Most teams find out they have an AI problem the same way they found out they had a shadow IT problem. Not from a project plan. From an audit finding, or someone noticing a browser extension nobody recognizes.
The tooling for this is already sitting in Microsoft 365, and plenty of us pay for the licenses without knowing what they cover. The awkward part is that it is split across two products, and deploying only one of them leaves a visible hole.
The numbers are worse than you think
Employee AI adoption ran ahead of governance, and the 2026 research agrees on roughly how far ahead.
PagerDuty surveyed 1,250 office professionals at large organizations and found about two thirds had used AI tools they believed were against company policy. Netskope telemetry put roughly 47% of workplace generative AI use on personal, unmanaged accounts, so the whole interaction happens outside your controls. Salesforce found only around 18% of organizations have a formal AI security policy at all.
IBM attached a price to it. Where unauthorized AI use contributed to a breach, it added about 670,000 US dollars to the average cost, and shadow AI was involved in roughly 43% of AI related breaches, more than double the year before.
Two products, two different questions
What made this click for me is that AI governance answers two separate questions, and Microsoft put the answers in two different places. Purview decides what data an AI tool can read and generate from. Entra decides which people and which agents are allowed to authenticate and act at all.
Once you see it that way the failure modes are obvious.
Run Purview alone and you can stop Copilot grounding a response on a labelled document, but an unregistered agent with its own credentials is still working away in your tenant and you have no record it exists. Run Entra alone and every agent has an owner and an expiry date, but a perfectly legitimate agent can still pull personal data out of an unlabelled SharePoint library and put it somewhere awkward.
You need both. That is basically the whole argument.
Agents are service accounts wearing a new hat
The Entra side deserves a pause, because it changed recently and it is the part most teams have not looked at.
An AI tool used to be something a person used. Now agents built in Copilot Studio, Power Platform, Foundry and a growing list of third party platforms hold their own credentials and access resources on their own. They are service accounts, except staff can create them without going anywhere near provisioning.
Anyone who has cleaned up an old Active Directory knows how this ends. An agent spun up for a two week task, never decommissioned, still holding access to a shared mailbox, is the same exposure as the ex-employee account nobody disabled. You have a joiner, mover and leaver process for people. You probably have nothing for agents. Entra now treats agent identities as their own identity type, which is what makes a lifecycle possible.
The Purview half
Everything here is at https://purview.microsoft.com, and most of it needs Microsoft 365 E5 or E5 Compliance, so check that before planning anything.
DSPM for AI is the discovery layer and where you should start. It shows which AI apps and agents are in use across the tenant, covering Copilot, Entra registered AI apps and browser based AI sites, and flags where they are touching labelled data. Sign in with Compliance Administrator rights and work through the Get Started checklist: activate Purview Audit, install the browser extension, onboard devices, switch on the recommended policies. Devices already in Defender for Endpoint show up on their own, which removes most of the effort.
Sensitivity labels and DLP are load bearing, because every other control refers back to them. A document labelled Restricted can be configured so Copilot will not use it, and DLP lets you write a policy that names Copilot as a location. Build and publish the labels first. A DLP policy pointing at unpublished labels does nothing at all and it will not warn you, which is a fun afternoon to lose.
Auditing captures every prompt and response through Copilot and connected apps. Confirm it is on rather than assuming, and do it early. Audit data cannot be recovered for a period when logging was off, and the first time you need it will be the worst possible moment to find that out.
Communication compliance points the monitoring you already run on email and Teams at AI prompts instead, using shipped AI templates. Scoping deserves care, and security should not configure it alone. Get HR and legal in the room first.
Compliance Manager gives you assessment templates and a scored list of improvement actions with owners attached, which beats writing a framework from scratch.
The Entra half
Everything here is at https://entra.microsoft.com.
Agent ID gives each agent its own identity rather than folding it into a shared service account, so it carries an owner, a lifecycle and an audit trail. Agents from supported platforms appear automatically, which means the view doubles as an inventory.
If you only do one thing from this post, do this one. Viewing agent identities needs no admin role whatsoever, so you can open that page right now, before any project exists, and see what is already running. Managing agents you do not own needs Agent ID Administrator or Cloud Application Administrator.
Identity governance applies the machinery you already use, meaning access reviews, entitlement management and lifecycle workflows, to agents as well as people. Access gets recertified on a schedule and revoked when it stops being used, which stops orphaned agents piling up.
Agent blueprints are the parent definition a class of agents inherits its permissions and policies from. Approving a new agent turns into assigning it to an existing blueprint instead of running a fresh review every time. Better still, disabling a blueprint kills every agent built from it in one action, which you want to already have during an incident rather than discover afterwards.
Conditional Access can now target agents, applying device compliance, location conditions and a risk score for the agent itself. Identity Protection produces a Risky Agents report with 90 days of detections. This needs Entra ID P1, and the risk reporting needs P2, so settle licensing before you build a plan on it.
The agent registry works across Defender, Entra and Intune to surface agents nobody provisioned, including coding assistants and MCP servers your developers connected themselves. MCP adoption grew sharply through 2025 and is still largely ungoverned, so this is not hypothetical.
Where all of it actually lives
Portal navigation eats more time than the configuration does, so here is the whole thing on one page.
Risk against control
Two things fall out of that.
The low effort controls are almost all discovery, which argues for starting there. You can produce something genuinely useful in week one without touching anyone's workflow.
The medium effort work is gated on licensing more than difficulty. P1 and P2 decide whether Conditional Access for agents is available to you at all, so answer that before committing to dates you cannot hold.
How I would sequence it
Discover. Turn on DSPM for AI, confirm audit is active, install the extension on pilot machines, open the Agent identities view. Nothing gets blocked. The output is a factual picture of what is happening, which most teams cannot produce today.
Classify. Label your highest risk data first instead of attempting everything. At the same time, give every agent discovery found a named owner. This is usually where forgotten agents quietly die, because nobody will claim them.
Control. With labels published and agents owned, enforcement is mechanical. DLP scoped to Copilot, your first blueprint or two, Conditional Access for agents using the conditions you already apply to people.
Sustain. Fold agents into the access review cadence you already run instead of standing up a parallel process, and review the Compliance Manager score on a schedule.
What this does not fix
Purview and Entra govern your tenant. Someone on a personal AI account on a personal device is narrowed by these controls rather than stopped, which is why a staff facing AI policy still matters alongside the technical work.
A lot of the agent capability is recent and some is still in preview, so features and navigation will move. Check the Microsoft Learn pages rather than trusting a six month old runbook, this post included.
And every one of these controls produces findings a human has to act on. Without a named owner, the reports quietly accumulate until someone asks why nobody noticed.
Last thought
What I like about the Purview and Entra split is that it matches how we already think. We have spent years keeping identity controls separate from data controls, and AI just added a new kind of actor on one side and a new kind of data flow on the other.
Start by counting. You cannot write sensible policy about a population you have never counted.
