Lab: Agent 365 Defender Playbook

Overview

This lab validates attack patterns against an Azure AI Services / Foundry-backed, tool-using application and correlates current Defender for AI Services model/application alerts in Microsoft Sentinel.

Agent 365 became generally available on May 1, 2026. This model-level lab does not require Agent 365 access and does not onboard its local chat-completions loop to Agent 365. Since July 1, 2026, Foundry agent-level discovery, posture, and threat detection require an Agent 365-eligible license and the separate Agent 365 observability path.

It focuses on the gap between traditional container security and agentic workload security. A container scanner can tell you whether an image has CVEs. It cannot tell you whether a prompt injection caused an agent to misuse a tool, leak credentials, or follow malicious instructions from retrieved content.

What Gets Deployed

Resource	Purpose
Azure AI Services	Model deployment for the agent loop
Foundry hub/project	Project context for agentic AI workloads
Key Vault, Storage, ACR	Foundry dependencies and future hosted-agent container path
Application Insights	Runtime telemetry linked to the Sentinel workspace
AI Services diagnostics	Audit, request/response, usage, trace, and metric logs
Sentinel rules	Five analytics rules using current documented Azure AI model/application alert IDs

Reviewed Implementation Notes

Python dependencies are bounded in requirements.txt and installed by the deploy script.
Attack-harness console evidence redacts sensitive tool arguments and results; raw tool results still reach the model intentionally for the defensive test.
The subscription-level Defender plan is not disabled automatically during cleanup, and optional Key Vault purge requires an exact-name confirmation.
Deployable rules exclude the retired AI.Azure_Agentic_* contract; the lab does not invent KQL over Agent 365 observability tables.
The v2 ownership marker and model-level rule IDs fail closed against an older deployment. Clean up a v1 deployment from its exact pinned revision before deploying this one.

Test Scenarios

Scenario	Purpose
`jailbreak`	Direct prompt override attempt
`instruction-leak`	System prompt extraction
`xpia`	Indirect prompt injection through retrieved content
`credential-exfil`	Honeytoken API key / SSH key extraction attempt
`ascii-smuggling`	Invisible Unicode instruction smuggling
`tool-abuse`	Prohibited email exfiltration via tool use
`wallet-attack`	Optional 200-request volume scenario; cost-bearing and not part of the retained April validation

Quick Start

git clone https://github.com/j-dahl7/agent-365-defender-sentinel.git
cd agent-365-defender-sentinel
git checkout 4714d928de2716c4638605f8edb6b2abee4cc4d7

az account show --query '{subscription:name,id:id}' -o table
az security pricing show --name AI --query '{tier:pricingTier}' -o table

export SENTINEL_WS_ID="/subscriptions/<sub>/resourceGroups/<rg>/providers/Microsoft.OperationalInsights/workspaces/<workspace>"

# Set this only if the pricing check shows that the paid plan must change.
export CONFIRM_SUBSCRIPTION_SCOPE="ENABLE-DEFENDER-FOR-AI-SERVICES"

python3 -m venv .venv
.venv/bin/pip install --require-hashes -r requirements.lock

# Read-only ownership, collision, workspace, and billing preview.
PLAN_ONLY=true ./scripts/deploy-lab.sh

# Live deployment after reviewing the preview.
./scripts/deploy-lab.sh

export AI_SERVICES_ENDPOINT="https://<ai-services>.cognitiveservices.azure.com"
export MODEL_DEPLOYMENT="gpt-4-1-mini"
.venv/bin/python attacks/run_attack.py jailbreak

The canonical README is the operational source of truth. Keep the exact pinned checkout above, and do not run wallet-attack unless you deliberately accept its additional request volume and cost.

Companion Blog

Agent 365 Launch Playbook: I Tested the Defender Response for AI Agent Attacks