Data & AI Cloud Security

AI shifts the attack surface. Where classic apps lean on network and identity, agents and RAG solutions introduce new risks: prompt injection, data leakage through grounding, and agents that can do more than intended. These risks are architecture decisions, not an afterthought.

Microsoft 365 Copilot only works with content the user can already access through Microsoft Graph, and prompts, responses, and Graph data are not used to train the underlying models. Microsoft Purview provides the data layer on top: DSPM for AI, sensitivity labels, DLP, and Insider Risk Management, spanning Copilot, Foundry, and third-party AI apps. Defender for Cloud adds AI security posture management to its CNAPP, and Sentinel provides detection. OWASP published the LLM Top 10 2026 in August 2026, with prompt injection and excessive agency as recurring headline risks.

An enterprise AI platform has four security planes: identity (who or what calls the model), data (what grounding may see), model and agent (which tools can be invoked), and observability (what happened). Foundry separates these through a resource for governance, projects for isolation, and distinct governance boundaries for connected services such as Storage, Key Vault, and Azure AI Search.

• Fix the identity boundary: agents run under a managed identity with least privilege, not under an administrator's rights.
• Isolate grounding data per project and label sources with sensitivity labels, so DLP and encryption rights travel with the answer.
• Place prompt-injection controls and excessive-agency limits (which tools, which scope) on the agent layer, not in the prompt.
• Close network access with virtual network isolation and private endpoints toward Storage, Key Vault, and Search.

The biggest leaks are rarely the model itself. They come from oversharing (Copilot surfaces what was already shared too broadly), from agents with too wide a tool scope, and from grounding that pulls in confidential sources without a label. Treat DSPM for AI as the starting point: first see which sensitive data AI can reach, fix the permissions, then detect misuse with Sentinel.

Security carries a cost you must model up front. Sentinel cost depends heavily on ingestion volume, analytics tier, data lake tier, and retention; unfiltered AI logs can inflate the bill. Decide deliberately which signals go to the expensive analytics tier and which to cheaper storage.

Do not start with detection but with data hygiene. Organizations that roll out Copilot without first solving oversharing get incidents that no security tool fixes, but governance does. Involve data owners early.

• Least privilege versus speed: tight tool scopes slow agents down, but wide scopes are the core of excessive agency.
• Full logging versus cost: sending everything to the analytics tier is safe but expensive; tiering forces choices.
• Central versus federated controls: central Purview policies are consistent, but teams want per-project autonomy.

• Trying to solve prompt injection with a better system prompt instead of controls on the tool layer.
• Rolling out Copilot without first running a DSPM for AI scan for oversharing.
• Running agents under broad administrator rights instead of a dedicated managed identity.
• Sending all AI telemetry unfiltered to the expensive Sentinel tier.