01see it for yourself
The blu3print is a Microsoft 365 tenant we run as a reference. Hardened the way we’d harden yours, with agents working inside it.
02what it is
real, not mocked · live, not staged · nothing hidden
what you’re looking at
Most security stories are told in slides. This one is a login. Open any object and you’re reading the live configuration, not a screenshot of it.
03the intersection
Anyone can spin up an agent. Few keep them scoped: permissions pile up, no one signs off. AI isn’t a second platform to secure; it’s a new dimension through the estate you already control.
the AI layera new dimension
Copilot · Copilot Studio · Foundry · Agent 365
Entra
Conditional Access, PIM, named agent identities
Intune
compliance baselines, configuration profiles
Defender
Defender & Sentinel, detection, posture, alerts
Purview
sensitivity labels, DLP policies
every object opens read-only in Microsoft 365
04THE NAVIGATOR
A read-only navigator over the same tenant. Ask how something’s configured and it answers from the estate, then opens the exact object so you can check it.
agent-config-drift: checks the tenant for drift every 6h, matches each change to its approval and the PIM activation behind it, and flags anything no one signed off.
read-only: it sees every change and makes none. It writes to three places only: a SharePoint report, one mailbox, and a Sentinel alert when a change has no approval.
runs as itself in Entra Agent ID · autonomous · named sponsor · directory reads least-privilege · every call logged
you could ask
illustrative. The live navigator runs read-only on an invited tenant
the ledger — every agent, proposed to retired
+ added agent-config-drift: flags any tenant change with no approval behind it.
~ re-scoped agent-config-drift: dropped Sites.ReadWrite.All; write now scoped to one site (Sites.Selected).
– retired agent-export-legacy: replaced by native UTCM monitoring; no run in 31 days.
05take a look
Open by invitation while we build it out. Leave an email and we’ll set up a read-only login so you can walk the tenant yourself.
We’d rather show you than tell you.
