Tag Archives: AI

Exploring Microsoft Entra Agent ID (Preview): Identity, Governance & Zero‑Trust for AI Agents

AI, AI Agent, Cloud Security, Security December 7, 2025 Leave a comment

Note: Features are in Preview and may change.

As organizations lean into AI assistants and autonomous workflows, one challenge keeps coming up in every SOC and IAM conversation: agent sprawl. Agents show up in multiple teams and builder platforms, and before you know it, you’ve got non‑human actors touching sensitive data without a clear inventory, lifecycle, or policy boundary.

Microsoft Entra Agent ID and the Agent Registry (Preview) are designed to solve exactly that bringing identities, governance, and Zero Trust controls to AI agents, so you can securely discover, organize, and manage them easily in your directory.

What Agent Registry Adds (and Why You’ll Care)

Agent Registry is an Microsoft Entra integrated metadata repository that gives you a unified view of agents built on Microsoft platforms (e.g., Copilot Studio, Azure AI Foundry) and those from other ecosystems. It separates operational records (Agent Instances) from discoverability metadata (Agent Card Manifests) and introduces Collections to govern which agents can discover and collaborate with each other. Think discovery before access a crucial shift for reducing exposure.

A Quick Look at the Tenant Experience

Agent ID Overview (Preview) dashboard showing agent counts, status, types, and blueprints: high-level posture of agents, identities, blueprints, and collections

Continue reading →

Navigating DORA with Microsoft Purview: A compliance blueprint for Microsoft 365

Microsoft 365, Purview October 28, 2025 Leave a comment

Digital Operational Resilience Act (DORA) is reshaping how EU financial entities manage ICT risk, resilience testing, incident reporting, and third‑party risk. If you run Microsoft 365, Microsoft Purview Compliance Manager gives you a practical way to translate DORA requirements into actions, evidence, and measurable progress. This guide walks through a clean, step‑by‑step implementation flow from setting up a DORA assessment to assigning improvement actions and tracking your score, so you can be audit ready without drowning in spreadsheets.

Why use Microsoft Purview Compliance Manager for DORA ?

  • Prebuilt assessments: DORA assessment templates map regulatory articles to actionable controls you can assign and track.
  • Control mapping: Microsoft‑managed baselines and customer‑managed controls provide clarity on shared responsibility.
  • Improvement actions: Structured tasks with owners, due dates, and recommended steps create accountability.
  • Evidence management: Centralized artifacts (documents, links, screenshots) simplify audit preparation.
  • Real‑time scoring: Compliance scores help prioritize high‑risk gaps and demonstrate progress.

Prerequisites and approach

  • Access: Ensure you have appropriate roles in Microsoft Purview (e.g., Compliance Manager Admin or similar).
  • Scope: Decide which services to cover first; start with Microsoft 365 for a focused rollout.
  • Vanilla setup: Use a fresh assessment group to avoid inherited noise and control drift.

Quick Tip

Can also use the default user access options available from the Assesment option in the Compliance Manager Portal

Step‑by‑step setup in Compliance Manager

Create and configure your DORA assessment

  • Open Purview: Go to Microsoft Purview portal → Compliance Manager – Navigate to assessment – Select Regulation
  • Find templates: Search for “Digital” under assessment templates. (I was not able to find with DORA :))
Continue reading →

Deep Dive into Microsoft Purview Adaptive Protection: A SOC Team’s Guide to Investigating Insider Risk Alerts in Adaptive Protection

Adaptive Protection, DLP, Microsoft 365, Purview October 7, 2025 Leave a comment

In today’s hybrid work environment, insider threats are becoming increasingly complex. Microsoft Purview’s Adaptive Protection and Insider Risk Management (IRM) offer a dynamic, risk-based approach to protecting sensitive data while enabling SOC teams to investigate and respond to alerts with precision.

This blog provides a step by step walkthrough of how SOC teams can leverage these tools to investigate alerts, assess user behavior, and take appropriate action.

Step 1: Understanding the Adaptive Protection Dashboard

The Adaptive Protection dashboard is the SOC team’s starting point. It provides a bird’s-eye view of user risk levels across the organization, helping analysts prioritize investigations.

Key Elements of the Dashboard:

  • User Risk Levels:
    • Elevated Risk: Users exhibiting high-risk behavior that may indicate potential data exfiltration or policy violations.
    • Moderate Risk: Users with concerning patterns but not yet critical.
    • Minor Risk: Users with low level anomalies or early warning signs.
  • Policy Integration:
    • Shows which Insider Risk policies are actively using these risk levels.
    • Helps correlate user behavior with policy triggers, such as data leakage,
    • Security violations, or unusual access patterns.
Continue reading →

SOC Analyst Guide: Investigating Insider Risk Alerts in Microsoft Purview

DLP, Microsoft 365, Purview October 2, 2025 Leave a comment

This blog post provides a comprehensive guide for SOC analysts to investigate and respond to alerts generated by Microsoft Purview’s Insider Risk Management and Adaptive Protection. It outlines step-by-step workflows for accessing alerts, triaging incidents, analyzing user behavior, managing cases, and leveraging Microsoft Defender integration.

The guide also includes best practices and suggested screenshots to help SOC teams effectively mitigate insider threats and maintain organizational security.

Introduction

Microsoft Purview’s Insider Risk Management (IRM) and Adaptive Protection empower SOC teams to detect and respond to insider threats dynamically. This guide walks through how SOC analysts can triage, investigate, and respond to alerts generated by these systems.

Part 1: Investigating Insider Risk Management Alerts

1. Access the Alerts Dashboard

Go to: Microsoft Purview Portal > Insider Risk Management > Alerts

Continue reading →

What’s New in Azure Firewall: Draft & Deploy, Selective Logging, Explicit Proxy, Security Copilot & More

Cloud Security, Network Security, Security September 28, 2025 Leave a comment

Azure Firewall continues to evolve with powerful new features that enhance security, governance, and operational efficiency.

Whether you’re managing complex enterprise environments or hybrid architectures, these updates offer greater control, visibility, and automation.

Here’s an overview into the latest innovations:

Draft and Deploy – Azure Firewall Policy Changes (Preview)

Managing firewall policies just got smarter.

With the Draft and Deploy feature, administrators can now:

  • Clone active policies to create editable drafts.
  • Collaborate on bulk changes without impacting live environments.
  • Stage deployments to minimize disruption.
  • Apply all changes at once, improving governance and reducing human error.

This is a game changer for environments requiring frequent policy updates, such as dynamic cloud workloads or multi team operations.

Continue reading →

Creating Your First AI Agent with Azure AI Agent Service

AI, AI Agent, Azure AI March 31, 2025 Leave a comment

Introduction

Azure AI Agent Service allows you to create, deploy, and manage AI agents that can perform various tasks. This service leverages powerful AI models to enable agents to perform a wide range of tasks, from answering queries to automating complex workflows. With its user-friendly interface and robust infrastructure, Azure AI Agent Service makes it easy for developers to build intelligent agents that can enhance applications and improve productivity.

This guide will walk you through the steps to set up and run your first agent with the help of Azure AI agent service.

Prerequisites:

  • An Azure subscription.
  • You need a GitHub Account.
  • Basic knowledge of PowerShell and Python.

So first step is to setup your workspace in the GitHUb

GitHub Codespaces: A Convenient Cloud-Based Development Environment

GitHub Codespaces offers a virtual machine in the cloud, providing a clean environment with all necessary prerequisites pre-installed. This makes it incredibly easy to set up and run your code, even on a standard laptop without high-end specifications.

Key Features:

  • Cloud-Based Computation: All computations are performed in the cloud, allowing you to work efficiently on a standard laptop.
  • Easy Setup: Setting up Codespaces is straightforward and quick, making it accessible for developers of all levels.
Continue reading →