Microsoft’s security chief says the agents you deployed are insiders: overprivileged, able to act on data and tools, and likely to misbehave without being compromised. The inventory is available at every Entra tier. The containment that follows is not.
A developer runs a local coding agent that reads instructions hidden in project content. Intune can deploy Defender runtime protection in Audit so admins can review detections before blocking supported activity. Verify the pilot and its coverage before broadening enforcement.
Device code phishing uses the real microsoft.com/devicelogin page. MFA succeeds, the attacker gets the tokens. Block Authentication flows > Device code in Conditional Access, report-only first.
Cisco Secure Access, Tanium, and Clever MFA TrustPass are now GA as Edge for Business connectors. If you already run any of the three, here is the config-and-verify path.
Defender Experts MDR Plan 2 extends managed detection beyond Microsoft products through Sentinel, covering non-Microsoft cloud, identity, email, network, and endpoint sources.
Claude Desktop ships with a shared API key in a local config file — no per-user identity, no MFA, no audit trail. For MSPs with regulated clients, that’s a non-starter. Microsoft just published an architecture that routes Claude Desktop through Entra ID and Azure API Management with zero custom backend code. Per-user identity, Conditional Access, auditable, and the config can be pushed via Intune. If your clients are asking for sanctioned AI desktop tools alongside their existing M365 stack, this closes a real governance gap.
Most MSPs can tell you which Azure VMs are running. Fewer can tell you which ones stopped sending Defender telemetry last week. A new Logic App automation from Microsoft closes that gap daily — and it is a compliance-monitoring service waiting to happen.
Most MSPs can’t answer which service principals are active in a client tenant, let alone which are over-privileged. Microsoft Defender now surfaces NHI inventory and governance—and that is a recurring-service opportunity hiding in plain sight.
Microsoft Defender for Linux now supports scheduled scans, and Edge Stable shifts to a two-week release cycle on August 27. MSPs need to make two configuration decisions now: close the Linux scan gap and choose the right Edge channel per client.
GitHub Copilot CLI can analyze exported Intune diagnostics. Dataverse MCP gives agents named tools that can create records. MSPs need one auditable policy for AI access before useful troubleshooting turns into shadow IT.
