Someone in your org spun up a Copilot agent. Seven printable checks, and one read-only script you can point at your own tenant today.
You have been asked whether that agent is safe to keep running, and you want a defensible yes or no per control rather than a vendor screenshot. This is the front door to the full verification kit: a seven-check printable audit sheet plus one read-only script, sized so one person can run it against one agent in an afternoon. Check 1 is the ContentFiltered prompt-injection probe, the one most teams over-trust, with the honest caveat that the filter is probabilistic and that EchoLeak (CVE-2025-32711) proved classifier layers alone were bypassed.
Fifteen files. The seven-check checklist, a printable audit sheet, one read-only PowerShell script, the reader-roles matrix, the per-script sample outputs, and the limits page. Every document ships as a typeset PDF and its Markdown source.
This kit gathers and structures evidence, control by control. It documents your posture. It does not prove your agents are secure and is not a guarantee of any security outcome. It is a verification aid, not security, legal, or compliance advice.
The read-only scripts in this ladder, the bundled sample included, inspect posture and make no configuration or data changes, and nothing here ships attack or destructive-test scripts. That is the AI-prepares-humans-decide boundary as a feature: the tool prepares the finding, a human decides and acts. The checklist's two behavioral checks are different in kind, and the sheet says so where it matters: the prompt-injection probe and the destructive-action gate test send live prompts and can trigger agent actions, so run them against a non-production or explicitly consented agent, never blind against production.
So you can self-select out: this is a name-your-price download, free at $0, in exchange for an email, and the honest upsell is that it is a deliberate subset of the paid kit rather than the whole instrument. If you came for a script that deletes mail, changes a permission, or exercises an attack, this is not that product and never will be.
A sheet you can put on a clipboard, not a report you plow through.
Each check names what to test, the steps sourced to a named Microsoft or standards page, and what a PASS versus a FAIL looks like. The sheet enforces one governance position throughout: AI prepares, humans decide, which is the feature that keeps a destructive action behind a human. An unrun check is a FAIL until proven otherwise.
Alongside it, one read-only script you can run in your own tenant today: it lists your Entra Agent IDs and flags any with no named, active sponsor, which is check 2 answered with evidence rather than with a screenshot.
Seven checks drawn from the full eight-control set, numbered the same way in the sheet, the script and this page. Oversharing (T6) and grounding (T8) are in the full kit, not here, and the rationale for the subset ships with the bundle.
AI prepares, humans decide. A governed agent must never hold standing authorization for a consequential or irreversible action without a human in front of it.
Every Graph call is a GET. There is no write cmdlet anywhere in the bundle.
Not a commented-out write command waiting to be un-commented, either. The only file any script writes is a local findings CSV on your own machine, and only when you pass -CsvPath.
- The first admin consent to the Microsoft Graph PowerShell client registers that client's service principal in Entra.
- It also registers your delegated read-scope grant.
- Both are created by your consent rather than by a script, and once for the tenant rather than once per run.
- Both are reviewable and revocable under Enterprise applications.
Which is why the wording here is the scripts write nothing, and not the tidier claim that running them leaves no trace. The tidier claim would be false.
This sheet is seven checks. The full kit is all eight controls, four more read-only scripts, and the limits.
The comparison ships in this bundle rather than being left to a guess: whats-in-the-full-kit-v1.md lists exactly what Core and Team contain. The short version is below.
- The full T1 to T8 verification kit, including oversharing (T6) and grounding (T8), with sourced steps, PASS, FAIL and a fix on every card.
- Four read-only assessment scripts: agent inventory, least privilege, DLP presence, and the audit-signal query pack.
- The mailbox-wipe board one-pager, the licensing dependency matrix, the risk acceptance form, and a checksum manifest.
- And in Team, the deep-research dossier, the filterable crosswalk workbook, the citation workbook, redacted audit-log samples, the incident runbook, and an internal-use org licence with no headcount limit.
Run this sheet first. If it earns its afternoon, the Core verification kit is the next step, and the Team tier is the one a whole function shares.
Named here with its limit in the same breath, because it is the only real measurement behind this bundle.
The author ran the read-only sample script in this bundle end to end against a purpose-built Microsoft 365 E5 tenant, with ground truth recorded out of band, from a separate administrator session, before each run. One tenant, one operator, and that operator is the author, 15 to 18 August 2026. That run found defects in the script and they were fixed before release. That is the whole of the claim: a process claim about how this was built, never an assurance claim about your agents, and nobody outside has looked at any of it.
The measurement covers the sample script in this bundle. The Lite checklist itself was not the subject of those measurements, and no amount of tenant work makes a printable sheet a tested artifact.
The per-script sample outputs stay constructed illustrations rather than captures, on a fictional tenant with no real data. What they do reproduce exactly is the verdicts, the flag wording and the column layout.
They do not merge. Documentary claims are current as of July 2026. Only the tenant measurements are 15 to 18 August 2026, and they are dated in place wherever they appear.
The item-by-item bound list, including everything the run never touched, is in What this kit does not prove, which ships free in this bundle so you can read it before paying anything.
Fifteen files. Eight components. Every document as a typeset PDF and its Markdown source.
The PDF is for printing and circulating. The Markdown is for pasting into your own audit materials. The scripts ship as scripts.
The Lite verification checklist, seven checksPDF + MD
Seven headline checks, each with PASS, FAIL and N/A columns and a date field, plus an audit header you fill once per run. The seven are a deliberate subset of the full T1 to T8 controls: the ContentFiltered prompt-injection probe (T1), distinct identity with a named accountable sponsor (T2), end-user versus maker credentials and no unneeded write or delete scopes (T3, shown as two checks), the destructive-action human gate (T4), DLP for Copilot (T5), and audit attribution (T7). Oversharing (T6) and grounding (T8) are not here. They are in the full kit.
The printable audit sheetPDF + MD
The same seven checks stripped to a one-agent, one-auditor, one-afternoon worksheet with a fill-once header and PASS, FAIL and N/A rows, so you can put it on a clipboard and record against it instead of reading prose.
One read-only sample assessment scriptPowerShell
sample-list-agent-identities-v1.ps1, Microsoft Graph PowerShell that enumerates your Entra Agent IDs and flags any with no named, active sponsor, which is check 2 of the sheet. It inspects posture and makes no configuration or data changes, so you can prove the concept in your own tenant before deciding on the full kit. It states its blind spots up front: Agent Builder agents carry no Agent ID, draft agents have no directory object at all because publishing is what mints the Agent ID, and legacy app registrations cannot always be classified reliably. Treat the count as best-effort, not a guaranteed census.
What access each check needs, before you startPDF + MD
The required-reader-roles matrix: the per-script directory roles and Graph read scopes, the one-time admin consent that stops most first runs, and the one place Microsoft's own documentation contradicts itself. It is in this free bundle rather than behind the paywall so you can settle the access question inside your own org before you spend anything.
What every script printsPDF + MD
Per-script sample output for all five assessment scripts, including the four that only ship in the paid bundles, so you can see the shape of a finding before you decide whether it is worth paying for. These are constructed illustrations rather than captures of a live tenant, on a fictional tenant with no real data, and they are labelled as such, with the verdicts, flag wording and column layout reproduced exactly as the scripts emit them.
Why these seven checksPDF + MD
The design rationale behind the subset, and the residual risk each check leaves standing even when it passes. Read it if you have to defend the choice of checks to someone who did not pick them.
What the full kit addsPDF + MD
A plain list of what Core and Team contain, so the upgrade decision is a comparison rather than a guess. It is in the bundle because an honest comparison is cheaper for both of us than a surprise after purchase.
What this kit does not provePDF + MD
The limits page, and the one to read before you cite a passed check as evidence to anyone. Every boundary a full green sheet does not establish, including prompt-injection immunity, licensing entitlement, and the bounds of the author's own live-tenant testing, item by item. It ships free on purpose: if the honest limits change your mind, that is the right outcome before you pay anything.
Every claim traces to a page you can open yourself.
This is a briefing from an independent practitioner. Microsoft is cited as a source, never cheered, and each control is described with its residual risk named. The EchoLeak CVE is cited to its NVD record, with the 9.3 Critical score attributed to Microsoft as the CNA and NVD's own 7.5 base score named alongside it.
The front door, and it costs nothing.
Name your price, including zero. You get updates to the current edition free, and the Lite checklist carries its own quarterly cadence with the next review due October 2026.
- The seven-check checklist and the printable audit sheet
- One read-only assessment script you can run today
- The reader-roles matrix and the per-script sample outputs
- The limits page, and why these seven checks
- All eight controls, T1 to T8, on per-control test cards
- Four read-only assessment scripts, plus this free sample
- The mailbox-wipe board one-pager
- Licensing matrix, risk acceptance form, checksum manifest
Licensed, not sold. Your own use inside your organization, and full terms are at kesslernity.com/license. Ready for all eight controls? The Core verification kit is on this same store.
The person who has to answer for it.
A CISO or risk owner who needs a defensible account. A security architect or M365 admin who has to gather the evidence. An internal audit or GRC lead who needs the check written down, dated, and signed off, including the checks that could not be run.
Anyone who wants software, or wants to break something.
There is no dashboard here, no connector, no automated pipeline. The scripts are read-only assessment tools, not remediation runbooks. It is M365 Copilot specific, not a general agent stack. It is not legal, compliance or regulatory sign-off, and it is not a live assessment of your tenant. And it is emphatically not for anyone hunting a script that performs, simulates or enables a destructive action, because refusing to ship one is the entire point.
Also on the shelf.
Securing Agents in Microsoft 365 Copilot (Core)
All eight controls on per-control test cards, four read-only assessment scripts, the board one-pager and the limits page.
Verification kit plus the deep-research dossier
Everything in Core, plus the 30-page dossier, the filterable crosswalk, audit-log samples and an uncapped internal-use org licence.
The M365 Copilot Deployment Kit
If the question after security is rollout: the deployment work, the governance checklist, the roadmap and the business case.
Before you download.
What exactly do I get for nothing?
Will the script run in my setup, and what access does it need?
How long does it take?
Is this just AI-generated fluff?
What is the catch on a free product?
This product is an orientation and verification-methodology aid. It is not security, legal, compliance, or regulatory advice. It is not a guarantee of any security outcome. The read-only sample script is run at the buyer's own discretion under a least-privileged reader role. Microsoft changes product behavior and control defaults over time, and standards versions move too, so claims are stamped as of July 2026 and each cited primary source should be re-verified before you rely on it. Nothing here authorizes an AI agent to hold standing authorization for a consequential or irreversible action; a human decision must sit before any such action.