Microsoft 365 AI agent created
A Copilot or Power Platform agent was created or modified.
What it detects
A Copilot or Power Platform agent was created or modified.
An agent is automation with an identity and a standing grant. Once created it reads whatever its connections allow — mail, files, chats — on a schedule, with no further sign-in to notice and no session to revoke. Data leaves through the agent's own HTTP action rather than as an attachment, so mail-flow controls, DLP on attachments and outbound gateway rules never see it.
It is the newest form of a very old technique: persistence that survives password resets because it is not a credential. The pack already covers Power Automate flows moving mail; this covers the agent layer above it, which can be prompted to decide what to take rather than following a fixed rule.
MITRE ATT&CK mapping
False positives and triage
Tenants that have adopted Copilot Studio or Power Platform create agents as ordinary business work, and in those the volume is real — the useful question is what the agent CONNECTS to, not that it exists. Escalate on agents with HTTP actions pointing at raw IP addresses or unfamiliar domains, on configurations allowing unauthenticated invocation, and on agents built by an account with no history of Power Platform use. An agent created shortly after a suspicious sign-in by the same actor is the sequence that matters. Note that disabling the user does not stop a published agent; it has to be removed.
The rule
Declarative YAML read by the detection engine — data, never executed. Confidence 60%. Source: rules/cloud/m365_ai_agent_created.yaml, licensed under the Apache License 2.0.
id: cloud.identity.m365_ai_agent_created
version: 1.0.0
status: stable
severity: high
confidence: 0.6
platforms: [application]
mitre_techniques: [T1505, T1114, T1567]
description: |
A Copilot or Power Platform agent was created or modified.
An agent is automation with an identity and a standing grant. Once created it
reads whatever its connections allow — mail, files, chats — on a schedule, with
no further sign-in to notice and no session to revoke. Data leaves through the
agent's own HTTP action rather than as an attachment, so mail-flow controls, DLP
on attachments and outbound gateway rules never see it.
It is the newest form of a very old technique: persistence that survives password
resets because it is not a credential. The pack already covers Power Automate
flows moving mail; this covers the agent layer above it, which can be prompted to
decide what to take rather than following a fixed rule.
match:
event_action_any:
- CreateAgent
- UpdateAgent
- CreateBot
- UpdateBot
- CreateCopilot
- UpdateCopilot
- PublishAgent
correlation_keys: [user_name]
false_positive_guidance: |
Tenants that have adopted Copilot Studio or Power Platform create agents as
ordinary business work, and in those the volume is real — the useful question is
what the agent CONNECTS to, not that it exists. Escalate on agents with HTTP
actions pointing at raw IP addresses or unfamiliar domains, on configurations
allowing unauthenticated invocation, and on agents built by an account with no
history of Power Platform use. An agent created shortly after a suspicious
sign-in by the same actor is the sequence that matters. Note that disabling the
user does not stop a published agent; it has to be removed.
Related detections
Run this rule on your own logs — offline
KIROSEC runs this rule and the rest of the library over Windows, Linux, macOS and cloud audit logs on the analyst's own machine. Every alert links to the events that raised it, and nothing leaves the device.