The runtime protection described here is available today through Microsoft Defender’s integration with Agent 365. It evaluates tool invocations (and tool responses) for Work IQ MCP servers and custom MCP servers that have been onboarded to Agent 365, applying policy before the action completes.
Before configuring protection rules, complete the enablement steps so that telemetry, behaviors, and enforcement are available:
Onboard to Microsoft Agent 365.
Enable security for AI agents in the Microsoft Defender portal, including the Microsoft 365 app connector. This is required for investigation, Advanced Hunting, and full visibility into agent activity.
Confirm that relevant agents and MCP tooling servers are registered and visible in the Agent 365 control plane.
Full enablement guidance is available here:
Enable security for AI agents using Microsoft Defender
Once security for AI agents is enabled, real-time protection is managed in the Microsoft Defender portal:
Settings → Security for AI → Policies & rules → Real-time protection
Two rule types are available:
Default rule — Audits matching activity across agents. The action is allowed to complete, but the event is recorded as a behavior. This provides visibility and a baseline before moving to enforcement.
Custom rules — Block matching actions before they execute. You can scope rules to all agents or specific agents, exclude individual agents, and select the detection types (threat scenarios) the rule should cover. Blocked events are also recorded as behaviors.
Recommended rollout path:
Leave the default audit rule enabled so teams can observe detections and refine understanding of agent behavior.
Create targeted custom rules for high-confidence threats (unsafe tool invocations, secret leakage through tool calls, communication with untrusted domains, malicious content propagation, and related scenarios).
Scope blocking rules carefully and expand as confidence grows.
Audited and blocked actions appear as behaviors that can be queried in Advanced Hunting (including the BehaviorInfo table). These behaviors support custom detections, hunting queries, and automation without requiring a full incident.
Complete configuration steps, rule creation details, and management guidance are documented here:
Protect AI agents in real time using Microsoft Defender
This protection applies to Agent 365 tool invocations that route through Work IQ MCP or customer MCP tools registered with Agent 365. Agents that do not integrate with Work IQ MCP or rely on unsupported tools fall outside this coverage path.
Local AI agents running on endpoints use a separate runtime protection capability in Microsoft Defender for Endpoint (agent-native event inspection and/or network inspection). That configuration is managed via PowerShell preferences or Intune scripts and is documented separately.
Runtime protection closes the gap between detection and prevention at the moment of action. Combined with the observability of the full agent loop, it gives security teams both the ability to stop high-risk tool invocations and the telemetry needed to understand, hunt, and continuously harden agent behavior.
Here are practical Advanced Hunting queries focused on the agent behaviors and runtime protection events described in the post.
These are the events recorded when Defender evaluates tool invocations against your real-time protection rules.
BehaviorInfo
| where Timestamp > ago(7d)
| where ServiceSource has_any ("Defender", "Security for AI", "Agent")
or Title has_any ("agent", "tool", "MCP", "prompt injection", "exfiltration", "secret")
or Description has_any ("tool invocation", "agent", "MCP", "Work IQ")
| project Timestamp, BehaviorId, Title, Description, ActionType, Categories, AttackTechniques,
AccountUpn, StartTime, EndTime, AdditionalFields
| order by Timestamp descJoins the behavior with the associated agents, users, tools, and resources.
BehaviorInfo
| where Timestamp > ago(7d)
| join kind=inner BehaviorEntities on BehaviorId
| project Timestamp, BehaviorId, Title, Description, ActionType, Categories, AttackTechniques,
EntityType, EntityRole, AccountUpn, AccountObjectId,
Application, RemoteIP, AdditionalFields
| order by Timestamp descPrimary source for tool call activity through Work IQ MCP and custom MCP servers.
CloudAppEvents
| where Timestamp > ago(7d)
| where ActionType in (
"InvokeAgent",
"InferenceCall",
"ExecuteToolBySDK",
"ExecuteToolByGateway",
"ExecuteToolByMCPServer"
)
| extend Raw = parse_json(RawEventData)
| project Timestamp, ActionType, Application, AccountDisplayName, AccountObjectId,
IPAddress, CountryCode,
AgentId = tostring(Raw.PlatformAgentId),
TargetAgentId = tostring(Raw.PlatformTargetAgentId),
ToolName = tostring(Raw["gen_ai.tool.name"]),
ToolParameters = tostring(Raw["gen_ai.tool.parameters"]),
RawEventData
| order by Timestamp descUseful for understanding which tool calls were audited or blocked.
let ToolCalls =
CloudAppEvents
| where Timestamp > ago(7d)
| where ActionType in ("ExecuteToolByGateway", "ExecuteToolByMCPServer", "ExecuteToolBySDK")
| extend Raw = parse_json(RawEventData)
| project ToolTimestamp = Timestamp,
ActionType,
AccountObjectId,
AgentId = tostring(Raw.PlatformAgentId),
ToolName = tostring(Raw["gen_ai.tool.name"]);
BehaviorInfo
| where Timestamp > ago(7d)
| join kind=inner BehaviorEntities on BehaviorId
| where EntityType has_any ("Agent", "Tool", "User") or AccountObjectId != ""
| join kind=leftouter ToolCalls on $left.AccountObjectId == $right.AccountObjectId
| project Timestamp, BehaviorId, Title, Description, ActionType, Categories,
EntityType, AccountUpn, ToolName, ToolTimestamp
| order by Timestamp descAgentsInfo
| where Timestamp > ago(1d)
| summarize arg_max(Timestamp, *) by AgentId
| where LifecycleStatus !in~ ("Deleted", "Uninstalled")
| project Timestamp, AgentId, AgentName, Platform, EntraAgentId,
PublishedStatus, LifecycleStatus, Model,
McpServers, DeclaredTools, Owners, Instructions
| order by AgentName ascPotential secret leakage or data exfiltration via tools
CloudAppEvents
| where Timestamp > ago(24h)
| where ActionType in ("ExecuteToolByGateway", "ExecuteToolByMCPServer")
| extend Raw = parse_json(RawEventData)
| where tostring(Raw) has_any ("password", "secret", "token", "key", "credential", "api_key", "connectionstring")
| project Timestamp, ActionType, AccountDisplayName,
ToolName = tostring(Raw["gen_ai.tool.name"]),
Parameters = tostring(Raw["gen_ai.tool.parameters"]),
RawEventDataBlocked or audited high-risk behaviors in the last 24 hours
BehaviorInfo
| where Timestamp > ago(24h)
| where ActionType has_any ("Block", "Audit")
or Title has_any ("block", "audit", "prevented")
| join kind=inner BehaviorEntities on BehaviorId
| project Timestamp, BehaviorId, Title, Description, ActionType,
AccountUpn, EntityType, Application
| order by Timestamp descStart with the BehaviorInfo + BehaviorEntities join when investigating runtime protection activity.
Use CloudAppEvents with the specific ActionTypes for the full agent loop visibility (prompts → tool calls → responses).
Filter on AdditionalFields or parse RawEventData more deeply once you see the shape of your tenant’s data.
These queries can be turned into custom detection rules once you tune them to your environment.
These queries target the runtime protection and observability data most relevant to Work IQ MCP tool invocations (the Microsoft 365-grounded tooling servers protected by Defender in Agent 365).
CloudAppEvents
| where Timestamp > ago(7d)
| where ActionType in (
"ExecuteToolByGateway",
"ExecuteToolByMCPServer",
"ExecuteToolBySDK"
)
| extend Raw = parse_json(RawEventData)
| extend ToolName = tostring(Raw["gen_ai.tool.name"]),
Operation = tostring(Raw["gen_ai.operation.name"]),
ResourcePath = tostring(Raw["gen_ai.tool.parameters"]),
AgentId = tostring(coalesce(Raw.PlatformAgentId, Raw.PlatformTargetAgentId))
| where ToolName has_any ("fetch", "create_entity", "update_entity", "delete_entity",
"do_action", "call_function", "ask", "list_agents",
"get_schema", "search_paths")
or ResourcePath has_any ("/me/", "/users/", "messages", "events", "chats", "drive", "sites")
or tostring(Raw) has_any ("Work IQ", "WorkIQ", "mcp_", "workiq")
| project Timestamp, ActionType, AccountDisplayName, AccountObjectId, IPAddress,
ToolName, Operation, ResourcePath, AgentId, Application, RawEventData
| order by Timestamp descBehaviorInfo
| where Timestamp > ago(7d)
| join kind=inner BehaviorEntities on BehaviorId
| where Title has_any ("tool", "MCP", "agent", "Work IQ", "exfiltration", "secret", "injection")
or Description has_any ("tool invocation", "MCP", "Work IQ", "gateway")
or tostring(AdditionalFields) has_any ("Work IQ", "MCP", "tool")
| project Timestamp, BehaviorId, Title, Description, ActionType, Categories,
AttackTechniques, AccountUpn, EntityType, EntityRole, Application
| order by Timestamp desclet WorkIQTools =
CloudAppEvents
| where Timestamp > ago(7d)
| where ActionType in ("ExecuteToolByGateway", "ExecuteToolByMCPServer")
| extend Raw = parse_json(RawEventData)
| extend ToolName = tostring(Raw["gen_ai.tool.name"]),
AgentId = tostring(coalesce(Raw.PlatformAgentId, Raw.PlatformTargetAgentId)),
ResourcePath = tostring(Raw["gen_ai.tool.parameters"])
| where ToolName has_any ("fetch", "do_action", "create_entity", "update_entity",
"delete_entity", "ask", "call_function")
or ResourcePath has_any ("/me/messages", "/me/events", "/me/chats", "/me/drive", "sendMail")
| project ToolTime = Timestamp, AccountObjectId, ToolName, ResourcePath, AgentId, ActionType;
BehaviorInfo
| where Timestamp > ago(7d)
| join kind=inner BehaviorEntities on BehaviorId
| join kind=leftouter WorkIQTools on $left.AccountObjectId == $right.AccountObjectId
| project Timestamp, BehaviorId, Title, Description, ActionType,
AccountUpn, ToolName, ResourcePath, AgentId, EntityType
| order by Timestamp descPotential data exfiltration or sensitive actions via Work IQ tools
CloudAppEvents
| where Timestamp > ago(24h)
| where ActionType in ("ExecuteToolByGateway", "ExecuteToolByMCPServer")
| extend Raw = parse_json(RawEventData)
| extend ToolName = tostring(Raw["gen_ai.tool.name"]),
Params = tostring(Raw["gen_ai.tool.parameters"])
| where ToolName in ("do_action", "create_entity", "update_entity", "fetch")
| where Params has_any ("sendMail", "messages", "mail", "forward", "reply",
"drive", "sites", "files", "download", "export")
or Params has_any ("password", "secret", "token", "credential", "key", "connection")
| project Timestamp, AccountDisplayName, ToolName, Params, IPAddress, RawEventData
| order by Timestamp descRecent blocked/audited Work IQ-related behaviors
BehaviorInfo
| where Timestamp > ago(24h)
| where ActionType has_any ("Block", "Audit")
| join kind=inner BehaviorEntities on BehaviorId
| where Title has_any ("tool", "MCP", "agent")
or Description has_any ("Work IQ", "tool invocation", "MCP server")
| project Timestamp, BehaviorId, Title, Description, ActionType, AccountUpn, EntityType
| order by Timestamp descAgentsInfo
| where Timestamp > ago(1d)
| summarize arg_max(Timestamp, *) by AgentId
| where LifecycleStatus !in~ ("Deleted", "Uninstalled")
| where tostring(McpServers) has_any ("Work IQ", "WorkIQ", "mcp_", "Calendar", "Mail", "Teams")
or tostring(DeclaredTools) has_any ("fetch", "do_action", "ask", "Work IQ")
| project AgentId, AgentName, Platform, EntraAgentId, PublishedStatus,
McpServers, DeclaredTools, Owners
| order by AgentName ascNotes for Work IQ MCP hunting
Work IQ MCP primarily surfaces through the gateway / MCP server ActionTypes in CloudAppEvents.
The 10 core tools (fetch, do_action, create_entity, etc.) plus resource paths under /me/ or Graph-style paths are strong indicators.
Runtime protection decisions (audit vs block) land in BehaviorInfo / BehaviorEntities.
Start with query #1 and #3. They give the best visibility into the protected tool invocations the blog post focuses on.
Comments
Nothing yet. Say the first thing.
Sign in to join the conversation.