In this blog post Secure AI Agents Safely with Microsoft Purview and Agent Framework we will explain how CIOs can stop useful AI agents from becoming an uncontrolled path into sensitive company data.
The risk often appears after a successful pilot. An agent that once answered simple policy questions is suddenly reading client files, checking financial systems and taking actions on behalf of employees. Productivity improves, but nobody can clearly explain what the agent can see, what it records or what happens when it makes a mistake.
At a high level, Microsoft Agent Framework provides the building blocks for creating AI agents and controlled workflows. Microsoft Purview provides the data protection and compliance layer that checks how those agents handle information.
Used together, they can create enforceable boundaries around what an agent may read, return, retain and share. This builds on the identity, permission and oversight principles covered in our CIO guide to governing enterprise AI agents.
What Microsoft Agent Framework actually does
An AI agent is more than a chatbot. It can interpret a request, search company information, call approved business systems and complete a sequence of tasks.
Microsoft Agent Framework is the software foundation developers use to assemble those capabilities. It connects AI models such as Azure OpenAI or Anthropic Claude with company data, memory, tools and structured workflows.
One of its most important governance features is middleware. Middleware is a checkpoint placed between the user, the AI model and connected systems. It can inspect a request, block an unsafe action, record an event or require approval before processing continues.
Microsoft Purview can operate at this checkpoint. Purview is Microsoft’s platform for discovering, classifying and protecting business information. Its data loss prevention policies can identify sensitive content such as personal details, health information, financial records or confidential project data.
User request
↓
Identity and permission check
↓
Purview input policy
↓
Agent Framework workflow
↓
Approved data source or business tool
↓
Human approval for high-impact actions
↓
Purview output policy
↓
Audit, retention and monitoringThis is not simply a filter placed over the final answer. It is a governance path covering the complete interaction.
Start by deciding what the agent is allowed to do
A common mistake is beginning with a list of technical features. Governance should begin with the business purpose and the consequences of failure.
An agent that summarises public product information is relatively low risk. An agent that can change a supplier’s bank details or send customer records outside the company requires far stronger controls.
For every production agent, record:
- Its business owner and technical owner.
- The users and departments allowed to access it.
- The information it can read, create or update.
- The systems and tools it can call.
- The actions that require human approval.
- How interactions will be logged and retained.
- How the agent can be disabled during an incident.
This creates accountability before the agent gains real authority. It also makes approval faster because security teams are assessing a defined use case rather than an open-ended AI experiment. Our agent onboarding framework provides a practical model for this process.
Use identity and permissions as the first boundary
Purview cannot compensate for excessive access. If an agent has permission to read every SharePoint site, file store and customer database, it may expose information that the user should never have been able to request.
Each agent should therefore have a distinct identity in Microsoft Entra, Microsoft’s identity and access management service. Permissions should be limited to the specific information and actions required for its role.
A human resources agent might read approved policy documents but not executive employment files. A finance agent might prepare a payment request but should not be able to approve and release the payment by itself.
This supports the Essential Eight, the Australian Government’s cybersecurity framework for reducing common security threats, particularly its focus on multifactor authentication and restricting administrative privileges. The Essential Eight does not replace AI governance, but it provides an important security foundation.
Apply Purview policies to both prompts and responses
Sensitive information can enter an agent through a user’s prompt or leave through the agent’s response. Both directions need inspection.
Agent Framework can use Purview policy middleware to intercept prompts, responses and agent-to-agent messages. Depending on the policy, an interaction can be allowed, recorded, warned about or blocked before information is released.
For example, an employee might ask an agent to summarise a spreadsheet containing customer names, account numbers and health information. Purview can recognise those information types and prevent the agent from returning them through an unapproved channel.
The Purview checkpoint should be the final middleware boundary so another component cannot alter the response after it has been inspected. Streaming responses also require careful planning because the content may need to be assembled and checked before any part is shown. We cover that specific design issue in our guide to guarding streaming AI agents.
Do not confuse content controls with action controls
Purview primarily governs data. It does not automatically decide whether an agent should cancel an order, delete a record or email a contract.
High-impact actions need separate controls within Agent Framework. Use explicit workflows, restricted tools and human approval steps rather than allowing the AI model to decide every next action.
A sensible policy is to let agents gather information and prepare recommendations automatically. Actions involving money, legal commitments, employee records, customer communications or destructive system changes should normally require approval.
This is where architecture matters. Our secure Azure AI agent architecture guide explains how sandboxes, controlled connections and approval gates reduce the impact of incorrect decisions.
Build an audit trail without creating another privacy problem
CIOs need to know which agent accessed what information, which tools it used and why an action was allowed or blocked. Purview can support auditing, data lifecycle management, eDiscovery, insider risk investigations and communication compliance for supported agent environments.
Agent Framework can also produce operational traces, logs and performance measurements. However, recording every prompt, response and tool result can create a new collection of highly sensitive information.
Decide which details are genuinely required for security and compliance. Restrict access to the logs, apply retention periods and avoid capturing complete sensitive conversations unless there is a justified need.
This is especially relevant under Australia’s Privacy Act when agents process personal information. Logging should be deliberate, proportionate and documented rather than enabled simply because the option exists.
An example of governance in practice
Consider a 200-person professional services firm introducing an agent to prepare client briefing packs. The agent needs to search approved project folders, summarise documents and create a draft in Microsoft 365.
Without governance, it might search unrelated client matters, include confidential pricing in its answer or expose personal information through its logs.
A safer design gives the agent access only to the requesting user’s approved project areas. Purview checks the prompt and completed briefing for sensitive information, while Agent Framework limits the workflow to search, summarise and draft.
The agent cannot send the briefing externally. A consultant must review and approve it first. The business still saves preparation time, but the agent does not gain uncontrolled authority over client information.
A practical governance plan for CIOs
- Inventory existing agents. Include internal tools, Copilot agents, Microsoft Foundry workloads and Entra-registered custom applications.
- Assign an owner and risk rating. Base the rating on data sensitivity and the impact of available actions.
- Reduce permissions. Remove broad access before relying on content filtering.
- Classify important information. Purview policies work best when the business knows which data is sensitive.
- Add runtime checks. Inspect prompts, responses and agent-to-agent exchanges.
- Require approval for consequential actions. Keep people responsible for decisions involving money, legal obligations or sensitive records.
- Test failure scenarios. Try unauthorised requests, prompt manipulation, excessive data access and unavailable policy services.
- Review evidence regularly. Monitor blocked interactions, unusual access, operating costs and recurring policy gaps.
Licensing should also be checked early. Some Purview AI governance capabilities require Microsoft 365 E5 features, pay-as-you-go billing or additional configuration. Confirming this during design prevents an apparently complete security plan from losing important controls at deployment.
Governance should make safe AI easier to approve
The goal is not to place a compliance obstacle in front of every AI idea. It is to give the business a repeatable way to approve useful agents without accepting unknown data and operational risk.
Microsoft Purview and Agent Framework work best as part of a wider control model covering identity, source permissions, workflow design, monitoring and human accountability. For production Microsoft Foundry environments, our production agent governance guide extends these controls across the full operating environment.
CloudPro Inc combines more than 20 years of enterprise IT experience with hands-on work across Azure, Microsoft 365, Defender, Purview, OpenAI, Claude and Wiz. As a Melbourne-based Microsoft Partner and Wiz Security Integrator, we help organisations design controls that work in daily operations, not just in policy documents.
If you are unsure whether your AI agents can access, reveal or act on more than they should, we are happy to review the current design and identify the highest-priority gaps — no strings attached.