AI agents and the data leak problem
The rise of artificial intelligence agents in Microsoft 365 and Azure environments introduces an often underestimated attack surface: data leaks and exfiltration. Unlike traditional applications, AI agents do not merely execute static instructions — they access, reason, and transmit information autonomously, sometimes from highly confidential sources.
In this context, IT and security teams must approach these risks not as hypothetical scenarios, but as real vectors of compromise, capable of engaging the organization's regulatory responsibility (GDPR, HIPAA, NIS2).
Attention
A data leak via an AI agent does not necessarily imply malicious intent. It can result from a sequence of insufficiently controlled legitimate operations, making it all the more difficult to detect.
The exfiltration chain: four critical stages
Understanding how a leak occurs is the first condition for preventing it. The exfiltration cycle via an AI agent generally follows four distinct phases:
1. Access to sensitive data
The agent queries file systems, knowledge bases, internal APIs, or document repositories containing personal, financial, or strategic data. At this stage, the risk surface is directly correlated with the permissions granted to the agent.
2. Processing and response generation
The agent produces outputs — texts, summaries, reports — by leveraging the data it has access to. If the context injected into the prompt contains sensitive information, it may be integrated into the generated response.
3. Uncontrolled exposure
Sensitive information appears in responses transmitted to users, in debug logs, or in outgoing communications. This step is often invisible to governance teams if no filtering policy is in place.
4. Effective exfiltration
Data reaches unauthorized recipients or systems: a user without legitimate access rights, a third-party service, an external email box, or even an uncontrolled web endpoint.
Good to know
This cycle applies equally to conversational agents based on Microsoft Copilot Studio and to automated workflows built with Azure AI Foundry or Semantic Kernel. Governance must cover all of these surfaces.
The five exfiltration vectors to monitor
The most frequently observed exfiltration vectors in AI agent deployments are as follows:
- Excessive sharing in responses: the agent returns more information than the user's request justifies. This phenomenon, sometimes called over-sharing, is particularly common in agents connected to RAG (Retrieval-Augmented Generation) systems.
- Debug logs and traces: application logs can store fragments of prompts or responses containing sensitive data. Application Insights traces or Azure Monitor logs deserve particular attention.
- Calls to external APIs or web services: when an agent has tools allowing it to send HTTP requests, data can be transmitted to third parties without adequate compliance control.
- Overly broad queries on knowledge bases: RAG systems can return document chunks containing information that is not relevant to the query, but nonetheless sensitive.
- Automated emails and notifications: agents integrated with Microsoft Power Automate or Logic Apps can trigger email sends to unintended recipients, constituting a classic leak channel.
Data at risk: what to prioritize protecting
Not all data presents the same level of criticality. Here are the categories that should receive enhanced protection in any AI agent deployment:
- Personal data and PII (names, addresses, identification numbers)
- Financial information (balance sheets, billing data, card numbers)
- Health records subject to specific regulations (HIPAA, HDS)
- Confidential business documents (contracts, calls for proposals, strategies)
- Source code and intellectual property
- Secrets and API keys — a particularly critical category: their disclosure can enable an attacker to pivot to the entire infrastructure
Important
Secrets and API keys represent the highest risk vector. An exposed Azure OpenAI key or third-party API key in an agent response can compromise an entire cloud environment in minutes. Systematically use Azure Key Vault for secret management and never inject them directly into prompts.
Implementation: examples of technical controls
Here are some examples of technical controls that engineering teams can implement to reduce the risk of exfiltration.
Output filtering with Azure Content Safety
Azure AI Content Safety allows you to analyze generated responses before they are transmitted to the user or downstream system.
1from azure.ai.contentsafety import ContentSafetyClient2from azure.core.credentials import AzureKeyCredential3from azure.ai.contentsafety.models import AnalyzeTextOptions4 5client = ContentSafetyClient(6 endpoint="https://<your-resource>.cognitiveservices.azure.com/",7 credential=AzureKeyCredential("<your-key>")8)9 10request = AnalyzeTextOptions(text=agent_response)11response = client.analyze_text(request)12 13# Check risk scores before transmitting the response14for item in response.categories_analysis:15 if item.severity >= 4:16 raise ValueError(f"Sensitive content detected in category: {item.category}")PII detection with Azure AI Language
Azure AI Language offers named entity recognition and PII detection services directly integrable into an agent pipeline.
1from azure.ai.textanalytics import TextAnalyticsClient2from azure.core.credentials import AzureKeyCredential3 4client = TextAnalyticsClient(5 endpoint="https://<your-resource>.cognitiveservices.azure.com/",6 credential=AzureKeyCredential("<your-key>")7)8 9documents = [agent_response]10result = client.recognize_pii_entities(documents, language="en")11 12for doc in result:13 if not doc.is_error:14 for entity in doc.entities:15 print(f"PII detected: {entity.text} | Category: {entity.category}")16 # Replace or mask the entity in the final responseSecret management with Azure Key Vault
1from azure.identity import DefaultAzureCredential2from azure.keyvault.secrets import SecretClient3 4credential = DefaultAzureCredential()5client = SecretClient(6 vault_url="https://<your-keyvault>.vault.azure.net/",7 credential=credential8)9 10# Retrieve a secret without ever exposing it in source code11api_key = client.get_secret("openai-api-key").valueBest practices for AI agent governance
Beyond technical controls, AI agent governance relies on fundamental organizational principles:
Apply the principle of least privilege
Each agent must have only the permissions strictly necessary for executing its tasks. In Microsoft 365, this implies configuring precise OAuth scopes and avoiding Application permissions in favor of Delegated permissions when possible. Use Microsoft Entra ID to manage agent identities and regularly audit their access rights.
Implement tailored DLP policies
Microsoft Purview Data Loss Prevention policies must be extended to new channels created by agents: Power Automate connectors, webhooks, Copilot Studio responses. Configure detection rules for PII and financial information across all these flows.
Audit and monitor data flows
Enable comprehensive logging of your agents' interactions via Azure Monitor and Microsoft Sentinel. Create specific alert rules to detect unusual data volumes or calls to unexpected destinations.
1// Example KQL query to detect unusual outbound API calls from an agent2AzureDiagnostics3| where ResourceType == "OPENAI"4| where OperationName == "ChatCompletions_Create"5| where isnotempty(tostring(requestBody_s))6| extend tokenCount = toint(parse_json(responseBody_s).usage.total_tokens)7| where tokenCount > 40008| summarize count() by bin(TimeGenerated, 1h), CallerIPAddress9| where count_ > 50Purge sensitive data before prompt injection
Implement a preprocessing layer that cleans data before it is injected into the agent's context. This step, often called prompt sanitization, is particularly critical for RAG systems.
Review and restrict third-party integrations
Inventory all external connectors and APIs your agents have access to. For each integration, assess the necessity of the connection, the data likely to be transmitted, and the third party's compliance guarantees. Use Azure API Management to centralize and control these flows.
Comparison of available security controls
| Control | Microsoft Service | Protection Level | Implementation Complexity |
|---|---|---|---|
| PII Detection | Azure AI Language | High | Low |
| Content Filtering | Azure AI Content Safety | High | Low |
| Secret Management | Azure Key Vault | Critical | Low |
| DLP Policies | Microsoft Purview | High | Medium |
| SIEM and Detection | Microsoft Sentinel | Very High | High |
| Access Control | Microsoft Entra ID | Critical | Medium |
Conclusion: data at the heart of agent security
AI agents represent a paradigm shift in how information systems interact with data. Their autonomy, which constitutes their primary added value, is also their primary risk surface. Protecting data in this context goes beyond securing a network perimeter — it requires rethinking governance, permissions, flow filtering, and real-time monitoring.
Tip
Integrate AI agent security reviews into your development cycle starting from the design phase (security by design). A well-designed architecture from the start costs significantly less to secure than an agent patched in production.
To deepen these topics, consult the official Microsoft resources:
