AI agents can now reach your Microsoft 365 data.Someone has to answer for each one.
When your board, an auditor or a customer's security review looks at AI, they ask three things. Which AI agents exist in your Microsoft 365? What can each one reach? Who is accountable for it? CYBERWHITE gives you the answer as evidence, mapped to the standards your reviewers already use.
One scan reads Microsoft Entra ID and builds your AI agent register. 48 governance controls, mapped to NIST AI RMF, NIST AI 600-1, the OWASP Top 10 for Agentic Applications and Australia's Information Security Manual (ISM). For organisations in Australia, India, the United States and Europe.
One set of controls, mapped to the standards your reviewers use
Every control is sourced from the ASD Information Security Manual (September 2026), ASD's agentic AI guidance, or NIST, and prints its source wording. Each one is then cross-mapped wherever the source sentence genuinely fits. Where a framework has no fit, we leave it blank rather than pad it. The report can lead with whichever standard your organisation already works to.
NIST AI RMF 1.0
US National Institute of Standards and Technology AI Risk Management Framework
Each control is cross-mapped to the subcategory it supports, such as GOVERN 1.6 for the AI inventory.
NIST AI 600-1
Generative AI Profile of the AI RMF
Each control is cross-mapped to the suggested actions it supports.
OWASP Top 10 for Agentic Applications 2026
Open Worldwide Application Security Project
Each control is cross-mapped to the agentic risk it reduces, from ASI01 goal hijack to ASI10 rogue agents.
ASD ISM, September 2026
Australian Signals Directorate Information Security Manual
The source wording for the AI agent controls, alongside ASD’s agentic AI guidance and NIST.
Eight of the 48 controls, and where each one maps
The technical findings report lists all 48, each with its source wording and every mapping.
| Control | How it is answered | Mapped to |
|---|---|---|
| Each AI agent has its own identity, separate from staff accounts. | Scan lists the agent identities. You confirm none runs under a person’s account. | OWASP ASI03ISM-2133 |
| An AI agent register is kept and regularly verified. | Scan drafts the register from Entra ID every time it runs. | NIST AI RMF GOVERN 1.6NIST AI 600-1 GV-1.6-001ISM-2134 |
| The register records owner, purpose, identities, credentials and access for each agent. | Entra ID supplies identities and access. You record owner and purpose. | NIST AI RMF GOVERN 1.6NIST AI 600-1 GV-1.6-003ISM-2135 |
| Application permissions held by apps and agents are the minimum needed. | Checked automatically. | NIST AI RMF MAP 4.2NIST AI 600-1 GV-6.1-007OWASP ASI03ISM-2156 |
| Tenant-wide delegated consents are the minimum needed. | Checked automatically. | NIST AI RMF MAP 4.2NIST AI 600-1 GV-6.1-007OWASP ASI03ISM-2157 |
| Content an agent retrieves is untrusted and cannot override its instructions. | Governance question, answered and labelled by who gave it. | NIST AI RMF MEASURE 2.7NIST AI 600-1 MS-2.7-007OWASP ASI01, ASI06ISM-2158 |
| A person approves before an agent takes a sensitive or high-impact action. | Governance question, answered and labelled by who gave it. | NIST AI RMF MAP 3.5, GOVERN 3.2NIST AI 600-1 MS-4.2-004OWASP ASI02, ASI08ISM-2113 |
| Every tool call, external request and output an agent makes is centrally logged. | Governance question, answered and labelled by who gave it. | NIST AI RMF MEASURE 2.4, MANAGE 4.1NIST AI 600-1 MS-2.6-005, MG-4.1-002ISM-2159 |
Regional notes for India and the European Union
When your organisation is in India or the EU, the report adds notes from regional documents next to the controls they bear on. Each note says what kind of document it is, so advice is never mistaken for an obligation.
- India: the Reserve Bank of India (RBI) FREE-AI committee report. A recommendation for RBI-regulated entities.
- India: the Ministry of Electronics and Information Technology (MeitY) India AI Governance Guidelines. A guideline.
- European Union: the EU AI Act, Article 4. Law.
There are no regional notes for Australia or the United States. Organisations there use the mapped standards above.
One scan, then the questions only people can answer
26 of the 48 controls are checked automatically from Microsoft Entra ID and Microsoft 365, and from Azure when it is connected. The other 22 are governance questions a tenant cannot answer. The scan only reads.
The AI agent register
Every Entra agent identity, every non-Microsoft app, every app registered in the tenant and every Microsoft AI service, plus agents built in Copilot Studio and Agent Builder, agents in the Microsoft 365 Copilot catalogue, and published Azure AI Foundry agents. For each one: what permissions it holds, what consents it has, and a risk rating for the highest permission found.
26 automated checks
App permissions and consents, apps from unverified publishers, admin roles held by apps, ageing credentials, unused and disabled apps, AI apps on managed devices, catalogue agents open to everyone, and, when Azure is connected, Copilot agents that need no sign-in, run on their maker's access or have lost their owner, content filters against prompt injection, what each AI identity can reach, AI security alerts left open, and files shared through links that need no sign-in. Each result says what was read and what to do next.
22 governance questions
Human approval, untrusted content, logging, cost controls, decommissioning and the executive questions from ASD's agentic AI guidance. Every answer is saved with who gave it and when. A client's answer on its own reads “Client reports”, not verified.
What it does, and what it does not
It does
- Only read when it scans. The scan changes nothing in your tenant.
- Work on Microsoft 365 Business Premium. No E5 licence needed. Where a check needs a licence you don't have, the report says so.
- Print each control's source wording and its NIST, OWASP and ISM references, so an assessor can check the trace.
- Mark a high permission as a review item. It is not called non-compliant until someone has judged it.
- Show what changed in the register since the last scan.
- Include Microsoft Purview evidence you upload in the report.
It does not
- Read Copilot conversations or prompts.
- Block or stop an agent while it runs, or fix anything for you. The remediation plan is guidance for your own team.
- Know the owner or business purpose of an agent. Entra ID does not hold them. You record them.
- Prove an app is an AI agent from its name alone. A name match is flagged as a hint for you to confirm.
- Answer the governance questions for you. No AI writes any part of the report.
- Map to ISO/IEC 42001. We have not verified its clause numbers, so we don't print them.
How an engagement runs
A consultant runs the engagement with your team. The consultant connects your tenant and runs the scan. Your people answer the governance questions in the CYBERWHITE portal. You get a report pack your board and your assessor can check line by line.
- Executive report, technical findings, AI agent register, remediation plan and CSV exports.
- A two-page board summary built on ASD's executive questions for AI agents.
- Re-scan any time to see what changed since the last scan.
- Viewer teammates can read results. Only engineers and owners can run a scan.
MSPs and consultants run the same engagement for their own clients, with their name on the report.
Sources
- NIST AI 100-1, AI Risk Management Framework 1.0
- NIST AI 600-1, Generative AI Profile
- OWASP Top 10 for Agentic Applications 2026
- ASD Information Security Manual, September 2026 changes
- ASD, “Agentic AI harnesses: the layer above the model” (11 September 2026)
- ASD and partners, Careful adoption of agentic AI services (April 2026)
CYBERWHITE is designed against these published documents. It is not endorsed or certified by ASD, NIST or OWASP.
Frequently asked questions
What is an AI agent register?+
A list of every AI agent an organisation runs, with what each one can access and who is accountable for it. NIST AI RMF GOVERN 1.6 asks for a way to inventory AI systems, and the Australian ISM (ISM-2134 and ISM-2135) sets out a register and what it should hold. CYBERWHITE drafts the register from Microsoft Entra ID. You add each agent’s owner and business purpose, because Entra ID does not hold them.
Which standards does AI Agent Governance map to?+
Every control is sourced from the ASD Information Security Manual (September 2026), ASD’s agentic AI guidance, or NIST. Each one is cross-mapped to NIST AI RMF 1.0, NIST AI 600-1 and the OWASP Top 10 for Agentic Applications 2026 wherever the source sentence genuinely fits. ISO/IEC 42001 is not mapped.
Is it only for Australian organisations?+
No. The ISM is one of the standards it maps to. The report can lead with NIST AI RMF, NIST AI 600-1 or the OWASP Agentic Top 10 instead. For organisations in India and the European Union, the report adds regional notes from the RBI FREE-AI committee report, the MeitY India AI Governance Guidelines and Article 4 of the EU AI Act, each labelled as a recommendation, a guideline or law. There are no regional notes for Australia or the United States.
Does the scan change anything in Microsoft 365?+
No. The scan only reads Microsoft Entra ID and Microsoft 365, and Azure when it is connected. It does not change settings, block agents or read Copilot conversations. The remediation plan in the report is guidance for your own team.
Who answers the governance questions?+
22 of the 48 controls cannot be read from a tenant, so a person answers them. The client answers in the CYBERWHITE portal, or the consultant records what they observed. Every answer is labelled by who gave it. A client’s answer on its own is reported as “Client reports”, not as verified.
What is in the report pack?+
An executive report, technical findings for all 48 controls with the source wording, the AI agent register, a remediation plan, a two-page board summary built on ASD’s executive questions, and CSV exports. A later scan shows what changed in the register since the last one.