Agent security / Microsoft 365 Copilot

Your board asks what stops an agent wiping a mailbox. This is the answer, control by control, with the evidence.

Your people are spinning up Copilot agents. Microsoft's docs are scattered and read like marketing, and a practitioner probe that returns ContentFiltered tells you a filter fired, not what it stopped. You need a defensible account you can hand a risk committee, and a way to gather evidence for each control in your own tenant instead of trusting a settings screenshot.

Twenty-two files. Eight per-control test cards, four read-only assessment scripts, a one-page board answer, and the limits written down. Every document ships as a typeset PDF and its Markdown source.

Read-only by design Sourced to Microsoft Learn, OWASP, MITRE ATLAS, NIST One agent, one afternoon
The downloadCore tier
01The verification kit, full T1 to T8Eight per-control test cards, PDF and Markdown
02The mailbox-wipe board one-pagerFive load-bearing controls, in the order they apply
03Four read-only assessment scriptsInventory, least privilege, DLP presence, audit KQL
04The run guide and the reader-roles matrixWhich READ scope each script needs, and why
05Licensing dependency matrix, risk acceptance formFor the checks you cannot run and must sign off
06What this kit does not proveThe limits page, item by item
22 files · $69 · every document as PDF and Markdown
No guarantee. Read this before you buy.

This kit gathers and structures evidence, control by control. It documents your posture. It does not prove your agents are secure and is not a guarantee of any security outcome. It is a verification aid, not security, legal, or compliance advice.

Read-only assessment scripts by design

The four assessment scripts inspect posture and make no configuration or data changes, and this kit does not ship attack or destructive-test scripts. That is the AI-prepares-humans-decide boundary as a feature: the tool prepares the finding, a human decides and acts. The verification kit's two behavioral probes are different in kind, and the kit says so where it matters: the prompt-injection test and the destructive-action gate test send live prompts and can trigger agent actions, so run them against a non-production or explicitly consented agent, never blind against production.

Refund expectation, stated up front

So you can self-select out: if you came for a script that deletes mail, changes a permission, or exercises an attack, this is not that product and never will be. Buy it to document and structure your posture control by control, not to break something.

The instrument

An audit instrument, not a report you plow through.

The centerpiece is a verification kit: eight per-control test cards, numbered T1 to T8 consistently with the scripts, that each tell you what to test, the steps sourced to a named Microsoft or standards page, what a PASS looks like, what a FAIL means, and where to go to fix it.

Alongside it, a one-page board answer to the mailbox-wipe question, written so a CISO can read it straight into a minute. The four read-only assessment scripts turn the kit from a document into an instrument: they gather the evidence, you make the call.

T1–T8

Eight controls, numbered the same way in the kit, the scripts and this page. Each card carries what-to-test, sourced steps, PASS, FAIL, fix, and a standards anchor.

T1 Prompt injection, and the ContentFiltered probe
T2 Distinct agent identity with a named accountable sponsor
T3 Least privilege and permission inheritance
T4 The destructive-action human approval gate
T5 DLP for Copilot
T6 Oversharing
T7 Audit attribution
T8 Grounding
The governing rule

AI prepares, humans decide. A governed agent must never hold standing authorization for a consequential or irreversible action without a human in front of it.

Read-only, and what that actually means

Every Graph call is a GET. There is no write cmdlet anywhere in the bundle.

Not a commented-out write command waiting to be un-commented, either. The only file any script writes is a local findings CSV on your own machine, and only when you pass -CsvPath.

One honest exception, stated here rather than left for you to find
  • The first admin consent to the Microsoft Graph PowerShell client registers that client's service principal in Entra.
  • It also registers your delegated read-scope grant.
  • Both are created by your consent rather than by a script, and once for the tenant rather than once per run.
  • Both are reviewable and revocable under Enterprise applications.

Which is why the wording here is the scripts write nothing, and not the tidier claim that running them leaves no trace. The tidier claim would be false.

Before you spend anything

Read three of these files first, and run one of the scripts in your own tenant.

Gumroad has no file-preview mechanism, so rather than ask you to take the read-only claim on trust, three of the files and one of the scripts are in the free Lite bundle instead. It is a $0 download on this same store.

In the free Lite bundle, no payment, just an email
  • The sample script sample-list-agent-identities-v1.ps1, which lists your Entra Agent IDs and flags any with no named, active sponsor.
  • The per-script sample outputs, showing what each script prints. Constructed illustrations rather than captures of a live tenant, on a fictional tenant with no real data, with the verdicts, flag wording and column layout reproduced exactly as the scripts emit them.
  • The required-reader-roles matrix, which names the exact least-privileged READ scope each script needs, so you can verify the bundle asks for read rights only.
  • And the limits page, so you can read what the kit does not prove before you pay for it.

Get the free bundle first if that matters to you: Agent Security Verification Checklist for Microsoft 365 Copilot (Lite), $0 or name your price, on this same store.

The August tenant run

Named here with its limit in the same breath, because it is the only real measurement in this product.

The author ran every PowerShell script in this bundle end to end against a purpose-built Microsoft 365 E5 tenant, with seeded canaries and with ground truth recorded out of band, from a separate administrator session, before each run. One tenant, one operator, and that operator is the author, 15 to 18 August 2026. That run found defects in the kit's own scripts, and those defects were fixed before this went on sale. That is the whole of the claim: a process claim about how the kit was built, never an assurance claim about your agents, and nobody outside has looked at any of it.

KQL

The fourth assessment script, the query pack, was evaluated against records captured from that tenant rather than executed in Log Analytics. So this query cannot return a row against this record shape is established, and this query returned zero is not.

Samples

The sample outputs stay constructed illustrations rather than captures, and no amount of tenant work changes that. What they do reproduce exactly is the verdicts, the flag wording and the column layout.

Two dates

They do not merge. Documentary claims are current as of July 2026. Only the tenant measurements are 15 to 18 August 2026, and they are dated in place wherever they appear.

The item-by-item bound list, including everything the run never touched, is in What this kit does not prove, which the free tier also ships so you can read it before paying anything.

What's inside

Twenty-two files. Nine components. Every document as a typeset PDF and its Markdown source.

The PDF is for printing and circulating. The Markdown is for pasting into your own audit materials. The scripts ship as scripts.

01

The verification kit, T1 to T8PDF + MD

Eight per-control test cards. Each one gives you what to test, the steps sourced to a named Microsoft or standards page, what a PASS looks like, what a FAIL means, and where to go to fix it, plus an audit header and result tables you fill in once per run. The threat-to-standards crosswalk ships inside the kit as a static reference table, mapping each threat to its OWASP entry, ATLAS technique ID, NIST category and mitigating Microsoft control. Those mappings are interpretive crosswalks, not primary facts, and they say so.

02

The mailbox-wipe board one-pagerPDF + MD

The precise answer to what stops an agent wiping a mailbox, written so a CISO can read it straight into a minute: the five load-bearing controls in the order they apply, and the explicit note that the content filter and the runtime confirmation prompt are courtesies, not controls.

03

Agent inventory, and least privilegePowerShell

Two read-only Microsoft Graph scripts. The first enumerates agent identities with their owners and sponsors and flags any with no named, active human sponsor (T2), and it states its blind spots up front: Agent Builder agents carry no Agent ID, draft agents have no directory object at all because publishing is what mints the Agent ID, and legacy app registrations cannot always be classified reliably. Treat the count as best-effort, not a guaranteed census. The second lists app-only agents holding write, delete, send or manage scopes beyond a read-only need, such as Mail.ReadWrite, which is the dangerous path in the mailbox-wipe walkthrough (T3).

04

DLP for Copilot presence checkPowerShell

Checks for a Microsoft 365 Copilot and Copilot Chat Purview DLP location and reports its presence and mode, enforcing versus still in simulation (T5). Presence and mode alone do not establish efficacy: scope, groups, conditions, exclusions and licensing all matter, so a present policy is a signal to investigate, not a PASS. The script says that too.

05

The audit-signal query packKQL

Two source-separated sections. Section A queries Application Insights for the content-filter error. Section B queries an ingested Purview audit table and is written against a measured record shape rather than a documented field list: it censuses what your tenant actually emits, keys jailbreak detection on the element type that was measured to work, and reports attribution completeness on AgentId, AgentBlueprintId, AppIdentity and AppHost (T1 and T7). A live capture on 17 August 2026 found the documented XPIADetected and JailbreakDetected flags, the Messages property and AgentName absent from every record, so queries built on them returned a false clean rather than an error. Confirm your own table and column names, and read a missing field as inconclusive, never as an automatic PASS.

06

The run guide, the reader-roles matrix, the sample outputsPDF + MD

How to run each script read-only, the modules and reader roles, the expected output, the explicit read-only safety statement, and the rule that a behavioral probe gets run several times because LLM output is not deterministic. The reader-roles matrix names the exact least-privileged READ scope each script needs, so you can confirm before you run that nothing asks for a write role. The sample outputs give one worked example per script: constructed illustrations rather than captures of a live tenant, with the verdicts, flag wording and column layout reproduced exactly as the scripts emit them.

07

A checksum manifestSHA-256

Checksums for every file in the script bundle, so you can verify what you received matches what shipped. It is an integrity check, not an authenticity signature: it catches corruption and truncation, and it cannot by itself prove origin, because a tamperer could regenerate it. Treat it as a checksum, not a signature.

08

What this kit does not provePDF + MD

The limits page, and the one to read before you cite a passed check as evidence to anyone. It names every boundary a full green sheet does not establish: it does not prove your other agents are safe, does not confer prompt-injection immunity, does not extend Conditional Access over non-Entra tools, does not certify your licensing entitlement, and does not replace Microsoft's own documentation. It also states the bounds of the author's live-tenant testing, item by item, including what was measured, what was not tested, and what returned an empty result rather than a pass. The free tier ships it too, so you can read it before paying anything.

09

Licensing dependency matrix, and the risk acceptance formPDF + MD

Which agent-security capability depends on which licence, the prerequisite chain, and a three-question entitlement check to date and file before an audit cycle. Then the one-page form, printable and signable, plus a register: a check you cannot run, a capability you are not licensed for, or an N/A on a non-critical control is a documented acceptance a named human signs with an expiry and a re-test trigger, never a checkbox. The form makes that cheap enough to actually do.

Vendor-neutral, and sourced

Every claim traces to a page you can open yourself.

Microsoft Learn MSRC NVD, for CVE-2025-32711 OWASP LLM Top 10 2025 MITRE ATLAS v5.4.0 NIST AI 600-1

This is a briefing from an independent practitioner. Microsoft is cited as a source, never cheered, and each control is described with its residual risk named. The EchoLeak CVE is cited to its NVD record, with the 9.3 Critical score attributed to Microsoft as the CNA and NVD's own 7.5 base score named alongside it.

Get the kit

The audit instrument, today.

Pay once, keep it, and get updates to the current edition free. Re-verification is semi-annual, and the next re-verify is due February 2027.

Core This page
$69
The audit instrument. Twenty-two files.
  • The T1 to T8 verification kit, PDF and Markdown
  • Four read-only assessment scripts, plus the free sample
  • The mailbox-wipe board one-pager
  • Limits page, licensing matrix, risk acceptance form
Get the Core kit · $69
Team
$97
Everything in Core, plus the dossier and an org licence.
  • Everything in the Core tier
  • The 30-page, 10,000-word source-cited dossier
  • Filterable crosswalk workbook, citation workbook, audit-log samples
  • Internal-use org licence covering a whole organization, no headcount limit
See the Team tier · $97

Licensed, not sold. One purchase covers your own use inside your organization, and full terms are at kesslernity.com/license. Not sure yet? The free Lite bundle is the same store and costs nothing.

Who it is for

The person who has to answer for it.

A CISO or risk owner who needs a defensible account. A security architect or M365 admin who has to gather the evidence. An internal audit or GRC lead who needs the check written down, dated, and signed off, including the checks that could not be run.

Who it is not for

Anyone who wants software, or wants to break something.

There is no dashboard here, no connector, no automated pipeline. The scripts are read-only assessment tools, not remediation runbooks. It is M365 Copilot specific, not a general agent stack. It is not legal, compliance or regulatory sign-off, and it is not a live assessment of your tenant. And it is emphatically not for anyone hunting a script that performs, simulates or enables a destructive action, because refusing to ship one is the entire point.

The rest of the ladder

Also on the shelf.

Questions

Before you buy.

What exactly do I get, and do I have to read a book to use it?
No. The buyable unit is the audit instrument, not a report you plow through. Twenty-two files: the T1 to T8 verification kit, the mailbox-wipe board one-pager, four read-only assessment scripts plus the free sample script, a run guide, the required-reader-roles matrix, the per-script sample outputs, a checksum manifest, the limits page, the licensing dependency matrix, and the risk acceptance form. Every document ships as both a typeset PDF and its Markdown source, so you can print and circulate it or paste it into your own audit materials. The scripts ship as scripts. You can run the kit without reading a single page of prose.
Will these scripts run in my setup, and what access do they need?
They are PowerShell for Microsoft Graph and Exchange, plus KQL for Application Insights and Log Analytics. Every one runs read-only. For two checks the answer is a role: the DLP check uses View-Only DLP Compliance Management, which ships inside Security Reader, and the KQL needs Reader on the Application Insights resource and the workspace. For the three Graph scripts the answer is not a role at all. They need the delegated read scopes AgentIdentity.Read.All, Directory.Read.All and Application.Read.All, and because all three are admin-consent scopes, a one-time tenant-wide admin consent is the real gate. It fires before a token is issued, so no reader role substitutes for it, and a tested run confirmed an operator holding zero directory roles succeeds once consent is in place. Arrange that consent before your first run. It is the step that most often stops one. Nothing needs a write scope or an admin write role.
How long does it take?
You can run the full kit against one agent in an afternoon. The four assessment scripts plus the free sample each run in minutes and hand you a finding you decide on. Because LLM output is not deterministic, the behavioral probes get run several times, and one follow-through out of five is a FAIL, not a fluke.
Is this just AI-generated fluff?
The prose was drafted with AI agents inside a gated factory pipeline, and it is more honest to tell you than to pretend otherwise. It then passed a deterministic slop scanner and a build checker, and it was fact-checked against authoritative sources, cross-checked by multiple web-capable models plus a vendor-diverse model council to catch fabrication, with load-bearing security claims held to the highest bar. Every citation traces to a named authoritative source: Microsoft Learn, MSRC, NVD, OWASP, MITRE or NIST. The scripts were checked read-only against the Microsoft API documentation. The limits of all of it are written down in the kit's own limits page, including what the live-tenant run did not cover.
What about refunds and licensing?
One purchase covers your own use inside your organization: run the kit and the read-only scripts against your organization's own tenants, adapt the checklists into your internal audit materials, and share the completed outputs and the board one-pager internally. What you may not do is redistribute or resell the source files outside your organization. Full terms are at kesslernity.com/license. It is a Gumroad purchase, so refunds go through Gumroad, and the refund expectation is stated at the top of this page: if you wanted a destructive or attacking script, this product does not ship one by design, so please self-select out before buying.
Disclaimer

This product is an orientation and verification-methodology aid. It is not security, legal, compliance, or regulatory advice. It is not a guarantee of any security outcome. The read-only assessment scripts are run at the buyer's own discretion under least-privileged reader roles. Microsoft changes product behavior and control defaults over time, and standards versions move too, so claims are stamped as of July 2026 and each cited primary source should be re-verified before you rely on it. Nothing here authorizes an AI agent to hold standing authorization for a consequential or irreversible action; a human decision must sit before any such action.

Licensed, not sold

Full License & Terms apply (ref KESS-LIC-2026-001). By purchasing you agree to the version in force on your purchase date.

Kesslernity is an independent publisher. This product is independent analysis and is not affiliated with or sponsored by Microsoft. Microsoft 365 and Copilot are trademarks of the Microsoft group of companies. It is practitioner guidance, not professional, legal, or financial advice.

Questions before you buy, or support after? Contact mathieu@kesslernity.com. Terms of Service · Privacy Policy