{"id":5940,"date":"2025-09-08T09:00:00","date_gmt":"2025-09-08T16:00:00","guid":{"rendered":""},"modified":"2026-04-08T10:39:24","modified_gmt":"2026-04-08T17:39:24","slug":"strengthen-agent-security-with-near-real-time-protection-in-microsoft-copilot-studio","status":"publish","type":"copilot","link":"https:\/\/www.microsoft.com\/en-us\/microsoft-copilot\/blog\/copilot-studio\/strengthen-agent-security-with-near-real-time-protection-in-microsoft-copilot-studio\/","title":{"rendered":"Strengthen agent security with real-time protection in Microsoft Copilot Studio"},"content":{"rendered":"\n

As AI agents become more embedded in critical business workflows, the need for robust security grows. Microsoft Copilot Studio already includes strong built-in protections against agent manipulation, but for organizations that need deeper oversight and proactive, responsive control, a new feature is now in public preview: Advanced real-time protection during agent runtime <\/strong>for enhanced security.<\/p>\n\n\n\n

This capability enhances security for AI agents by enabling organizations to connect their own monitoring system such as\u00a0Microsoft Defender<\/a> as well as security platforms by other providers, or their own custom-built tools. These integrations allow for real-time evaluation and control of agent behavior during runtime.<\/p>\n\n\n\n

When connected, the external systems become part of the agent\u2019s decision-making process. They can block unsafe actions, even if the agent plans to execute them. For example, if the external system determines that the agent is planning to send an email that is oversharing information, it can block the email from being sent.<\/p>\n\n\n\n

Admins can apply these protections across multiple agents and environments using the Power Platform Admin Center – no code required.<\/p>\n\n\n

\"A<\/figure>\n\n\n\n

Copilot Studio agents: secure by default<\/h2>\n\n\n\n

AI agents face unique threats. One major risk is injection of prompts to the agent from an external source (also known as cross prompt injection attacks, or XPIA), where malicious prompts trick agents into leaking data or misusing tools. Copilot Studio includes default protections against both XPIA and user prompt injection attacks (UPIA). These defenses block suspicious prompts in real time, reducing the risk of data loss or unauthorized actions.<\/p>\n\n\n\n

However, for organizations with advanced security needs, built-in protections may not be enough. That\u2019s where\u00a0the real-time protection comes in with an additional layer of defense.<\/p>\n\n\n\n

Real-time protection in action<\/h2>\n\n\n\n

With advanced runtime protection, Copilot Studio calls the connected security system during the agent\u2019s runtime. The system reviews the agent\u2019s planned actions and decides whether to approve or block them. If it detects a threat, it stops the agent immediately and notifies the user. If the action is safe, the agent continues without delay or disruption.<\/p>\n\n\n\n

This setup gives organizations stronger control over agent behavior while preserving a smooth user experience. It supports a \u201cbring your own protection\u201d model, allowing integration with:<\/p>\n\n\n\n