Chapter 2 of 6
Architecture at a glance#
The subscription plan is the first control boundary. Defender for Cloud analyzes supported AI service activity, raises AI alerts, and sends them to Defender XDR. Sentinel receives AI-related signals from its connectors and the Log Analytics workspace.
The module deploys two reusable definitions:
| Surface | Repository definition | Live authority |
|---|---|---|
| Defender for Cloud AI services plan | defender-ai-plan.bicep and defender-ai-plan-decisions.json | Microsoft Defender for Cloud |
| Copilot jailbreak analytics rule | copilot-threat-detections.bicep and copilot-jailbreak-analytics.kql | Microsoft Sentinel |
| Copilot external-IP hunting query | copilot-threat-detections.bicep and copilot-external-ip-hunting.kql | Log Analytics saved searches surfaced in Sentinel |
| Shadow AI decisions | shadow-ai-sanction-decisions.json | Defender for Cloud Apps portal tags and policies |
The workflow runs Bicep what-if for the two deployable surfaces. Shadow AI tagging is portal-led: the security owner starts in monitor mode, applies Sanctioned or Unsanctioned tags, and moves to blocking only through the approved change path.
Design choices and tradeoffs#
| Decision | Chosen approach | Benefits | Costs and limitations |
|---|---|---|---|
| Defender plan rollout | Subscription-scope Bicep for Microsoft.Security/pricings name AI | Repeatable plan state and extension decisions | Prompt evidence and Purview sharing need a privacy decision |
| Sentinel content | Bicep for a scheduled analytics rule and saved search | The SOC can deploy and review as code | Connectors and tables must already produce data |
| Hunting query | Log Analytics saved search | Matches how Sentinel hunting queries are stored | The starter private-range filter must be tuned |
| Shadow AI | Monitor-first portal path with a JSON decision record | Avoids blocking a business app before review | The portal remains authoritative for app tags and enforcement |
Architecture guidance#
Use AI threat protection in Microsoft Defender for Cloud for the plan scope, supported services, Defender XDR integration, and availability limits.
Use Enable threat protection for AI services for the AI services plan components, prompt-evidence behavior, Purview-sharing boundary, and role requirements.
Use Manage generative AI apps for your organization for Defender for Cloud Apps discovery, Generative AI filtering, and Sanctioned or Unsanctioned tagging.