attack paths involving AI resources

Defender for Cloud can discover AI workloads across supported environments and services, including Azure AI services, Azure AI Foundry, Azure Machine Learning, Amazon Bedrock, and Google Vertex AI.

The dashboard provides a practical way to review these findings without having to examine every AI resource independently.

AI security posture management versus AI threat protection

These capabilities address different security questions.

CapabilityPrimary purpose
AI security posture managementIdentify configuration weaknesses, vulnerabilities, exposure, and security gaps
AI threat protectionDetect suspicious or malicious activity targeting AI workloads
Data and AI security dashboardPresent data and AI inventory, posture findings, protection coverage, and threat information in one view

For example:

  • A publicly accessible AI endpoint is primarily a posture concern.
  • A suspicious sequence of prompts targeting an AI service may be a runtime threat concern.
  • The dashboard can help security personnel see both types of information together.

Prerequisites for the Dashboard

The exact information displayed depends on the Defender for Cloud plans and capabilities enabled in the subscription.

For full access to the dashboard’s data and AI capabilities, Microsoft documentation identifies the following requirements:

  • Defender CSPM
  • The Defender CSPM sensitive data discovery extension
  • Defender for Storage
  • Defender for Databases
  • AI workload threat protection
  • Registration of each relevant Azure subscription with the Microsoft.Security resource provider

Access also requires appropriate permissions to read assessments, subassessments, and alerts. The documented minimum privileged role for the dashboard is the Security reader role.

Why plan enablement matters

If a protection plan is not enabled, the dashboard may show incomplete protection coverage or may not provide certain findings.

For example:

  • Without sensitive data discovery, sensitive information findings may be unavailable.
  • Without Defender for Storage, storage threat protection information may be incomplete.
  • Without Defender for Databases, database-related protection information may be unavailable.
  • Without AI threat protection, AI prompt scanning and AI threat alerts may not be displayed.

The dashboard should therefore be interpreted in the context of the plans enabled for the subscription.

Data and AI Security Overview

The Data and AI security overview section provides a high-level view of the organization’s data and AI resources.

Resources may be categorized into areas such as:

  • Storage assets
  • Managed databases
  • Hosted databases
  • AI services

The overview can help identify whether resources are:

  • Fully protected
  • Partially protected
  • Not protected

Protection status depends on the relevant Defender for Cloud plans and extensions that apply to the resource.

The overview may also highlight resources associated with:

  • High-severity recommendations
  • Critical-severity recommendations
  • High-severity alerts
  • Critical-severity alerts
  • High- or critical-severity attack paths

This allows security teams to prioritize the most important issues instead of treating every resource equally.

The Top Issues Section

The Top issues section focuses attention on the resources and findings that require the most immediate action.

It can include:

High- and critical-severity alerts

Alerts indicate that Defender for Cloud or an integrated protection service has detected potentially malicious or suspicious activity.

Examples may include:

  • Suspicious activity involving data resources
  • Threats against AI workloads
  • Malicious or abnormal access patterns
  • Other detected security events

Alerts should be investigated to determine:

  • Which resource is affected
  • What activity was detected
  • When the activity occurred
  • Whether the activity is ongoing
  • What identities or services were involved
  • Whether containment or remediation is required

High- and critical-severity recommendations

Recommendations identify security improvements that should be made to reduce risk.

Examples include recommendations related to:

  • Internet exposure
  • Authentication
  • Identity permissions
  • Data protection
  • Missing security configurations
  • Vulnerable components
  • Protection plan coverage

A recommendation is generally a posture finding, whereas an alert is generally associated with detected activity or a security event.

High- and critical-severity attack paths

Attack path analysis helps identify combinations of weaknesses that could allow an attacker to reach a valuable resource.

An attack path may involve:

  1. An internet-exposed endpoint
  2. A weak identity or excessive permission
  3. A vulnerable workload
  4. Access to sensitive data
  5. A high-value AI or data resource

Attack paths are important because an individual issue may appear moderate when viewed in isolation but become critical when combined with other weaknesses.

The Data Closer Look Section

The Data closer look section provides more detailed information about data resources and their associated risks.

It can include the following areas.

Sensitive data discovery

Sensitive data discovery helps identify data resources that contain sensitive information.

Examples of sensitive information may include:

  • Personal information
  • Financial information
  • Credentials or secrets
  • Regulated information
  • Other information types identified by the organization

The dashboard can provide an overview of:

  • Sensitive information types
  • Sensitivity labels
  • Resources containing sensitive data
  • Resources where sensitive data may be exposed

Security teams can use this information to determine whether sensitive data is:

  • Publicly exposed
  • Accessible by inappropriate identities
  • Used by an AI workload without sufficient controls
  • Stored in a resource lacking appropriate protection

Sensitivity settings can be managed to control which information types and sensitivity labels are relevant to the organization.

Data threat protection

This area provides information about security alerts associated with data resources, including:

  • Storage resources
  • Managed databases

The purpose is to help security teams investigate threats affecting data and determine whether the associated resource requires remediation.

Data queries in Security Explorer

The dashboard can provide investigation queries for data-related risks.

Examples of investigation scenarios include:

  • Data resources containing plaintext secrets
  • Databases accessible by external users
  • Public storage containing sensitive data
  • Resources with potentially unsafe configurations

Security Explorer can be used to investigate relationships between resources, identities, configurations, and risks.

Internet-exposed data resources

The dashboard can identify data resources exposed to the internet.

These may include:

  • Public storage resources
  • Internet-accessible managed databases
  • Hosted databases with external exposure

Internet exposure does not automatically mean that a resource has been compromised. However, it increases the potential attack surface and should be evaluated alongside authentication, authorization, network controls, and data sensitivity.

The AI Closer Look Section

The AI closer look section focuses specifically on AI workloads and their security risks.

It includes several important areas.

AI discovery

AI discovery provides an inventory of AI resources found in the environment.

This visibility helps organizations identify:

  • Which AI services are deployed
  • Where AI workloads are running
  • Which teams or applications use AI
  • Which AI resources require security assessment
  • Whether unauthorized or unexpected AI resources exist

AI discovery is particularly important because organizations may have AI resources deployed by multiple teams across different subscriptions, projects, or cloud providers.

AI threat protection

AI threat protection provides information about detected threats involving AI workloads.

The dashboard can display:

  • The number of prompts scanned
  • Detected alerts
  • Alert severity
  • AI workloads associated with the alerts

Prompt scanning and AI threat detection help identify suspicious activity targeting AI services. However, the number of prompts scanned is a monitoring metric, not a security score by itself.

A high number of scanned prompts may simply indicate that an AI service is heavily used. Security teams should focus on the associated alerts, severity, affected resources, and investigation details.

AI queries in Security Explorer

The dashboard can provide queries for investigating AI-related risks.

Examples include:

  • Sensitive data resources used for grounding
  • Vulnerable containers used by AI workloads
  • AI resources with risky configurations
  • Relationships between AI endpoints and data resources
  • AI workloads with excessive exposure or permissions

These queries help security teams understand how AI resources interact with the rest of the environment.

Internet-exposed resources used for grounding

Grounding allows an AI workload to use external data to improve the relevance or accuracy of its responses.

The dashboard can identify internet-exposed storage and search resources used for grounding.

This is important because an AI application may be secure at the model endpoint while the data used to ground the model is exposed or inadequately protected.

Security teams should evaluate:

  • Whether the grounding data is sensitive
  • Whether the storage or search resource is publicly accessible
  • Whether the AI workload has excessive access
  • Whether authentication and authorization are properly configured
  • Whether the data source is trustworthy
  • Whether the resource is protected by appropriate Defender plans

Monitoring AI Protection Coverage

Protection coverage indicates whether resources are protected by the applicable security plans.

A resource may be:

Fully protected

The relevant posture and threat protection capabilities are enabled and providing coverage.

Partially protected

Some relevant capabilities are enabled, but one or more protections are missing.

Not protected

The applicable protection capabilities are not enabled or do not cover the resource.

Protection coverage should be reviewed regularly because AI environments change quickly. New AI services, model deployments, storage resources, and containers may be introduced without being included in the organization’s original security design.

How to Access and Use the Dashboard

A typical workflow is:

  1. Sign in to the Azure portal.
  2. Open Microsoft Defender for Cloud.
  3. Select Data and AI security dashboard.
  4. Review the Data and AI security overview.
  5. Review the Top issues section.
  6. Examine AI discovery and AI threat protection information.
  7. Investigate relevant recommendations, alerts, or attack paths.
  8. Use Security Explorer queries for deeper analysis.
  9. Remediate configuration issues.
  10. Reassess the dashboard to confirm that risk and protection coverage have improved.

For data-specific investigations, the dashboard can also be used to view resources containing sensitive information and then open the resource’s recommendations and alerts.

Recommended Monitoring Process

A repeatable monitoring process can be organized into five stages.

1. Establish an inventory

Identify all AI services, applications, models, endpoints, data sources, containers, and supporting infrastructure.

2. Review protection coverage

Determine whether each resource is covered by the appropriate Defender for Cloud plans.

3. Prioritize critical findings

Start with:

  • Critical alerts
  • Critical recommendations
  • Critical attack paths
  • Internet-exposed AI endpoints
  • Sensitive data used by AI workloads
  • AI resources with excessive permissions

4. Investigate relationships

Use Security Explorer and attack path analysis to understand how an issue could affect other resources.

5. Remediate and verify

Apply the recommended changes, then return to the dashboard to confirm that the issue has been resolved or that the risk has been reduced.

Common Security Actions After Reviewing the Dashboard

Depending on the findings, remediation may include:

  • Enabling the appropriate Defender for Cloud plan
  • Removing unnecessary public network access
  • Configuring private endpoints
  • Strengthening authentication
  • Applying least-privilege permissions
  • Using managed identities
  • Protecting storage and databases
  • Removing plaintext secrets
  • Updating vulnerable libraries or container images
  • Restricting access to grounding data
  • Investigating suspicious AI prompts or alerts
  • Reviewing attack paths
  • Applying security recommendations through infrastructure as code
  • Monitoring the environment continuously

The dashboard helps identify what should be addressed, but remediation usually occurs in the underlying Azure service, identity platform, network configuration, data platform, or application.

Important Exam Distinctions

Dashboard versus Security Explorer

  • The Data and AI security dashboard provides a summarized monitoring view.
  • Security Explorer provides deeper investigation and relationship analysis.

Recommendation versus alert

  • A recommendation identifies a security improvement or configuration gap.
  • An alert indicates detected suspicious or malicious activity.

Posture management versus threat protection

  • Posture management focuses on reducing weaknesses before they are exploited.
  • Threat protection focuses on detecting threats and suspicious activity.

AI discovery versus AI threat protection

  • AI discovery identifies AI resources and workloads.
  • AI threat protection detects threats targeting those workloads.

Sensitive data discovery versus data threat protection

  • Sensitive data discovery identifies resources containing sensitive information.
  • Data threat protection identifies security threats involving data resources.

Internet exposure versus compromise

An internet-exposed resource is not necessarily compromised. It is a resource with increased attack surface and potentially greater risk. An alert or investigation is needed to determine whether malicious activity occurred.

Key Takeaways

For the SC-500 exam, remember these points:

  • The Data and AI security dashboard provides a centralized view of data and AI security.
  • The dashboard combines inventory, protection coverage, recommendations, alerts, and attack paths.
  • Full functionality depends on the relevant Defender for Cloud plans and extensions.
  • AI discovery helps identify AI resources across the environment.
  • AI threat protection provides visibility into scanned prompts and detected alerts.
  • Sensitive data discovery helps identify resources containing sensitive information.
  • Security Explorer supports deeper investigation of data and AI risks.
  • Attack path analysis helps identify chains of weaknesses that could lead to high-impact compromise.
  • Internet-exposed AI and data resources should be prioritized for review.
  • The dashboard supports monitoring and prioritization; remediation is performed in the underlying services and security controls.

Practice Exam Questions

Question 1

A security team wants a centralized view of its AI resources, protection coverage, recommendations, alerts, and attack paths. Which Microsoft Defender for Cloud capability should the team use?

A. Microsoft Defender Vulnerability Management
B. Azure Resource Graph
C. Data and AI security dashboard
D. Microsoft Sentinel workbook

Correct answer: C

Explanation: The Data and AI security dashboard provides a centralized view of data and AI resources, protection status, recommendations, alerts, and attack paths. Azure Resource Graph can query resources, but it does not provide the same integrated security dashboard experience.

Question 2

An organization wants to identify storage and database resources that contain sensitive information. Which capability should be enabled?

A. Azure Bastion
B. Defender for Servers
C. Sensitive data discovery
D. Microsoft Entra Privileged Identity Management

Correct answer: C

Explanation: Sensitive data discovery identifies resources containing sensitive information types and sensitivity labels. The results can be reviewed through the Data and AI security dashboard.

Question 3

What is the primary purpose of AI security posture management in Defender for Cloud?

A. To identify AI workload risks, vulnerabilities, misconfigurations, and exposure
B. To replace Microsoft Entra authentication for AI applications
C. To train foundation models
D. To provide end-user prompt authoring assistance

Correct answer: A

Explanation: AI security posture management focuses on discovering AI workloads and identifying security weaknesses such as vulnerable components, excessive permissions, misconfigurations, and internet exposure.

Question 4

The AI closer look section reports the number of prompts scanned and displays alerts by severity. What capability is providing this information?

A. Sensitive data discovery
B. AI threat protection
C. Azure Policy
D. Defender for Containers

Correct answer: B

Explanation: AI threat protection provides information about AI-related threat detection, including prompt scanning activity and detected alerts.

Question 5

A security analyst sees a critical recommendation for an AI endpoint that is accessible from the internet. What does this finding primarily represent?

A. Proof that the endpoint has been compromised
B. A completed incident investigation
C. A posture or configuration risk requiring remediation
D. A successful model deployment

Correct answer: C

Explanation: An internet-exposed endpoint is a security posture concern. It increases the attack surface but does not, by itself, prove that a compromise has occurred.

Question 6

Which dashboard section is most directly associated with identifying sensitive information types and sensitivity labels in cloud data resources?

A. Data closer look
B. Top issues
C. AI discovery
D. AI threat protection

Correct answer: A

Explanation: The Data closer look section includes sensitive data discovery information, including sensitive information types and sensitivity labels.

Question 7

A security team wants to investigate whether sensitive data resources are being used for AI grounding. Which capability should the team use?

A. Azure Backup
B. Security Explorer queries
C. Azure Bastion
D. Microsoft Entra authentication methods

Correct answer: B

Explanation: Security Explorer provides queries for investigating relationships and risks involving AI resources, including sensitive data resources used for grounding.

Question 8

Which statement best describes an attack path in Defender for Cloud?

A. A list of all prompts sent to an AI model
B. A backup copy of an affected resource
C. A sequence of weaknesses that could allow an attacker to reach a valuable resource
D. A list of approved Azure Policy definitions

Correct answer: C

Explanation: Attack path analysis identifies connected weaknesses, such as internet exposure, excessive permissions, and vulnerable resources, that could lead to a high-impact compromise.

Question 9

A subscription has Defender CSPM enabled, but sensitive data discovery and Defender for Storage are not enabled. What is the most likely result?

A. The dashboard will automatically protect all storage resources
B. The dashboard may provide incomplete data protection and sensitive data information
C. All storage resources will be removed from the inventory
D. AI threat protection will be disabled automatically

Correct answer: B

Explanation: Dashboard information depends on the relevant plans and extensions. Without sensitive data discovery and Defender for Storage, data-related visibility and protection coverage may be incomplete.

Question 10

Which action is the best first step after identifying a critical AI security alert in the Data and AI security dashboard?

A. Delete every AI resource in the subscription
B. Ignore the alert until the next monthly review
C. Disable all network connectivity
D. Investigate the alert, affected resource, activity, and related recommendations

Correct answer: D

Explanation: A critical alert should be investigated to understand the detected activity, affected resources, identities, timing, and recommended response. Remediation should be based on the investigation rather than automatically deleting or disabling unrelated resources.

Go to the SC-500 Exam Prep Hub main page