Enabling Real-Time Protection for Copilot Studio Agents in Defender
Short answer
B Connect the Microsoft 365 app connector in the Microsoft Defender portal to enable real-time protection for the Copilot Studio agent.
Question
A Microsoft Power Platform administrator configures external threat detection for the agent by using a Microsoft Entra application.
You need to ensure that real-time protection is enabled during agent runtime.
What should you do in the Microsoft Defender portal?
Key Takeaways
Real-time protection for AI agents relies on telemetry ingestion via the Microsoft 365 app connector, not just session policies or Entra trust settings.
Learn how to enable real-time protection for Microsoft Copilot Studio agents by connecting the Microsoft 365 app connector in the Microsoft Defender portal.
Common mistake: Choosing session policies (A) because they offer real-time blocking, but failing to realize that the Microsoft 365 app connector is the mandatory foundation for agent telemetry and protection.
Expert Analysis
The question requires enabling real-time protection for a Microsoft Copilot Studio agent during runtime. The setup involves an external threat detection configuration using a Microsoft Entra application.
The most attractive but wrong answer is A. Configure Microsoft Defender for Cloud Apps session policies. This option sounds correct because session policies are the primary mechanism in Defender for Cloud Apps (MDA) to enforce real-time controls, such as blocking or restricting access based on risk signals. However, session policies apply to user sessions and app usage within the MDA ecosystem. They do not provide the underlying telemetry ingestion required for an AI agent's specific runtime activities unless the agent is explicitly acting as a user through a supported connector, which is not the standard architectural pattern for "agent runtime" protection in this context. The comment suggesting A focuses on the proxy/blocking aspect, which is true for session policies, but misses the prerequisite data flow requirement.
The correct approach is B. Connect the Microsoft 365 app connector. According to Microsoft documentation for securing Copilot Studio agents with Defender, the Microsoft 365 app connector is the critical component that ingests telemetry from the Power Platform and Microsoft 365 apps. This connector enables the security features, including real-time protection, by allowing Defender to monitor and act upon the agent's interactions in real time. Without this connector connected in the Defender portal, there is no data stream for real-time analysis, regardless of other configurations like Entra trust setups.
Option C (Global Secure Access) is unrelated to agent-specific runtime protection. Option D (Sentinel/Purview) handles log collection and auditing, not real-time active protection.
Exam Strategy
When configuring Defender for AI agents, always verify the telemetry source first. Real-time protection depends on data ingestion; identify the correct app connector (e.g., Microsoft 365 for Power Platform agents) before applying control policies. Distinguish between passive monitoring (logs) and active protection (connectors + policies).
Frequently Asked Questions
Why isn't Global Secure Access used for Copilot Studio agents?
Does the Entra app registration alone enable real-time protection?
Community Votes
75% of anonymous learners picked answer B. Votes are pick records left by other test-takers — they are not the verified answer.
Discussion 4 contributions
Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.
From public community threads 4
-
Eltooth 👍 2 Answered BB. Connect the Microsoft 365 app connector. For real-time runtime threat protection to properly function for Microsoft Copilot Studio agents, Microsoft Defender needs a telemetry link to receive, parse, and process agent activity logs.According to the official Microsoft documentation, you must ensure that the Microsoft 365 app connector is connected within the Microsoft Defender portal. If it is disconnected, Defender will be unable to ingest the necessary observability data (Agent 365 logs), meaning related real-time alerts and incidents will fail to appear in your Defender dashboard. https://learn.microsoft.com/en-us/defender-xdr/security-for-ai/ai-agent-real-time-protection#prerequisites
-
Matthiasdd 👍 1 Answered AThe Entra app registered by the Power Platform admin just sets up the trust channel between the agent and Defender. It's the session policy on the Defender for Cloud Apps side that does the actual work: it puts Defender in the middle of the agent's traffic as a proxy and blocks risky actions before they execute. that's what "real-time protection" during runtime means. The other options (M365 connector, Global Secure Access, Purview/Sentinel) are about visibility, network routing, or after-the-fact auditing, not live blocking.
-
rameshms85 👍 1 Answered BTo enable telemetry ingestion, alerting, and real-time protection features for Microsoft Copilot Studio agents within the Microsoft Defender portal, you must connect the Microsoft 365 app connector (under Security for AI settings).
-
3lVhylla 👍 1 Answered Bis basically the same (43) question... XDR enable, with real-time protection enabled
Reader comments & corrections
No reader corrections yet — spotted an error or have a note? Share it below.
Related Analysis
Practice All SC-500 Questions
Access 100 questions with complete answers and detailed explanations.
View Full SC-500 Practice Test →