Ironclad Manufacturing's CISO wants a weekly report showing which AI agents are being used across the organization, how many sessions each agent handled, and which data sources each agent accessed. The security team specifically wants to identify any agents that accessed sensitive production data stores. Which Microsoft 365 feature provides this agent activity visibility?
Select an answer to reveal the explanation.
Short Explanation and Infographic
Agent 365 is your agent operations center — it gives you visibility into which agents ran, how often, and what data they touched. Think of it as the security camera system for your agent fleet. The M365 usage reports show Copilot user adoption, not agent-level data access details.
Full explanation below image
Full Explanation
Agent 365 includes dedicated activity monitoring capabilities that surface agent-level telemetry: which agents are deployed and active, session volumes and frequency, and data sources accessed by each agent during execution. This is specifically designed for the 'agent fleet oversight' scenario that security teams and CISOs need — particularly the ability to identify agents accessing sensitive data stores, which is a key compliance and security concern.
Option A is incorrect because while Microsoft Purview Audit (Premium) captures a broad range of audit events including some agent-related activities, it requires manual log querying and does not provide the purpose-built agent activity dashboard or data-access categorization that Agent 365 monitoring provides. It's also not the Microsoft-recommended primary tool for this use case.
Option C is incorrect because Microsoft Sentinel is a SIEM/SOAR platform requiring significant setup, custom workbooks, and log connector configuration. While it can be integrated with Microsoft 365 audit logs for advanced threat detection, it's not the right first-line tool for operational agent monitoring. Agent 365 provides this out of the box.
Option D is incorrect because the Microsoft 365 Copilot usage report focuses on USER adoption metrics — which users are using Copilot, in which apps, and how frequently. It does not provide agent-level breakdowns, session details per agent, or data source access patterns for individual agents.
Exam tip: The exam distinguishes between Copilot usage reports (user adoption focus, in M365 admin center) and Agent 365 monitoring (agent activity, session counts, data access — in the Agent 365 portal). Know which tool answers which question.