{"id":59114,"date":"2026-10-15T08:02:03","date_gmt":"2026-10-14T22:02:03","guid":{"rendered":"https:\/\/www.cloudproinc.com.au\/index.php\/2026\/10\/15\/how-to-guard-streaming-ai-agents-with-microsoft-purview-policies\/"},"modified":"2026-10-15T08:04:26","modified_gmt":"2026-10-14T22:04:26","slug":"how-to-guard-streaming-ai-agents-with-microsoft-purview-policies","status":"publish","type":"post","link":"https:\/\/www.cloudproinc.com.au\/index.php\/2026\/10\/15\/how-to-guard-streaming-ai-agents-with-microsoft-purview-policies\/","title":{"rendered":"How to Guard Streaming AI Agents with Microsoft Purview Policies"},"content":{"rendered":"\n

In this blog post How to Guard Streaming AI Agents with Microsoft Purview Policies<\/strong> we will explain how to stop sensitive information escaping while an AI agent sends its answer to a user in real time.<\/p>\n\n\n\n\n\n\n\n

Streaming makes an AI assistant feel fast because words appear as they are generated. The risk is that confidential content may already be on screen before your security policy has inspected the complete answer.<\/p>\n\n\n\n

Microsoft Agent Framework helps organisations build and operate AI agents using .NET or Python. Microsoft Purview, Microsoft\u2019s data security and compliance platform, can sit in the agent\u2019s processing path and check prompts and responses against centrally managed rules.<\/p>\n\n\n\n

Why streaming changes the security problem<\/h2>\n\n\n\n

With a normal AI response, the application can wait for the complete answer, inspect it and then decide whether to display it. A streaming agent sends small pieces of the response to the browser as they arrive.<\/p>\n\n\n\n

Imagine an HR assistant preparing a summary about salary reviews. The first few streamed sentences may be harmless, but a later section could include employee names, salaries or health information pulled from an internal document.<\/p>\n\n\n\n

If those early response fragments have already reached the user, deleting the message at the end is too late. Screenshots, browser logs and connected applications may have retained the information.<\/p>\n\n\n\n

This is why streaming guardrails must control what leaves the agent, not simply review the final transcript.<\/p>\n\n\n\n

How Purview policy enforcement works<\/h2>\n\n\n\n

Microsoft Purview can apply data loss prevention rules, commonly called DLP rules. These are policies that identify sensitive information and decide whether it should be allowed, recorded, restricted or blocked.<\/p>\n\n\n\n

The policies can look for recognised information types such as payment card numbers, passport details and health data. They can also use sensitivity labels, which are tags such as Public, Internal or Highly Confidential applied to Microsoft 365 files and emails.<\/p>\n\n\n\n

Microsoft Agent Framework supports middleware, which is a checkpoint placed between the user, the AI model and the final application. Purview middleware can inspect the incoming prompt and the generated response without forcing every development team to write its own detection system.<\/p>\n\n\n\n

If you are still planning the wider platform, our guide to building production AI agents with Microsoft Agent Framework and .NET explains the underlying application structure.<\/p>\n\n\n\n

Five policy patterns that work in practice<\/h2>\n\n\n\n

1. Check the prompt before it reaches the model<\/h3>\n\n\n\n

The first checkpoint should inspect the user\u2019s prompt and relevant conversation history. This reduces the chance of staff submitting customer lists, credentials, legal documents or other restricted information to an agent that is not approved to process it.<\/p>\n\n\n\n

Low-risk content can continue normally. Higher-risk content can be blocked with a useful explanation, rather than a vague error message.<\/p>\n\n\n\n

For example, tell the user that the request contains payroll information and must be handled through the approved HR workflow. This turns a security control into practical guidance instead of an obstacle employees try to bypass.<\/p>\n\n\n\n

2. Buffer the response before releasing the stream<\/h3>\n\n\n\n

For sensitive business agents, the safest pattern is to temporarily hold the complete response, evaluate it and only then release it to the user. Current Purview integration for Microsoft Agent Framework supports full-buffer policy evaluation for streamed responses.<\/p>\n\n\n\n

This creates a small delay, but it prevents a confidential sentence from appearing before the policy decision is complete. The interface can display a message such as \u201cChecking this response against company data policy\u201d so the user understands what is happening.<\/p>\n\n\n\n

Not every agent needs this treatment. A public website assistant answering questions from approved marketing content may accept more immediate streaming. An HR, finance, legal or customer-data agent generally should not.<\/p>\n\n\n\n

3. Put controls close to the model connection<\/h3>\n\n\n\n

Purview can be added at the overall agent level or around the chat client, which is the component that communicates with the AI model. For strong response control, we generally prefer enforcement close to that model connection.<\/p>\n\n\n\n

This helps ensure a blocked response is stopped before it is displayed or stored in conversation history. Otherwise, an unsafe answer may be hidden from the current screen but remain available to a later conversation turn.<\/p>\n\n\n\n

The following simplified C# pattern shows the intended structure. Microsoft\u2019s integration remains in preview, so package versions and behaviour should be tested before production rollout.<\/p>\n\n\n\n

\/\/ Simplified example for architectural guidance\nTokenCredential purviewCredential =\n GetApprovedPurviewCredentialForCurrentUser();\n\nIChatClient protectedClient = rawChatClient\n .AsBuilder()\n .WithPurview(\n purviewCredential,\n new PurviewSettings("Finance Assistant"))\n .Build();\n\nAIAgent agent = protectedClient.AsAIAgent(\n instructions: "Help authorised finance staff analyse approved data.");\n\nawait foreach (AgentResponseUpdate update in\n agent.RunStreamingAsync(prompt, session, cancellationToken: ct))\n{\n await userInterface.SendAsync(update.ToString(), ct);\n}<\/code><\/pre>\n\n\n\n
The important point is not the exact syntax. It is that policy enforcement sits inside the response path, rather than being added later as a reporting feature.<\/p>\n\n\n\n
4. Keep tool permissions separate from data policy<\/h3>\n\n\n\n
Purview can decide whether content should move through the agent, but it should not be your only guardrail. It does not replace normal access controls or approval processes.<\/p>\n\n\n\n
An agent that can read a customer record should not automatically be allowed to update it. An agent that drafts a payment request should not be able to approve the payment.<\/p>\n\n\n\n
Use explicit tool permissions, limited user access and human approval for high-impact actions. Our article on designing a secure control plane for enterprise AI agents covers these broader controls in more detail.<\/p>\n\n\n\n
5. Decide what happens when policy checks fail<\/h3>\n\n\n\n
Many teams design for a blocked response but forget to design for an unavailable policy service. If Purview cannot return a decision, should the agent continue, retry or stop?<\/p>\n\n\n\n
For a public knowledge assistant, a short retry followed by a restricted response may be reasonable. For payroll, healthcare or legal data, the safer choice is usually to stop and record the event.<\/p>\n\n\n\n
This is known as failing closed. It means the business accepts temporary inconvenience rather than releasing information without a completed security check.<\/p>\n\n\n\n
A realistic business scenario<\/h2>\n\n\n\n
Consider a 200-person professional services firm introducing an agent that searches project documents and drafts client updates. Without proper controls, a consultant could ask a reasonable question and receive information copied from another client\u2019s commercially sensitive file.<\/p>\n\n\n\n
A practical policy design would block highly confidential labelled documents, inspect prompts for personal and financial information, buffer responses before display and require human approval before anything is emailed externally.<\/p>\n\n\n\n
The business outcome is clear. Staff still save time finding and summarising information, but the firm reduces the chance of a privacy incident, contractual breach or damaging client conversation.<\/p>\n\n\n\n
What CIOs should ask before approving streaming<\/h2>\n\n\n\n
    \n
  • Which agents are allowed to stream responses immediately?<\/li>\n
  • Which data types and sensitivity labels must trigger blocking?<\/li>\n
  • Is policy evaluated using the real user\u2019s identity or a shared service account?<\/li>\n
  • Can blocked content remain in conversation history or application logs?<\/li>\n
  • What happens if the policy service is slow or unavailable?<\/li>\n
  • Are policy decisions, overrides and failed checks retained for investigation?<\/li>\n
  • Have security, privacy and business owners tested realistic scenarios?<\/li>\n<\/ul>\n\n\n\n
    These controls also support broader Australian governance obligations. The Essential 8, the Australian government\u2019s cybersecurity framework, does not provide a complete AI policy, but its focus on controlled access, application security and administrative discipline remains highly relevant.<\/p>\n\n\n\n
    Organisations should also consider their obligations under Australian privacy legislation when agents process personal information. Purview can provide useful controls and evidence, but technology cannot replace a clear purpose, appropriate access and accountable data handling.<\/p>\n\n\n\n
    Build guardrails before users depend on the agent<\/h2>\n\n\n\n
    The best time to add streaming controls is before the agent becomes part of daily work. Retrofitting them later can change response times, application design and how conversation history is stored.<\/p>\n\n\n\n
    Purview provides a strong policy layer, but it works best alongside identity controls, limited tool access, monitoring and human approval. You also need an operating model for investigating blocks and tuning false positives, as covered in our guide to operationalising Microsoft Agent Framework in production.<\/p>\n\n\n\n
    CloudProInc brings more than 20 years of enterprise IT experience to this work. As a Melbourne-based Microsoft Partner and Wiz Security Integrator, we help organisations connect Azure, Microsoft 365, Purview, Defender and AI services without turning the project into a giant, faceless consulting exercise.<\/p>\n\n\n\n
    If you are unsure whether your streaming agent can expose information before its controls react, we are happy to review the design and point out the practical gaps \u2014 no strings attached.<\/p>\n\n\n","protected":false},"excerpt":{"rendered":"
    Streaming makes AI feel fast, but it can expose sensitive data before checks finish. Learn practical Purview policy patterns that keep Agent Framework responses controlled, auditable and useful.<\/p>\n","protected":false},"author":1,"featured_media":59116,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_et_pb_use_builder":"","_et_pb_old_content":"","_et_gb_content_width":"","_jetpack_newsletter_access":"","_jetpack_dont_email_post_to_subs":true,"_jetpack_newsletter_tier_id":0,"_jetpack_memberships_contains_paywalled_content":false,"_jetpack_feature_clip_id":0,"_jetpack_memberships_contains_paid_content":false,"footnotes":"","jetpack_post_was_ever_published":false},"categories":[121,13,113,37],"tags":[],"class_list":["post-59114","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-ai-governance-risk-management","category-blog","category-microsoft-agent-framework","category-microsoft-purview"],"jetpack-related-posts":[{"id":59280,"url":"https:\/\/www.cloudproinc.com.au\/index.php\/2026\/10\/20\/secure-ai-agents-safely-with-microsoft-purview-and-agent-framework\/","url_meta":{"origin":59114,"position":0},"title":"Secure AI Agents Safely with Microsoft Purview and Agent Framework","author":"CPI Staff","date":"October 20, 2026","format":false,"excerpt":"A practical CIO guide to using Microsoft Purview and Agent Framework to control data exposure, agent actions, audit trails and compliance without slowing useful AI adoption.","rel":"","context":"In "AI Governance & Risk Management"","block_context":{"text":"AI Governance & Risk Management","link":"https:\/\/www.cloudproinc.com.au\/index.php\/category\/ai-governance-risk-management\/"},"img":{"alt_text":"","src":"\/wp-content\/uploads\/2026\/10\/secure-ai-agents-safely-with-microsoft-purview-and-agent-framework.png","width":350,"height":200,"srcset":"\/wp-content\/uploads\/2026\/10\/secure-ai-agents-safely-with-microsoft-purview-and-agent-framework.png 1x, \/wp-content\/uploads\/2026\/10\/secure-ai-agents-safely-with-microsoft-purview-and-agent-framework.png 1.5x, \/wp-content\/uploads\/2026\/10\/secure-ai-agents-safely-with-microsoft-purview-and-agent-framework.png 2x, \/wp-content\/uploads\/2026\/10\/secure-ai-agents-safely-with-microsoft-purview-and-agent-framework.png 3x, \/wp-content\/uploads\/2026\/10\/secure-ai-agents-safely-with-microsoft-purview-and-agent-framework.png 4x"},"classes":[]},{"id":58777,"url":"https:\/\/www.cloudproinc.com.au\/index.php\/2026\/10\/12\/microsoft-purview-for-ai-agents-labels-dlp-and-audit-controls\/","url_meta":{"origin":59114,"position":1},"title":"Microsoft Purview for AI Agents Labels DLP and Audit Controls","author":"CPI Staff","date":"October 12, 2026","format":false,"excerpt":"Learn how Purview extends data labels, leak prevention and audit controls to AI agents, reducing risk without stopping useful automation.","rel":"","context":"In "AI Agents"","block_context":{"text":"AI Agents","link":"https:\/\/www.cloudproinc.com.au\/index.php\/category\/ai-agents\/"},"img":{"alt_text":"","src":"\/wp-content\/uploads\/2026\/09\/microsoft-purview-for-ai-agents-labels-dlp-and-audit-controls.png","width":350,"height":200,"srcset":"\/wp-content\/uploads\/2026\/09\/microsoft-purview-for-ai-agents-labels-dlp-and-audit-controls.png 1x, \/wp-content\/uploads\/2026\/09\/microsoft-purview-for-ai-agents-labels-dlp-and-audit-controls.png 1.5x, \/wp-content\/uploads\/2026\/09\/microsoft-purview-for-ai-agents-labels-dlp-and-audit-controls.png 2x, \/wp-content\/uploads\/2026\/09\/microsoft-purview-for-ai-agents-labels-dlp-and-audit-controls.png 3x, \/wp-content\/uploads\/2026\/09\/microsoft-purview-for-ai-agents-labels-dlp-and-audit-controls.png 4x"},"classes":[]},{"id":59126,"url":"https:\/\/www.cloudproinc.com.au\/index.php\/2026\/10\/16\/why-production-ai-agents-need-policy-enforcement-while-streaming\/","url_meta":{"origin":59114,"position":2},"title":"Why Production AI Agents Need Policy Enforcement While Streaming","author":"CPI Staff","date":"October 16, 2026","format":false,"excerpt":"Prompt checks alone cannot protect a business once an AI agent starts responding. Production systems need controls that inspect output, tool actions and data continuously.","rel":"","context":"In "AI Agents"","block_context":{"text":"AI Agents","link":"https:\/\/www.cloudproinc.com.au\/index.php\/category\/ai-agents\/"},"img":{"alt_text":"","src":"\/wp-content\/uploads\/2026\/10\/why-production-ai-agents-need-policy-enforcement-while-streaming.png","width":350,"height":200,"srcset":"\/wp-content\/uploads\/2026\/10\/why-production-ai-agents-need-policy-enforcement-while-streaming.png 1x, \/wp-content\/uploads\/2026\/10\/why-production-ai-agents-need-policy-enforcement-while-streaming.png 1.5x, \/wp-content\/uploads\/2026\/10\/why-production-ai-agents-need-policy-enforcement-while-streaming.png 2x, \/wp-content\/uploads\/2026\/10\/why-production-ai-agents-need-policy-enforcement-while-streaming.png 3x, \/wp-content\/uploads\/2026\/10\/why-production-ai-agents-need-policy-enforcement-while-streaming.png 4x"},"classes":[]},{"id":57439,"url":"https:\/\/www.cloudproinc.com.au\/index.php\/2026\/10\/12\/why-microsoft-is-racing-to-build-enterprise-safe-alternatives-to-openclaw\/","url_meta":{"origin":59114,"position":3},"title":"Why Microsoft Is Racing to Build Enterprise-Safe Alternatives to OpenClaw","author":"CPI Staff","date":"October 12, 2026","format":false,"excerpt":"OpenClaw has rapidly become the de facto open source framework for autonomous AI agents. Developers love it. The community is thriving. And it is fundamentally changing how organisations think about deploying always-on, self-evolving AI assistants. The problem is that OpenClaw was built for capability, not governance. And for the mid-market\u2026","rel":"","context":"In "AI Agents"","block_context":{"text":"AI Agents","link":"https:\/\/www.cloudproinc.com.au\/index.php\/category\/ai-agents\/"},"img":{"alt_text":"","src":"\/wp-content\/uploads\/2026\/04\/why-microsoft-is-racing-to-build-enterprise-safe-alternatives-to-openclaw-cover.png","width":350,"height":200,"srcset":"\/wp-content\/uploads\/2026\/04\/why-microsoft-is-racing-to-build-enterprise-safe-alternatives-to-openclaw-cover.png 1x, \/wp-content\/uploads\/2026\/04\/why-microsoft-is-racing-to-build-enterprise-safe-alternatives-to-openclaw-cover.png 1.5x, \/wp-content\/uploads\/2026\/04\/why-microsoft-is-racing-to-build-enterprise-safe-alternatives-to-openclaw-cover.png 2x, \/wp-content\/uploads\/2026\/04\/why-microsoft-is-racing-to-build-enterprise-safe-alternatives-to-openclaw-cover.png 3x, \/wp-content\/uploads\/2026\/04\/why-microsoft-is-racing-to-build-enterprise-safe-alternatives-to-openclaw-cover.png 4x"},"classes":[]},{"id":59123,"url":"https:\/\/www.cloudproinc.com.au\/index.php\/2026\/10\/15\/microsoft-agent-framework-python-1-21-and-net-1-24-readiness\/","url_meta":{"origin":59114,"position":4},"title":"Microsoft Agent Framework Python 1.21 and .NET 1.24 Readiness","author":"CPI Staff","date":"October 15, 2026","format":false,"excerpt":"The October releases improve control, isolation and compliance handling. But production readiness still depends on how your organisation tests, governs and operates each AI agent.","rel":"","context":"In "AI Agents"","block_context":{"text":"AI Agents","link":"https:\/\/www.cloudproinc.com.au\/index.php\/category\/ai-agents\/"},"img":{"alt_text":"","src":"\/wp-content\/uploads\/2026\/10\/microsoft-agent-framework-python-1-21-and-net-1-24-readiness.png","width":350,"height":200,"srcset":"\/wp-content\/uploads\/2026\/10\/microsoft-agent-framework-python-1-21-and-net-1-24-readiness.png 1x, \/wp-content\/uploads\/2026\/10\/microsoft-agent-framework-python-1-21-and-net-1-24-readiness.png 1.5x, \/wp-content\/uploads\/2026\/10\/microsoft-agent-framework-python-1-21-and-net-1-24-readiness.png 2x, \/wp-content\/uploads\/2026\/10\/microsoft-agent-framework-python-1-21-and-net-1-24-readiness.png 3x, \/wp-content\/uploads\/2026\/10\/microsoft-agent-framework-python-1-21-and-net-1-24-readiness.png 4x"},"classes":[]},{"id":59243,"url":"https:\/\/www.cloudproinc.com.au\/index.php\/2026\/10\/20\/microsoft-agent-framework-python-1-21-and-net-1-25-in-production\/","url_meta":{"origin":59114,"position":5},"title":"Microsoft Agent Framework Python 1.21 and .NET 1.25 in Production","author":"CPI Staff","date":"October 20, 2026","format":false,"excerpt":"Python 1.21 and .NET 1.25 add useful production controls, but safe AI agents still depend on disciplined testing, governance and upgrade planning.","rel":"","context":"In "AI Agents"","block_context":{"text":"AI Agents","link":"https:\/\/www.cloudproinc.com.au\/index.php\/category\/ai-agents\/"},"img":{"alt_text":"","src":"\/wp-content\/uploads\/2026\/10\/microsoft-agent-framework-python-1-21-and-net-1-25-in-production.png","width":350,"height":200,"srcset":"\/wp-content\/uploads\/2026\/10\/microsoft-agent-framework-python-1-21-and-net-1-25-in-production.png 1x, \/wp-content\/uploads\/2026\/10\/microsoft-agent-framework-python-1-21-and-net-1-25-in-production.png 1.5x, \/wp-content\/uploads\/2026\/10\/microsoft-agent-framework-python-1-21-and-net-1-25-in-production.png 2x, \/wp-content\/uploads\/2026\/10\/microsoft-agent-framework-python-1-21-and-net-1-25-in-production.png 3x, \/wp-content\/uploads\/2026\/10\/microsoft-agent-framework-python-1-21-and-net-1-25-in-production.png 4x"},"classes":[]}],"jetpack_sharing_enabled":true,"jetpack_featured_media_url":"\/wp-content\/uploads\/2026\/10\/how-to-guard-streaming-ai-agents-with-microsoft-purview-policies.png","_links":{"self":[{"href":"https:\/\/www.cloudproinc.com.au\/index.php\/wp-json\/wp\/v2\/posts\/59114","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.cloudproinc.com.au\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.cloudproinc.com.au\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.cloudproinc.com.au\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.cloudproinc.com.au\/index.php\/wp-json\/wp\/v2\/comments?post=59114"}],"version-history":[{"count":1,"href":"https:\/\/www.cloudproinc.com.au\/index.php\/wp-json\/wp\/v2\/posts\/59114\/revisions"}],"predecessor-version":[{"id":59115,"href":"https:\/\/www.cloudproinc.com.au\/index.php\/wp-json\/wp\/v2\/posts\/59114\/revisions\/59115"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.cloudproinc.com.au\/index.php\/wp-json\/wp\/v2\/media\/59116"}],"wp:attachment":[{"href":"https:\/\/www.cloudproinc.com.au\/index.php\/wp-json\/wp\/v2\/media?parent=59114"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.cloudproinc.com.au\/index.php\/wp-json\/wp\/v2\/categories?post=59114"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.cloudproinc.com.au\/index.php\/wp-json\/wp\/v2\/tags?post=59114"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}