AI agent governance for Microsoft 365
Find the agents nobody registered
Agent Perimeter inventories every AI agent with a foothold in your tenant, scores it against Microsoft's own security benchmark, and tells you plainly which answers it could not get. Read-only to assess. Your tenant, your identities, your approvals.
Why agents slip the perimeter
Your controls were built for people
An agent signs in, holds permissions and reaches data like a user, but nothing about it looks like one. The tools that would normally catch it were designed around someone who sleeps, travels and eventually leaves.
Most of them never reach the registry
Agents arrive through Copilot Studio, the Agent 365 registry, Defender and plain app registrations. Each surface knows about its own. No single list holds them all, so the count you can see is not the count you have.
Ownership goes stale quietly
The person who built an agent moves team or leaves. The agent keeps its credentials, its connectors and its access. Nothing expires, and no review is triggered, because no process ever knew the agent existed.
A missing answer reads as a clean one
An agent with no risk record looks identical whether Identity Protection cleared it or was never licensed to look. Every dashboard built on that data renders the unknown case as the safe one.
Third-party tools inherit your tenant
A consent grant to an outside AI product is a standing key to whatever it was granted. It does not show up as a login, it does not age out, and it is rarely reviewed after the day it was approved.
What it does
An inventory you can defend in a meeting
Four modules, run in order. Each one states what it read, what it could not read, and why.
Every surface, one list
Entra agent identities and blueprints, the Agent 365 registry, Defender's agent inventory, Copilot Studio, and the app registrations behind them. Reconciled into one record per agent with the sources that saw it.
41 checks against MCSB v2
Identity, access, data protection, logging and the AI domain. Each check carries its Microsoft control, the business impact of fixing it, and who in your organisation can actually make the change.
21 Sentinel rules
Agent sign-in from a new address, a model bridge holding broad access with no owner, an instruction written to override the platform, a tool invoked with no human approval. Deployed disabled, for you to review and enable.
Built for the review, not the console
An HTML report, a Power BI model, and a browsable panel. The headline figure is derived once and used everywhere, so the number in the summary is the number in the table.
Impact before command
One script per failing check. Every command states who it affects and what breaks before it appears, and arrives commented out behind an explicit flag. Nothing runs because you opened the file.
Scheduled, or in your pipeline
Runs unattended in Azure Automation, or in GitHub Actions and Azure DevOps with workload identity federation. No secret, no certificate in a variable, a red build when posture slips.
The rule the whole tool is built on
A number from a check that did not run is not a number
Every check carries a gate: a flag recording whether its input was
actually readable in your tenant. If the gate says no, the check reports
NOT CHECKED. It never reports a pass.
That sounds like a technical detail and it is the difference between a report you can act on and one that flatters you. A tool that silently converts "we could not see" into "nothing found" produces a clean bill of health for an estate it never read. Agent Perimeter would rather hand you eleven unanswered questions than one comfortable total.
What a first assessment turns up
The gap is bigger than the list you have
Every tenant differs. The shape of the first run rarely does.
Agents missing from the obvious source
of the agents holding a foothold in a tenant are typically absent from the single place most people look first. They surface only when Entra, the Agent 365 registry, Defender and Copilot Studio are reconciled against each other.
What the first report tells you
That last row is the one that matters. Checks the tenant cannot answer are reported as unanswered, each naming the licence, permission or data source that would settle it — never quietly counted as a pass.
Ways to start
Start small. Each step earns the next.
Read-only first. Nothing changes in your tenant until you decide it should, and the step that changes things shows you the impact before the command.
Agent Discovery
Read-only consent, one collection run, one report. You get the inventory, the posture score, and the list of what could not be read in your tenant and why. No changes, no agents touched.
Perimeter Review
The findings worked through with your identity and security owners. Which agents matter, which owners are gone, which third-party grants to withdraw, and a ranked plan with the impact of each change written down.
Detections and remediation
The Sentinel rules deployed and tuned to your baseline, remediation scripts run under your change process, and the Power BI model pointed at your workspace. Your approvals throughout.
Continuous assurance
Scheduled collection, or the assessment wired into your pipeline so posture drift turns a build red. Monthly review of what changed, what appeared, and what still cannot be measured.
Security and data
Your tenant, your identities, your approvals
Assessment is read-only
Discovery and scoring need read scopes only. Write permissions are requested at the point you choose to remediate, not before.
Nothing leaves your tenant
Collection writes to your own Log Analytics workspace. There is no vendor cloud in the path and no copy of your inventory anywhere else.
No agent prompts are stored
Instruction text is measured, not captured. The report records that an agent has instructions and how long they are, never what they say.
Pipelines hold no secret
CI signs in with workload identity federation, scoped to one repository and one branch. No certificate and no client secret in a variable.
Every change is previewed
Remediation runs in preview by default, states who is affected before the command it would run, and ships commented out behind an explicit flag.
Limits are published
Known gaps ship with the tool in writing. Where a figure can undercount, the documentation says so rather than leaving you to discover it.
Frequently asked questions
The questions we get first
Do we need Copilot or Agent 365 licences for this?
No. Agent Perimeter reads whatever your tenant exposes and reports honestly on the rest. Licensed sources such as the Agent 365 registry and Defender's agent inventory add detail where you have them; where you do not, the affected checks report NOT CHECKED and name the licence that would answer them. You are never shown a pass that depends on data nobody read.
What access does it need?
Read scopes across Entra, audit logs, applications and policy for the assessment. An app registration in your tenant, consented by a Global Administrator, running as itself rather than as a person. Write permissions are separate and requested only when you choose to remediate.
Will this flag our approved agents as problems?
It reports what is true of each agent: who owns it, what it can reach, whether anyone is watching it. An approved agent with a live owner and scoped access passes. An approved agent whose owner left in March does not, and that is the finding worth having.
How is this different from what Defender already shows us?
Defender sees the agents Defender knows about. So does Entra, so does Copilot Studio, so does the Agent 365 registry. The work is in reconciling them into one record per agent and being explicit about which sources saw it — on the tenant above, 72% of agents were missing from the single source most people check first.
Can it break something in production?
Not during assessment, which makes no changes at all. Remediation can, by design — withdrawing a consent grant or disabling a credential has consequences. That is why every generated script states the user-facing impact above the command, runs in preview by default, and requires an explicit flag to act.
What if an agent has never been tested against a hostile prompt?
Then the check reports NOT CHECKED, because nothing in Microsoft 365 records whether an agent has been red teamed. Passing everything would assert a programme nobody has evidence of; failing everything would manufacture findings from the absence of a field. The honest answer is that nobody has looked.
Let's see what is actually in your tenant
A read-only discovery run takes half a day and makes no changes. You keep the report either way.
Prefer email? hello@cbfive.com