Getting Started: Configuring Runtime Protection for Agent 365 Tooling

Follow-up

Thanks to a reader suggestion, this post is a follow-up to the recent “Runtime Protection for Agents: Detection Is Not Enough.”

The runtime protection described here is available today through Microsoft Defender’s integration with Agent 365. It evaluates tool invocations (and tool responses) for Work IQ MCP servers and custom MCP servers that have been onboarded to Agent 365, applying policy before the action completes.

Prerequisites

Before configuring protection rules, complete the enablement steps so that telemetry, behaviors, and enforcement are available:

1. Onboard to Microsoft Agent 365.

2. Enable security for AI agents in the Microsoft Defender portal, including the Microsoft 365 app connector. This is required for investigation, Advanced Hunting, and full visibility into agent activity.

3. Confirm that relevant agents and MCP tooling servers are registered and visible in the Agent 365 control plane.

Full enablement guidance is available here:
Enable security for AI agents using Microsoft Defender

Configuring Real-Time Protection Rules

Once security for AI agents is enabled, real-time protection is managed in the Microsoft Defender portal:

Settings → Security for AI → Policies & rules → Real-time protection

Two rule types are available:

• Default rule — Audits matching activity across agents. The action is allowed to complete, but the event is recorded as a behavior. This provides visibility and a baseline before moving to enforcement.

• Custom rules — Block matching actions before they execute. You can scope rules to all agents or specific agents, exclude individual agents, and select the detection types (threat scenarios) the rule should cover. Blocked events are also recorded as behaviors.

Recommended rollout path:

1. Leave the default audit rule enabled so teams can observe detections and refine understanding of agent behavior.

2. Create targeted custom rules for high-confidence threats (unsafe tool invocations, secret leakage through tool calls, communication with untrusted domains, malicious content propagation, and related scenarios).

3. Scope blocking rules carefully and expand as confidence grows.

Audited and blocked actions appear as behaviors that can be queried in Advanced Hunting (including the BehaviorInfo table). These behaviors support custom detections, hunting queries, and automation without requiring a full incident.

Complete configuration steps, rule creation details, and management guidance are documented here:
Protect AI agents in real time using Microsoft Defender

Scope Notes

This protection applies to Agent 365 tool invocations that route through Work IQ MCP or customer MCP tools registered with Agent 365. Agents that do not integrate with Work IQ MCP or rely on unsupported tools fall outside this coverage path.

Local AI agents running on endpoints use a separate runtime protection capability in Microsoft Defender for Endpoint (agent-native event inspection and/or network inspection). That configuration is managed via PowerShell preferences or Intune scripts and is documented separately.

Runtime protection closes the gap between detection and prevention at the moment of action. Combined with the observability of the full agent loop, it gives security teams both the ability to stop high-risk tool invocations and the telemetry needed to understand, hunt, and continuously harden agent behavior.

Advanced Hunting queries for agent behaviors

Here are practical Advanced Hunting queries focused on the agent behaviors and runtime protection events described in the post.

1. Recent Real-Time Protection Behaviors (Audit + Block)

These are the events recorded when Defender evaluates tool invocations against your real-time protection rules.

BehaviorInfo
| where Timestamp > ago(7d)
| where ServiceSource has_any ("Defender", "Security for AI", "Agent")
   or Title has_any ("agent", "tool", "MCP", "prompt injection", "exfiltration", "secret")
   or Description has_any ("tool invocation", "agent", "MCP", "Work IQ")
| project Timestamp, BehaviorId, Title, Description, ActionType, Categories, AttackTechniques, 
          AccountUpn, StartTime, EndTime, AdditionalFields
| order by Timestamp desc

2. Behaviors + Related Entities (Recommended Investigation Query)

Joins the behavior with the associated agents, users, tools, and resources.

BehaviorInfo
| where Timestamp > ago(7d)
| join kind=inner BehaviorEntities on BehaviorId
| project Timestamp, BehaviorId, Title, Description, ActionType, Categories, AttackTechniques,
          EntityType, EntityRole, AccountUpn, AccountObjectId, 
          Application, RemoteIP, AdditionalFields
| order by Timestamp desc

3. Agent Tool Invocations (Agent 365 Observability)

Primary source for tool call activity through Work IQ MCP and custom MCP servers.

CloudAppEvents
| where Timestamp > ago(7d)
| where ActionType in (
    "InvokeAgent",
    "InferenceCall",
    "ExecuteToolBySDK",
    "ExecuteToolByGateway",
    "ExecuteToolByMCPServer"
)
| extend Raw = parse_json(RawEventData)
| project Timestamp, ActionType, Application, AccountDisplayName, AccountObjectId,
          IPAddress, CountryCode, 
          AgentId = tostring(Raw.PlatformAgentId),
          TargetAgentId = tostring(Raw.PlatformTargetAgentId),
          ToolName = tostring(Raw["gen_ai.tool.name"]),
          ToolParameters = tostring(Raw["gen_ai.tool.parameters"]),
          RawEventData
| order by Timestamp desc

4. Correlate Tool Invocations with Runtime Protection Behaviors

Useful for understanding which tool calls were audited or blocked.

let ToolCalls = 
    CloudAppEvents
    | where Timestamp > ago(7d)
    | where ActionType in ("ExecuteToolByGateway", "ExecuteToolByMCPServer", "ExecuteToolBySDK")
    | extend Raw = parse_json(RawEventData)
    | project ToolTimestamp = Timestamp, 
              ActionType, 
              AccountObjectId,
              AgentId = tostring(Raw.PlatformAgentId),
              ToolName = tostring(Raw["gen_ai.tool.name"]);
BehaviorInfo
| where Timestamp > ago(7d)
| join kind=inner BehaviorEntities on BehaviorId
| where EntityType has_any ("Agent", "Tool", "User") or AccountObjectId != ""
| join kind=leftouter ToolCalls on $left.AccountObjectId == $right.AccountObjectId
| project Timestamp, BehaviorId, Title, Description, ActionType, Categories,
          EntityType, AccountUpn, ToolName, ToolTimestamp
| order by Timestamp desc

5. Agent Inventory (Current Agents and MCP Servers)

AgentsInfo
| where Timestamp > ago(1d)
| summarize arg_max(Timestamp, *) by AgentId
| where LifecycleStatus !in~ ("Deleted", "Uninstalled")
| project Timestamp, AgentId, AgentName, Platform, EntraAgentId, 
          PublishedStatus, LifecycleStatus, Model, 
          McpServers, DeclaredTools, Owners, Instructions
| order by AgentName asc

6. High-Value Hunting Patterns

Potential secret leakage or data exfiltration via tools

CloudAppEvents
| where Timestamp > ago(24h)
| where ActionType in ("ExecuteToolByGateway", "ExecuteToolByMCPServer")
| extend Raw = parse_json(RawEventData)
| where tostring(Raw) has_any ("password", "secret", "token", "key", "credential", "api_key", "connectionstring")
| project Timestamp, ActionType, AccountDisplayName, 
          ToolName = tostring(Raw["gen_ai.tool.name"]),
          Parameters = tostring(Raw["gen_ai.tool.parameters"]),
          RawEventData

Blocked or audited high-risk behaviors in the last 24 hours

BehaviorInfo
| where Timestamp > ago(24h)
| where ActionType has_any ("Block", "Audit") 
   or Title has_any ("block", "audit", "prevented")
| join kind=inner BehaviorEntities on BehaviorId
| project Timestamp, BehaviorId, Title, Description, ActionType, 
          AccountUpn, EntityType, Application
| order by Timestamp desc

---

Tips for Use

• Start with the BehaviorInfo + BehaviorEntities join when investigating runtime protection activity.

• Use CloudAppEvents with the specific ActionTypes for the full agent loop visibility (prompts → tool calls → responses).

• Filter on AdditionalFields or parse RawEventData more deeply once you see the shape of your tenant’s data.

• These queries can be turned into custom detection rules once you tune them to your environment.

Focused Advanced Hunting queries for Work IQ MCP

These queries target the runtime protection and observability data most relevant to Work IQ MCP tool invocations (the Microsoft 365-grounded tooling servers protected by Defender in Agent 365).

1. Work IQ MCP Tool Invocations (Primary Query)

CloudAppEvents
| where Timestamp > ago(7d)
| where ActionType in (
    "ExecuteToolByGateway",
    "ExecuteToolByMCPServer",
    "ExecuteToolBySDK"
)
| extend Raw = parse_json(RawEventData)
| extend ToolName = tostring(Raw["gen_ai.tool.name"]),
         Operation = tostring(Raw["gen_ai.operation.name"]),
         ResourcePath = tostring(Raw["gen_ai.tool.parameters"]),
         AgentId = tostring(coalesce(Raw.PlatformAgentId, Raw.PlatformTargetAgentId))
| where ToolName has_any ("fetch", "create_entity", "update_entity", "delete_entity", 
                          "do_action", "call_function", "ask", "list_agents", 
                          "get_schema", "search_paths")
   or ResourcePath has_any ("/me/", "/users/", "messages", "events", "chats", "drive", "sites")
   or tostring(Raw) has_any ("Work IQ", "WorkIQ", "mcp_", "workiq")
| project Timestamp, ActionType, AccountDisplayName, AccountObjectId, IPAddress,
          ToolName, Operation, ResourcePath, AgentId, Application, RawEventData
| order by Timestamp desc

2. Real-Time Protection Behaviors Tied to Work IQ MCP

BehaviorInfo
| where Timestamp > ago(7d)
| join kind=inner BehaviorEntities on BehaviorId
| where Title has_any ("tool", "MCP", "agent", "Work IQ", "exfiltration", "secret", "injection")
   or Description has_any ("tool invocation", "MCP", "Work IQ", "gateway")
   or tostring(AdditionalFields) has_any ("Work IQ", "MCP", "tool")
| project Timestamp, BehaviorId, Title, Description, ActionType, Categories, 
          AttackTechniques, AccountUpn, EntityType, EntityRole, Application
| order by Timestamp desc

3. Work IQ MCP Tool Calls + Protection Outcomes (Correlation)

let WorkIQTools =
    CloudAppEvents
    | where Timestamp > ago(7d)
    | where ActionType in ("ExecuteToolByGateway", "ExecuteToolByMCPServer")
    | extend Raw = parse_json(RawEventData)
    | extend ToolName = tostring(Raw["gen_ai.tool.name"]),
             AgentId = tostring(coalesce(Raw.PlatformAgentId, Raw.PlatformTargetAgentId)),
             ResourcePath = tostring(Raw["gen_ai.tool.parameters"])
    | where ToolName has_any ("fetch", "do_action", "create_entity", "update_entity", 
                              "delete_entity", "ask", "call_function")
       or ResourcePath has_any ("/me/messages", "/me/events", "/me/chats", "/me/drive", "sendMail")
    | project ToolTime = Timestamp, AccountObjectId, ToolName, ResourcePath, AgentId, ActionType;
BehaviorInfo
| where Timestamp > ago(7d)
| join kind=inner BehaviorEntities on BehaviorId
| join kind=leftouter WorkIQTools on $left.AccountObjectId == $right.AccountObjectId
| project Timestamp, BehaviorId, Title, Description, ActionType, 
          AccountUpn, ToolName, ResourcePath, AgentId, EntityType
| order by Timestamp desc

4. High-Risk Work IQ MCP Patterns

Potential data exfiltration or sensitive actions via Work IQ tools

CloudAppEvents
| where Timestamp > ago(24h)
| where ActionType in ("ExecuteToolByGateway", "ExecuteToolByMCPServer")
| extend Raw = parse_json(RawEventData)
| extend ToolName = tostring(Raw["gen_ai.tool.name"]),
         Params = tostring(Raw["gen_ai.tool.parameters"])
| where ToolName in ("do_action", "create_entity", "update_entity", "fetch")
| where Params has_any ("sendMail", "messages", "mail", "forward", "reply", 
                        "drive", "sites", "files", "download", "export")
   or Params has_any ("password", "secret", "token", "credential", "key", "connection")
| project Timestamp, AccountDisplayName, ToolName, Params, IPAddress, RawEventData
| order by Timestamp desc

Recent blocked/audited Work IQ-related behaviors

BehaviorInfo
| where Timestamp > ago(24h)
| where ActionType has_any ("Block", "Audit")
| join kind=inner BehaviorEntities on BehaviorId
| where Title has_any ("tool", "MCP", "agent") 
   or Description has_any ("Work IQ", "tool invocation", "MCP server")
| project Timestamp, BehaviorId, Title, Description, ActionType, AccountUpn, EntityType
| order by Timestamp desc

5. Agents Using Work IQ MCP Servers

AgentsInfo
| where Timestamp > ago(1d)
| summarize arg_max(Timestamp, *) by AgentId
| where LifecycleStatus !in~ ("Deleted", "Uninstalled")
| where tostring(McpServers) has_any ("Work IQ", "WorkIQ", "mcp_", "Calendar", "Mail", "Teams")
   or tostring(DeclaredTools) has_any ("fetch", "do_action", "ask", "Work IQ")
| project AgentId, AgentName, Platform, EntraAgentId, PublishedStatus, 
          McpServers, DeclaredTools, Owners
| order by AgentName asc

---

Notes for Work IQ MCP hunting

• Work IQ MCP primarily surfaces through the gateway / MCP server ActionTypes in CloudAppEvents.

• The 10 core tools (fetch, do_action, create_entity, etc.) plus resource paths under /me/ or Graph-style paths are strong indicators.

• Runtime protection decisions (audit vs block) land in BehaviorInfo / BehaviorEntities.

• Start with query #1 and #3. They give the best visibility into the protected tool invocations the blog post focuses on.