Your board asks what stops an agent wiping a mailbox. This is the answer, control by control, with the evidence.
Your people are spinning up Copilot agents. Microsoft's docs are scattered and read like marketing, and a practitioner probe that returns ContentFiltered tells you a filter fired, not what it stopped. You need a defensible account you can hand a risk committee, and a way to gather evidence for each control in your own tenant instead of trusting a settings screenshot.
Twenty-two files. Eight per-control test cards, four read-only assessment scripts, a one-page board answer, and the limits written down. Every document ships as a typeset PDF and its Markdown source.
This kit gathers and structures evidence, control by control. It documents your posture. It does not prove your agents are secure and is not a guarantee of any security outcome. It is a verification aid, not security, legal, or compliance advice.
The four assessment scripts inspect posture and make no configuration or data changes, and this kit does not ship attack or destructive-test scripts. That is the AI-prepares-humans-decide boundary as a feature: the tool prepares the finding, a human decides and acts. The verification kit's two behavioral probes are different in kind, and the kit says so where it matters: the prompt-injection test and the destructive-action gate test send live prompts and can trigger agent actions, so run them against a non-production or explicitly consented agent, never blind against production.
So you can self-select out: if you came for a script that deletes mail, changes a permission, or exercises an attack, this is not that product and never will be. Buy it to document and structure your posture control by control, not to break something.
An audit instrument, not a report you plow through.
The centerpiece is a verification kit: eight per-control test cards, numbered T1 to T8 consistently with the scripts, that each tell you what to test, the steps sourced to a named Microsoft or standards page, what a PASS looks like, what a FAIL means, and where to go to fix it.
Alongside it, a one-page board answer to the mailbox-wipe question, written so a CISO can read it straight into a minute. The four read-only assessment scripts turn the kit from a document into an instrument: they gather the evidence, you make the call.
Eight controls, numbered the same way in the kit, the scripts and this page. Each card carries what-to-test, sourced steps, PASS, FAIL, fix, and a standards anchor.
AI prepares, humans decide. A governed agent must never hold standing authorization for a consequential or irreversible action without a human in front of it.
Every Graph call is a GET. There is no write cmdlet anywhere in the bundle.
Not a commented-out write command waiting to be un-commented, either. The only file any script writes is a local findings CSV on your own machine, and only when you pass -CsvPath.
- The first admin consent to the Microsoft Graph PowerShell client registers that client's service principal in Entra.
- It also registers your delegated read-scope grant.
- Both are created by your consent rather than by a script, and once for the tenant rather than once per run.
- Both are reviewable and revocable under Enterprise applications.
Which is why the wording here is the scripts write nothing, and not the tidier claim that running them leaves no trace. The tidier claim would be false.
Read three of these files first, and run one of the scripts in your own tenant.
Gumroad has no file-preview mechanism, so rather than ask you to take the read-only claim on trust, three of the files and one of the scripts are in the free Lite bundle instead. It is a $0 download on this same store.
- The sample script sample-list-agent-identities-v1.ps1, which lists your Entra Agent IDs and flags any with no named, active sponsor.
- The per-script sample outputs, showing what each script prints. Constructed illustrations rather than captures of a live tenant, on a fictional tenant with no real data, with the verdicts, flag wording and column layout reproduced exactly as the scripts emit them.
- The required-reader-roles matrix, which names the exact least-privileged READ scope each script needs, so you can verify the bundle asks for read rights only.
- And the limits page, so you can read what the kit does not prove before you pay for it.
Get the free bundle first if that matters to you: Agent Security Verification Checklist for Microsoft 365 Copilot (Lite), $0 or name your price, on this same store.
Named here with its limit in the same breath, because it is the only real measurement in this product.
The author ran every PowerShell script in this bundle end to end against a purpose-built Microsoft 365 E5 tenant, with seeded canaries and with ground truth recorded out of band, from a separate administrator session, before each run. One tenant, one operator, and that operator is the author, 15 to 18 August 2026. That run found defects in the kit's own scripts, and those defects were fixed before this went on sale. That is the whole of the claim: a process claim about how the kit was built, never an assurance claim about your agents, and nobody outside has looked at any of it.
The fourth assessment script, the query pack, was evaluated against records captured from that tenant rather than executed in Log Analytics. So this query cannot return a row against this record shape is established, and this query returned zero is not.
The sample outputs stay constructed illustrations rather than captures, and no amount of tenant work changes that. What they do reproduce exactly is the verdicts, the flag wording and the column layout.
They do not merge. Documentary claims are current as of July 2026. Only the tenant measurements are 15 to 18 August 2026, and they are dated in place wherever they appear.
The item-by-item bound list, including everything the run never touched, is in What this kit does not prove, which the free tier also ships so you can read it before paying anything.
Twenty-two files. Nine components. Every document as a typeset PDF and its Markdown source.
The PDF is for printing and circulating. The Markdown is for pasting into your own audit materials. The scripts ship as scripts.
The verification kit, T1 to T8PDF + MD
Eight per-control test cards. Each one gives you what to test, the steps sourced to a named Microsoft or standards page, what a PASS looks like, what a FAIL means, and where to go to fix it, plus an audit header and result tables you fill in once per run. The threat-to-standards crosswalk ships inside the kit as a static reference table, mapping each threat to its OWASP entry, ATLAS technique ID, NIST category and mitigating Microsoft control. Those mappings are interpretive crosswalks, not primary facts, and they say so.
The mailbox-wipe board one-pagerPDF + MD
The precise answer to what stops an agent wiping a mailbox, written so a CISO can read it straight into a minute: the five load-bearing controls in the order they apply, and the explicit note that the content filter and the runtime confirmation prompt are courtesies, not controls.
Agent inventory, and least privilegePowerShell
Two read-only Microsoft Graph scripts. The first enumerates agent identities with their owners and sponsors and flags any with no named, active human sponsor (T2), and it states its blind spots up front: Agent Builder agents carry no Agent ID, draft agents have no directory object at all because publishing is what mints the Agent ID, and legacy app registrations cannot always be classified reliably. Treat the count as best-effort, not a guaranteed census. The second lists app-only agents holding write, delete, send or manage scopes beyond a read-only need, such as Mail.ReadWrite, which is the dangerous path in the mailbox-wipe walkthrough (T3).
DLP for Copilot presence checkPowerShell
Checks for a Microsoft 365 Copilot and Copilot Chat Purview DLP location and reports its presence and mode, enforcing versus still in simulation (T5). Presence and mode alone do not establish efficacy: scope, groups, conditions, exclusions and licensing all matter, so a present policy is a signal to investigate, not a PASS. The script says that too.
The audit-signal query packKQL
Two source-separated sections. Section A queries Application Insights for the content-filter error. Section B queries an ingested Purview audit table and is written against a measured record shape rather than a documented field list: it censuses what your tenant actually emits, keys jailbreak detection on the element type that was measured to work, and reports attribution completeness on AgentId, AgentBlueprintId, AppIdentity and AppHost (T1 and T7). A live capture on 17 August 2026 found the documented XPIADetected and JailbreakDetected flags, the Messages property and AgentName absent from every record, so queries built on them returned a false clean rather than an error. Confirm your own table and column names, and read a missing field as inconclusive, never as an automatic PASS.
The run guide, the reader-roles matrix, the sample outputsPDF + MD
How to run each script read-only, the modules and reader roles, the expected output, the explicit read-only safety statement, and the rule that a behavioral probe gets run several times because LLM output is not deterministic. The reader-roles matrix names the exact least-privileged READ scope each script needs, so you can confirm before you run that nothing asks for a write role. The sample outputs give one worked example per script: constructed illustrations rather than captures of a live tenant, with the verdicts, flag wording and column layout reproduced exactly as the scripts emit them.
A checksum manifestSHA-256
Checksums for every file in the script bundle, so you can verify what you received matches what shipped. It is an integrity check, not an authenticity signature: it catches corruption and truncation, and it cannot by itself prove origin, because a tamperer could regenerate it. Treat it as a checksum, not a signature.
What this kit does not provePDF + MD
The limits page, and the one to read before you cite a passed check as evidence to anyone. It names every boundary a full green sheet does not establish: it does not prove your other agents are safe, does not confer prompt-injection immunity, does not extend Conditional Access over non-Entra tools, does not certify your licensing entitlement, and does not replace Microsoft's own documentation. It also states the bounds of the author's live-tenant testing, item by item, including what was measured, what was not tested, and what returned an empty result rather than a pass. The free tier ships it too, so you can read it before paying anything.
Licensing dependency matrix, and the risk acceptance formPDF + MD
Which agent-security capability depends on which licence, the prerequisite chain, and a three-question entitlement check to date and file before an audit cycle. Then the one-page form, printable and signable, plus a register: a check you cannot run, a capability you are not licensed for, or an N/A on a non-critical control is a documented acceptance a named human signs with an expiry and a re-test trigger, never a checkbox. The form makes that cheap enough to actually do.
Every claim traces to a page you can open yourself.
This is a briefing from an independent practitioner. Microsoft is cited as a source, never cheered, and each control is described with its residual risk named. The EchoLeak CVE is cited to its NVD record, with the 9.3 Critical score attributed to Microsoft as the CNA and NVD's own 7.5 base score named alongside it.
The audit instrument, today.
Pay once, keep it, and get updates to the current edition free. Re-verification is semi-annual, and the next re-verify is due February 2027.
- The T1 to T8 verification kit, PDF and Markdown
- Four read-only assessment scripts, plus the free sample
- The mailbox-wipe board one-pager
- Limits page, licensing matrix, risk acceptance form
- Everything in the Core tier
- The 30-page, 10,000-word source-cited dossier
- Filterable crosswalk workbook, citation workbook, audit-log samples
- Internal-use org licence covering a whole organization, no headcount limit
Licensed, not sold. One purchase covers your own use inside your organization, and full terms are at kesslernity.com/license. Not sure yet? The free Lite bundle is the same store and costs nothing.
The person who has to answer for it.
A CISO or risk owner who needs a defensible account. A security architect or M365 admin who has to gather the evidence. An internal audit or GRC lead who needs the check written down, dated, and signed off, including the checks that could not be run.
Anyone who wants software, or wants to break something.
There is no dashboard here, no connector, no automated pipeline. The scripts are read-only assessment tools, not remediation runbooks. It is M365 Copilot specific, not a general agent stack. It is not legal, compliance or regulatory sign-off, and it is not a live assessment of your tenant. And it is emphatically not for anyone hunting a script that performs, simulates or enables a destructive action, because refusing to ship one is the entire point.
Also on the shelf.
Agent Security Verification Checklist (Lite)
Seven printable checks, one read-only script, the sample outputs, the reader-roles matrix and the limits page.
Verification kit plus the deep-research dossier
Everything in Core, plus the 30-page dossier, the filterable crosswalk, audit-log samples and an uncapped internal-use org licence.
The M365 Copilot Deployment Kit
If the question after security is rollout: the deployment work, the governance checklist, the roadmap and the business case.
Before you buy.
What exactly do I get, and do I have to read a book to use it?
Will these scripts run in my setup, and what access do they need?
How long does it take?
Is this just AI-generated fluff?
What about refunds and licensing?
This product is an orientation and verification-methodology aid. It is not security, legal, compliance, or regulatory advice. It is not a guarantee of any security outcome. The read-only assessment scripts are run at the buyer's own discretion under least-privileged reader roles. Microsoft changes product behavior and control defaults over time, and standards versions move too, so claims are stamped as of July 2026 and each cited primary source should be re-verified before you rely on it. Nothing here authorizes an AI agent to hold standing authorization for a consequential or irreversible action; a human decision must sit before any such action.