Agent security / Microsoft 365 Copilot

Someone in your org spun up a Copilot agent. Seven printable checks, and one read-only script you can point at your own tenant today.

You have been asked whether that agent is safe to keep running, and you want a defensible yes or no per control rather than a vendor screenshot. This is the front door to the full verification kit: a seven-check printable audit sheet plus one read-only script, sized so one person can run it against one agent in an afternoon. Check 1 is the ContentFiltered prompt-injection probe, the one most teams over-trust, with the honest caveat that the filter is probabilistic and that EchoLeak (CVE-2025-32711) proved classifier layers alone were bypassed.

Fifteen files. The seven-check checklist, a printable audit sheet, one read-only PowerShell script, the reader-roles matrix, the per-script sample outputs, and the limits page. Every document ships as a typeset PDF and its Markdown source.

Read-only by design Sourced to Microsoft Learn, OWASP, MITRE ATLAS, NIST One agent, one afternoon
The downloadFree tier
01The Lite verification checklistSeven headline checks, PDF and Markdown
02The printable audit sheetPASS, FAIL and N/A rows you fill on a clipboard
03One read-only sample scriptYour Entra Agent IDs, and who sponsors them
04The required-reader-roles matrixThe READ scope each script needs, and the consent gate
05Why these seven checksThe rationale, and the risk each check leaves standing
06What this kit does not proveThe limits page, item by item
15 files · $0+ · every document as PDF and Markdown
No guarantee. Read this before you buy.

This kit gathers and structures evidence, control by control. It documents your posture. It does not prove your agents are secure and is not a guarantee of any security outcome. It is a verification aid, not security, legal, or compliance advice.

Read-only assessment scripts by design

The read-only scripts in this ladder, the bundled sample included, inspect posture and make no configuration or data changes, and nothing here ships attack or destructive-test scripts. That is the AI-prepares-humans-decide boundary as a feature: the tool prepares the finding, a human decides and acts. The checklist's two behavioral checks are different in kind, and the sheet says so where it matters: the prompt-injection probe and the destructive-action gate test send live prompts and can trigger agent actions, so run them against a non-production or explicitly consented agent, never blind against production.

Refund expectation, stated up front

So you can self-select out: this is a name-your-price download, free at $0, in exchange for an email, and the honest upsell is that it is a deliberate subset of the paid kit rather than the whole instrument. If you came for a script that deletes mail, changes a permission, or exercises an attack, this is not that product and never will be.

The front door

A sheet you can put on a clipboard, not a report you plow through.

Each check names what to test, the steps sourced to a named Microsoft or standards page, and what a PASS versus a FAIL looks like. The sheet enforces one governance position throughout: AI prepares, humans decide, which is the feature that keeps a destructive action behind a human. An unrun check is a FAIL until proven otherwise.

Alongside it, one read-only script you can run in your own tenant today: it lists your Entra Agent IDs and flags any with no named, active sponsor, which is check 2 answered with evidence rather than with a screenshot.

7 of 8

Seven checks drawn from the full eight-control set, numbered the same way in the sheet, the script and this page. Oversharing (T6) and grounding (T8) are in the full kit, not here, and the rationale for the subset ships with the bundle.

T1 Prompt injection, and the ContentFiltered probe
T2 Distinct agent identity with a named accountable sponsor
T3 End-user versus maker credentials
T3 No unneeded write or delete scopes
T4 The destructive-action human approval gate
T5 DLP for Copilot
T7 Audit attribution
The governing rule

AI prepares, humans decide. A governed agent must never hold standing authorization for a consequential or irreversible action without a human in front of it.

Read-only, and what that actually means

Every Graph call is a GET. There is no write cmdlet anywhere in the bundle.

Not a commented-out write command waiting to be un-commented, either. The only file any script writes is a local findings CSV on your own machine, and only when you pass -CsvPath.

One honest exception, stated here rather than left for you to find
  • The first admin consent to the Microsoft Graph PowerShell client registers that client's service principal in Entra.
  • It also registers your delegated read-scope grant.
  • Both are created by your consent rather than by a script, and once for the tenant rather than once per run.
  • Both are reviewable and revocable under Enterprise applications.

Which is why the wording here is the scripts write nothing, and not the tidier claim that running them leaves no trace. The tidier claim would be false.

What the full kit adds

This sheet is seven checks. The full kit is all eight controls, four more read-only scripts, and the limits.

The comparison ships in this bundle rather than being left to a guess: whats-in-the-full-kit-v1.md lists exactly what Core and Team contain. The short version is below.

In the $69 Core kit, and not in this one
  • The full T1 to T8 verification kit, including oversharing (T6) and grounding (T8), with sourced steps, PASS, FAIL and a fix on every card.
  • Four read-only assessment scripts: agent inventory, least privilege, DLP presence, and the audit-signal query pack.
  • The mailbox-wipe board one-pager, the licensing dependency matrix, the risk acceptance form, and a checksum manifest.
  • And in Team, the deep-research dossier, the filterable crosswalk workbook, the citation workbook, redacted audit-log samples, the incident runbook, and an internal-use org licence with no headcount limit.

Run this sheet first. If it earns its afternoon, the Core verification kit is the next step, and the Team tier is the one a whole function shares.

The August tenant run

Named here with its limit in the same breath, because it is the only real measurement behind this bundle.

The author ran the read-only sample script in this bundle end to end against a purpose-built Microsoft 365 E5 tenant, with ground truth recorded out of band, from a separate administrator session, before each run. One tenant, one operator, and that operator is the author, 15 to 18 August 2026. That run found defects in the script and they were fixed before release. That is the whole of the claim: a process claim about how this was built, never an assurance claim about your agents, and nobody outside has looked at any of it.

One script

The measurement covers the sample script in this bundle. The Lite checklist itself was not the subject of those measurements, and no amount of tenant work makes a printable sheet a tested artifact.

Samples

The per-script sample outputs stay constructed illustrations rather than captures, on a fictional tenant with no real data. What they do reproduce exactly is the verdicts, the flag wording and the column layout.

Two dates

They do not merge. Documentary claims are current as of July 2026. Only the tenant measurements are 15 to 18 August 2026, and they are dated in place wherever they appear.

The item-by-item bound list, including everything the run never touched, is in What this kit does not prove, which ships free in this bundle so you can read it before paying anything.

What's inside

Fifteen files. Eight components. Every document as a typeset PDF and its Markdown source.

The PDF is for printing and circulating. The Markdown is for pasting into your own audit materials. The scripts ship as scripts.

01

The Lite verification checklist, seven checksPDF + MD

Seven headline checks, each with PASS, FAIL and N/A columns and a date field, plus an audit header you fill once per run. The seven are a deliberate subset of the full T1 to T8 controls: the ContentFiltered prompt-injection probe (T1), distinct identity with a named accountable sponsor (T2), end-user versus maker credentials and no unneeded write or delete scopes (T3, shown as two checks), the destructive-action human gate (T4), DLP for Copilot (T5), and audit attribution (T7). Oversharing (T6) and grounding (T8) are not here. They are in the full kit.

02

The printable audit sheetPDF + MD

The same seven checks stripped to a one-agent, one-auditor, one-afternoon worksheet with a fill-once header and PASS, FAIL and N/A rows, so you can put it on a clipboard and record against it instead of reading prose.

03

One read-only sample assessment scriptPowerShell

sample-list-agent-identities-v1.ps1, Microsoft Graph PowerShell that enumerates your Entra Agent IDs and flags any with no named, active sponsor, which is check 2 of the sheet. It inspects posture and makes no configuration or data changes, so you can prove the concept in your own tenant before deciding on the full kit. It states its blind spots up front: Agent Builder agents carry no Agent ID, draft agents have no directory object at all because publishing is what mints the Agent ID, and legacy app registrations cannot always be classified reliably. Treat the count as best-effort, not a guaranteed census.

04

What access each check needs, before you startPDF + MD

The required-reader-roles matrix: the per-script directory roles and Graph read scopes, the one-time admin consent that stops most first runs, and the one place Microsoft's own documentation contradicts itself. It is in this free bundle rather than behind the paywall so you can settle the access question inside your own org before you spend anything.

05

What every script printsPDF + MD

Per-script sample output for all five assessment scripts, including the four that only ship in the paid bundles, so you can see the shape of a finding before you decide whether it is worth paying for. These are constructed illustrations rather than captures of a live tenant, on a fictional tenant with no real data, and they are labelled as such, with the verdicts, flag wording and column layout reproduced exactly as the scripts emit them.

06

Why these seven checksPDF + MD

The design rationale behind the subset, and the residual risk each check leaves standing even when it passes. Read it if you have to defend the choice of checks to someone who did not pick them.

07

What the full kit addsPDF + MD

A plain list of what Core and Team contain, so the upgrade decision is a comparison rather than a guess. It is in the bundle because an honest comparison is cheaper for both of us than a surprise after purchase.

08

What this kit does not provePDF + MD

The limits page, and the one to read before you cite a passed check as evidence to anyone. Every boundary a full green sheet does not establish, including prompt-injection immunity, licensing entitlement, and the bounds of the author's own live-tenant testing, item by item. It ships free on purpose: if the honest limits change your mind, that is the right outcome before you pay anything.

Vendor-neutral, and sourced

Every claim traces to a page you can open yourself.

Microsoft Learn MSRC NVD, for CVE-2025-32711 OWASP LLM Top 10 2025 MITRE ATLAS v5.4.0 NIST AI 600-1

This is a briefing from an independent practitioner. Microsoft is cited as a source, never cheered, and each control is described with its residual risk named. The EchoLeak CVE is cited to its NVD record, with the 9.3 Critical score attributed to Microsoft as the CNA and NVD's own 7.5 base score named alongside it.

Get the checklist

The front door, and it costs nothing.

Name your price, including zero. You get updates to the current edition free, and the Lite checklist carries its own quarterly cadence with the next review due October 2026.

Lite This page
$0+
The front door. Fifteen files.
  • The seven-check checklist and the printable audit sheet
  • One read-only assessment script you can run today
  • The reader-roles matrix and the per-script sample outputs
  • The limits page, and why these seven checks
Download the checklist · free
Core
$69
The full audit instrument. Twenty-two files.
  • All eight controls, T1 to T8, on per-control test cards
  • Four read-only assessment scripts, plus this free sample
  • The mailbox-wipe board one-pager
  • Licensing matrix, risk acceptance form, checksum manifest
See the Core kit · $69

Licensed, not sold. Your own use inside your organization, and full terms are at kesslernity.com/license. Ready for all eight controls? The Core verification kit is on this same store.

Who it is for

The person who has to answer for it.

A CISO or risk owner who needs a defensible account. A security architect or M365 admin who has to gather the evidence. An internal audit or GRC lead who needs the check written down, dated, and signed off, including the checks that could not be run.

Who it is not for

Anyone who wants software, or wants to break something.

There is no dashboard here, no connector, no automated pipeline. The scripts are read-only assessment tools, not remediation runbooks. It is M365 Copilot specific, not a general agent stack. It is not legal, compliance or regulatory sign-off, and it is not a live assessment of your tenant. And it is emphatically not for anyone hunting a script that performs, simulates or enables a destructive action, because refusing to ship one is the entire point.

The rest of the ladder

Also on the shelf.

Questions

Before you download.

What exactly do I get for nothing?
Fifteen files. The seven-check Lite checklist and the printable audit sheet, one read-only PowerShell sample script, and five short reference documents: why these seven checks, what the full kit adds, what this kit does not prove, the required-reader-roles matrix, and the per-script sample outputs. Every document ships as both a typeset PDF and its Markdown source, so you can print it or edit it. No login, no drip course, no video.
Will the script run in my setup, and what access does it need?
It is Microsoft Graph PowerShell and runs delegated, an interactive sign-in, using the read scopes AgentIdentity.Read.All and Directory.Read.All. Both require a one-time admin consent in your tenant, and that is the part to arrange first: it is what stops most first runs, and no tenant setting substitutes for it. Beyond consent a plain member account needs no directory role, though a guest account cannot read agent identities at all. The scopes are read-only and the script never requests a write scope or an admin write role. Whoever grants the consent needs a role that can, which a reader role cannot. The required-reader-roles matrix, which ships in this free bundle rather than behind the paywall, spells out both gates and the one place Microsoft's own documentation contradicts itself.
How long does it take?
An afternoon for one agent. Because LLM output is not deterministic, the behavioral checks get run several times, and one follow-through out of five is a FAIL, not a fluke.
Is this just AI-generated fluff?
The prose was drafted with AI agents inside a gated factory pipeline, and it is more honest to tell you than to pretend otherwise. It then passed a deterministic slop scanner and a build checker, and it was fact-checked against authoritative sources. Every citation traces to a named authoritative source: Microsoft Learn, MSRC, NVD, OWASP, MITRE or NIST. The EchoLeak CVE is cited to its NVD record, with the 9.3 Critical score attributed to Microsoft as the CNA and NVD's own 7.5 base score named alongside it, and the threat-to-standards mappings are interpretive crosswalks, not primary facts. The sample script was checked read-only against the Microsoft Graph documentation.
What is the catch on a free product?
The catch is your email and an honest upsell. This Lite sheet is a deliberate subset of the full kit, built new for this tier rather than a teaser paragraph, and the limits page ships with it so you can read what none of it proves before you pay anything. If it proves useful, the Core kit covers all eight controls with four more read-only scripts.
Disclaimer

This product is an orientation and verification-methodology aid. It is not security, legal, compliance, or regulatory advice. It is not a guarantee of any security outcome. The read-only sample script is run at the buyer's own discretion under a least-privileged reader role. Microsoft changes product behavior and control defaults over time, and standards versions move too, so claims are stamped as of July 2026 and each cited primary source should be re-verified before you rely on it. Nothing here authorizes an AI agent to hold standing authorization for a consequential or irreversible action; a human decision must sit before any such action.

Licensed, not sold

Full License & Terms apply (ref KESS-LIC-2026-001). By purchasing you agree to the version in force on your purchase date.

Kesslernity is an independent publisher. This product is independent analysis and is not affiliated with or sponsored by Microsoft. Microsoft 365 and Copilot are trademarks of the Microsoft group of companies. It is practitioner guidance, not professional, legal, or financial advice.

Questions before you buy, or support after? Contact mathieu@kesslernity.com. Terms of Service · Privacy Policy

Checked against Microsoft's own pages before publication. Since August 2026, three rival labs' models try to break every listing before I decide what ships. Misses, dated, with fixes: kesslernity.com/what-broke