Your board asks what stops an agent wiping a mailbox. This is the answer, plus the source-cited depth your function needs to defend it.
When your security function has to defend a Copilot agent rollout to a board or a risk committee, one lead running a checklist is not enough. The people around that lead need the same source-cited account of what secures an agent, the same evidence of what defensible audit output looks like, and a licence that covers everyone in the organization who needs it, with no seat count to track. This is that package: everything in the Core verification kit, plus the depth and the uncapped internal-use org licence a security function needs.
Thirty files. Everything in Core, plus the 30-page source-cited dossier, the filterable crosswalk workbook, the citation workbook, redacted Purview audit-log samples, the incident runbook, and an internal-use org licence with no headcount limit.
This kit gathers and structures evidence, control by control. It documents your posture. It does not prove your agents are secure and is not a guarantee of any security outcome. It is a verification aid, not security, legal, or compliance advice.
The four assessment scripts inspect posture and make no configuration or data changes, and this kit does not ship attack or destructive-test scripts. That is the AI-prepares-humans-decide boundary as a feature: the tool prepares the finding, a human decides and acts. The verification kit's two behavioral probes are different in kind, and the kit says so where it matters: the prompt-injection test and the destructive-action gate test send live prompts and can trigger agent actions, so run them against a non-production or explicitly consented agent, never blind against production.
So you can self-select out: if you came for a script that deletes mail, changes a permission, or exercises an attack, this is not that product and never will be. Buy it to document and structure your posture control by control, not to break something.
An audit instrument one person runs, and a reference layer a function shares.
The instrument is the same control-by-control centerpiece as Core: eight per-control test cards, numbered T1 to T8 consistently with the scripts, that each tell you what to test, the steps sourced to a named Microsoft or standards page, what a PASS looks like, what a FAIL means, and where to go to fix it. Plus the four read-only assessment scripts and the free sample.
On top of it, the reference layer: a 30-page dossier of roughly 10,000 words across seven chapters, 56 numbered footnotes drawn from 28 named primary sources, a filterable crosswalk workbook, a 52-row citation register, and redacted audit-log records so your team can build detections against the measured shape rather than the documented one.
Eight controls, numbered the same way in the kit, the scripts and this page. Each card carries what-to-test, sourced steps, PASS, FAIL, fix, and a standards anchor, and each dossier chapter carries the claim, the evidence, the limit and the consequence.
AI prepares, humans decide. A governed agent must never hold standing authorization for a consequential or irreversible action without a human in front of it.
Every Graph call is a GET. There is no write cmdlet anywhere in the bundle.
Not a commented-out write command waiting to be un-commented, either. The only file any script writes is a local findings CSV on your own machine, and only when you pass -CsvPath.
- The first admin consent to the Microsoft Graph PowerShell client registers that client's service principal in Entra.
- It also registers your delegated read-scope grant.
- Both are created by your consent rather than by a script, and once for the tenant rather than once per run.
- Both are reviewable and revocable under Enterprise applications.
Which is why the wording here is the scripts write nothing, and not the tidier claim that running them leaves no trace. The tidier claim would be false.
Read three of these files first, and run one of the scripts in your own tenant.
Gumroad has no file-preview mechanism, so rather than ask you to take the read-only claim on trust, three of the files and one of the scripts are in the free Lite bundle instead. It is a $0 download on this same store.
- The sample script sample-list-agent-identities-v1.ps1, which lists your Entra Agent IDs and flags any with no named, active sponsor.
- The per-script sample outputs, showing what each script prints. Constructed illustrations rather than captures of a live tenant, on a fictional tenant with no real data, with the verdicts, flag wording and column layout reproduced exactly as the scripts emit them.
- The required-reader-roles matrix, which names the exact least-privileged READ scope each script needs, so you can verify the bundle asks for read rights only.
- And the limits page, so you can read what the kit does not prove before you pay for it.
Get the free bundle first if that matters to you: Agent Security Verification Checklist for Microsoft 365 Copilot (Lite), $0 or name your price, on this same store.
Named here with its limit in the same breath, because it is the only real measurement in this package.
The author ran every PowerShell script in this bundle, the three assessment scripts plus the free sample, end to end against a purpose-built Microsoft 365 E5 tenant, with seeded canaries and with ground truth recorded out of band, from a separate administrator session, before each run. One tenant, one operator, and that operator is the author, 15 to 18 August 2026. That run found defects in the kit's own scripts, and those defects were fixed before this went on sale. That is the whole of the claim: a process claim about how the package was built, never an assurance claim about your agents, and nobody outside has looked at any of it.
The fourth assessment script, the query pack, was evaluated against records captured from that tenant rather than executed in Log Analytics. So this query cannot return a row against this record shape is established, and this query returned zero is not.
The sample outputs stay constructed illustrations rather than captures of a live tenant. The one file here that is a real capture is sample-audit-log-artifacts-v1.json, redacted from Purview records that tenant emitted on 17 August 2026 and labelled as such.
They do not merge. Documentary claims are current as of July 2026. Only the tenant measurements are 15 to 18 August 2026, and they are dated in place wherever they appear.
The item-by-item bound list, including everything the run never touched, is in What this kit does not prove, which the free tier also ships so you can read it before paying anything.
Thirty files. Fifteen components. Every document as a typeset PDF and its Markdown source.
The PDF is for printing and circulating. The Markdown is for pasting into your own audit materials. The scripts ship as scripts.
The verification kit, T1 to T8PDF + MD
Eight per-control test cards. Each one gives you what to test, the steps sourced to a named Microsoft or standards page, what a PASS looks like, what a FAIL means, and where to go to fix it, plus an audit header and result tables you fill in once per run. The threat-to-standards crosswalk ships inside the kit as a static reference table, mapping each threat to its OWASP entry, ATLAS technique ID, NIST category and mitigating Microsoft control. Those mappings are interpretive crosswalks, not primary facts, and they say so.
The mailbox-wipe board one-pagerPDF + MD
The precise answer to what stops an agent wiping a mailbox, written so a CISO can read it straight into a minute: the five load-bearing controls in the order they apply, and the explicit note that the content filter and the runtime confirmation prompt are courtesies, not controls.
Agent inventory, and least privilegePowerShell
Two read-only Microsoft Graph scripts. The first enumerates agent identities with their owners and sponsors and flags any with no named, active human sponsor (T2), and it states its blind spots up front: Agent Builder agents carry no Agent ID, draft agents have no directory object at all because publishing is what mints the Agent ID, and legacy app registrations cannot always be classified reliably. Treat the count as best-effort, not a guaranteed census. The second lists app-only agents holding write, delete, send or manage scopes beyond a read-only need, such as Mail.ReadWrite, which is the dangerous path in the mailbox-wipe walkthrough (T3).
DLP for Copilot presence checkPowerShell
Checks for a Microsoft 365 Copilot and Copilot Chat Purview DLP location and reports its presence and mode, enforcing versus still in simulation (T5). Presence and mode alone do not establish efficacy: scope, groups, conditions, exclusions and licensing all matter, so a present policy is a signal to investigate, not a PASS. The script says that too.
The audit-signal query packKQL
Two source-separated sections. Section A queries Application Insights for the content-filter error. Section B queries an ingested Purview audit table and is written against a measured record shape rather than a documented field list: it censuses what your tenant actually emits, keys jailbreak detection on the element type that was measured to work, and reports attribution completeness on AgentId, AgentBlueprintId, AppIdentity and AppHost (T1 and T7). A live capture on 17 August 2026 found the documented XPIADetected and JailbreakDetected flags, the Messages property and AgentName absent from every record, so queries built on them returned a false clean rather than an error. Confirm your own table and column names, and read a missing field as inconclusive, never as an automatic PASS.
The run guide, the reader-roles matrix, the sample outputsPDF + MD
How to run each script read-only, the modules and reader roles, the expected output, the explicit read-only safety statement, and the rule that a behavioral probe gets run several times because LLM output is not deterministic. The reader-roles matrix names the exact least-privileged READ scope each script needs, so you can confirm before you run that nothing asks for a write role. The sample outputs give one worked example per script: constructed illustrations rather than captures of a live tenant, with the verdicts, flag wording and column layout reproduced exactly as the scripts emit them.
A checksum manifestSHA-256
Checksums for every file in the script bundle, so you can verify what you received matches what shipped. It is an integrity check, not an authenticity signature: it catches corruption and truncation, and it cannot by itself prove origin, because a tamperer could regenerate it. Treat it as a checksum, not a signature.
What this kit does not provePDF + MD
The limits page, and the one to read before you cite a passed check as evidence to anyone. It names every boundary a full green sheet does not establish: it does not prove your other agents are safe, does not confer prompt-injection immunity, does not extend Conditional Access over non-Entra tools, does not certify your licensing entitlement, and does not replace Microsoft's own documentation. It also states the bounds of the author's live-tenant testing, item by item, including what was measured, what was not tested, and what returned an empty result rather than a pass. The free tier ships it too, so you can read it before paying anything.
Licensing dependency matrix, and the risk acceptance formPDF + MD
Which agent-security capability depends on which licence, the prerequisite chain, and a three-question entitlement check to date and file before an audit cycle. Then the one-page form, printable and signable, plus a register: a check you cannot run, a capability you are not licensed for, or an N/A on a non-critical control is a documented acceptance a named human signs with an expiry and a re-test trigger, never a checkbox. The form makes that cheap enough to actually do.
The deep-research dossierPDF
A 30-page, roughly 10,000-word typeset reference carrying 56 numbered footnotes drawn from 28 named primary sources, with a 51-entry bookmarked table of contents. Seven chapters, each one a claim a security function has to be able to defend: filtering is probabilistic and not a boundary; confirmation prompts are configurable and not enforced; the per-tool gate defaults off while maker credentials overshare; delegated access is bounded by the user and app-only is not, including the additive-grant trap; agent inventory has four populations rather than one; data governance governs reading while audit records attribution rather than a transcript; and the human-decides boundary is the control that does not depend on luck. Every chapter runs the same spine: the claim, why it matters, the Microsoft evidence, the standards anchor, the limit, and the operational consequence.
The threat model and standards crosswalk, filterableXLSX
The eight-threat mapping from OWASP LLM Top 10 2025 to MITRE ATLAS v5.4.0 technique IDs to NIST AI 600-1 category to mitigating Microsoft control, as a sortable workbook you drop straight into a risk-committee pack. The mappings are interpretive crosswalks traceable to a cited control, not primary facts, and the workbook says so.
Sample audit-log artifacts, redacted from a live captureJSON
Purview Copilot interaction records (RecordType 261) captured from a purpose-built Microsoft 365 E5 tenant on 17 August 2026 and redacted for publication, so the field names, nesting, casing and cardinality are exactly what the platform emitted and only the values were changed. It shows the AccessedResources block where it actually lives, nested under CopilotEventData, the AgentId, AgentBlueprintId and AppIdentity attribution fields, and a jailbreak detection in the form it is really recorded. It also carries an explicit list of the documented fields that were NOT present, including XPIADetected, JailbreakDetected, the Messages property and AgentName, because this file replaces an earlier synthetic version written from the documented field list that invented a schema the platform does not emit. Build your detections against the measured shape. No real tenant identifiers, users or prompt text.
The citation workbookXLSX
A 52-row claim register, one row per load-bearing claim, each with a stable claim ID, the source title and URL, a confidence score and an as-of date, plus a volatility rating and a re-check date on the 31 rows whose surface is version-sensitive enough to warrant one. A blank there means not rated, never stable. Sources span eight authorities: Microsoft Learn, MSRC, the Microsoft Security Blog, MITRE, NIST, NVD, OWASP and arXiv. Filter by authority, by volatility, or by the kit section a claim sits in, then open the URL and confirm the behavior still holds.
The internal-use org licencePDF + MD
Covers your whole organization with no headcount limit, staff plus contractors acting on your behalf, across any of your security, IT, risk and governance functions, for internal use of the kit and the read-only scripts against your own tenants, with no redistribution and no resale. There is no seat count to track and nothing to report to us. The limit is the entity rather than the headcount: separate legal entities inside a group are not covered, and neither is paid assessment work for clients. Both of those are an email, not a checkbox.
The agent incident runbook, one pagePDF + MD
Six steps in the order that keeps the evidence: contain by origin and type, preserve the audit trail and apply holds before any destructive step, disable by origin, revoke grants and credentials, investigate, then delete only once evidence is preserved. It carries an expected-latency box so revocation and hold timings are not a surprise at the worst moment. Written for a function with handoffs, which is why it sits in this tier.
Every claim traces to a page you can open yourself.
This is a briefing from an independent practitioner. Microsoft is cited as a source, never cheered, and each control is described with its residual risk named. The EchoLeak CVE is cited to its NVD record, with the 9.3 Critical score attributed to Microsoft as the CNA and NVD's own 7.5 base score named alongside it.
The instrument, plus the reference layer, for the whole function.
Pay once, keep it, and get updates to the current edition free. Re-verification is semi-annual, and the next re-verify is due February 2027.
- Everything in the Core tier, T1 to T8 and all four scripts
- The 30-page, 10,000-word source-cited dossier
- Filterable crosswalk workbook, citation workbook, audit-log samples
- Internal-use org licence covering a whole organization, no headcount limit
- The T1 to T8 verification kit, PDF and Markdown
- Four read-only assessment scripts, plus the free sample
- The mailbox-wipe board one-pager
- A single-user grant rather than an org licence
Licensed, not sold. The org licence covers your whole organization with no headcount limit, and full terms are at kesslernity.com/license. Not sure yet? The free Lite bundle is the same store and costs nothing.
The person who has to answer for it.
A CISO or risk owner who needs a defensible account. A security architect or M365 admin who has to gather the evidence. An internal audit or GRC lead who needs the check written down, dated, and signed off, including the checks that could not be run.
Anyone who wants software, or wants to break something.
There is no dashboard here, no connector, no automated pipeline. The scripts are read-only assessment tools, not remediation runbooks. It is M365 Copilot specific, not a general agent stack. It is not legal, compliance or regulatory sign-off, and it is not a live assessment of your tenant. And it is emphatically not for anyone hunting a script that performs, simulates or enables a destructive action, because refusing to ship one is the entire point.
Also on the shelf.
Agent Security Verification Checklist (Lite)
Seven printable checks, one read-only script, the sample outputs, the reader-roles matrix and the limits page.
Securing Agents in Microsoft 365 Copilot (Core)
The same audit instrument for one person: all eight controls, the four read-only scripts, and a single-user grant instead of the org licence.
The M365 Copilot Deployment Kit
If the question after security is rollout: the deployment work, the governance checklist, the roadmap and the business case.
Before you buy.
What is the difference between this and the Core tier?
What does the org licence actually allow, and what does it forbid?
Will the scripts run in my setup, and what access do they need?
Is this just AI-generated fluff?
What about refunds?
This product is an orientation and verification-methodology aid. It is not security, legal, compliance, or regulatory advice. It is not a guarantee of any security outcome. The read-only assessment scripts are run at the buyer's own discretion under least-privileged reader roles. Microsoft changes product behavior and control defaults over time, and standards versions move too, so claims are stamped as of July 2026 and each cited primary source should be re-verified before you rely on it. Nothing here authorizes an AI agent to hold standing authorization for a consequential or irreversible action; a human decision must sit before any such action.