Chapter 1 of 6
Module scope#
What we will do#
Objective. Turn on threat protection for one approved AI scope and give the SOC a focused AI detection path.
Enable the Defender for Cloud AI services plan in the approved subscription, deploy one Copilot jailbreak analytics rule and one hunting query to the approved Sentinel workspace, and record the Defender for Cloud Apps shadow AI sanction decisions. The observable result is a Standard Defender AI plan, an enabled Sentinel rule, and Unsanctioned tags applied to the recorded generative AI apps after a monitor-first review.
Why it matters#
Problem. AI attacks and unmanaged AI app use can bypass normal SOC tuning. Prompt injection, credential leakage, wallet attacks, and unsanctioned AI tools need named owners before alerts or blocks start.
Solution. This module turns on the AI services plan, deploys the first Copilot detection path, and records shadow AI decisions before portal changes. The SOC gets a scoped signal, not a broad new queue.
EU AI Act. For high-risk AI systems, this module supports Article 15 (cybersecurity) with Defender threat protection and Sentinel detections, and Article 73 (serious incidents) with early detection. Shadow AI discovery extends the Article 5 (prohibited practices) screen to AI apps nobody approved. This is an engineering mapping, not legal advice.
Boundaries#
This module sits outside the numbered session sequence.
It changes three surfaces: the subscription-level Defender for Cloud AI services plan, two Sentinel content items in one workspace, and Defender for Cloud Apps sanction tags for recorded generative AI apps. Azure and Microsoft Defender hold live plan, alert, rule, and app-tag state. The repository holds the Bicep definitions, KQL, and decision records.
Red teaming and the Defender alert-to-SOC route remain with the red teaming and threat defense guide. Operational alert thresholds and incident paths remain with the observability guide. Purview DLP for Agent 365 remains with the Agent 365 access boundary guide.
Module preparation
Who should join
- Security operations and Microsoft Sentinel engineers
- Microsoft Defender for Cloud and Defender XDR administrators
- Microsoft Defender for Cloud Apps owners
- AI platform and Microsoft Foundry owners
What you need
- The approved AI-hosting subscription, target scope alias, Sentinel workspace, Sentinel resource group, and deployment location are recorded in the private implementation parameters.
- The deployment operator can run subscription-scope and resource-group Bicep what-if for the approved nonproduction scope.
- Microsoft Defender for Cloud is enabled for the approved subscription, and the security owner can approve the AI services plan and prompt-evidence decisions.
- The Sentinel workspace is onboarded, the Microsoft Copilot connector is enabled or approved for enablement, and the SOC owner accepts the analytics rule and hunting query.
- Defender for Cloud Apps receives Cloud Discovery data, and the security operations owner can tag generative AI apps as Sanctioned or Unsanctioned.