AI Governance

Govern AI as you
govern everything

Every AI agent and Azure AI deployment adds identity risk and configuration risk to your estate. Bring both into the same risk-driven platform you already use for the rest of your Microsoft cloud.

START FOR FREEREQUEST DEMO

14-day free trial · 2 min setup · No credit card required

TENET — AI Governance
Agent identities
Support Copilot
Copilot Studio · Tenant-wide
High
Operations Agent
Copilot Studio · No sponsor
Medium
AI resource posture
text-embed-ada
No content filter policy
High
gpt4-prod-eu
Local auth enabled
Medium
Two Risk Surfaces

Two risk surfaces

AI adoption creates risk in two places at once: the identities behind your AI agents, and the configuration of the Azure AI resources they run on. TENET governs both.

Agent Identity Security

Inventory every AI agent identity in your tenant, including those from Copilot Studio and Azure AI Foundry, connect each one to its owner and human sponsor, and understand its permission reach and access scope.

Explore Agent Identity Security

AI-SPM

Audit the configuration of every Azure AI resource — public network exposure, authentication settings, content filter policy, quota pressure, and encryption and key management.

Explore AI-SPM
Identity risk

Know who owns every AI agent

AI agents from Copilot Studio, Azure AI Foundry and Microsoft Agent 365 are non-human identities with real permissions and data access. Left ungoverned, they accumulate access quietly, with no clear owner.

LEARN MORE
AI Agent Identities — Tenant Inventory3 IDENTITIES
2
Sources
Tracked
Ownership
Scoped
Access
Support Copilot
Copilot Studio · Tenant-wide
High
Finance Analyst
Azure AI Foundry · Scoped
Low
Operations Agent
Copilot Studio · No sponsor
Medium
Agent Identity Risk Signals
No assigned owner
Surface agent identities without an accountable owner.
No human sponsor
Identify agents that do not have a named human sponsor.
Broad tenant-wide grants
Flag access granted across the tenant instead of a narrow scope.
Sensitive permissions
Bring attention to agent identities that can reach sensitive permissions or data.
What TENET surfaces

Governance gaps around every agent

Risk is tied to identity ownership and access: who is accountable, what the identity can reach, and whether access is broader than it needs to be.

LEARN MORE
Configuration risk

Close AI configuration gaps

An AI agent is only as secure as the Azure AI resource it runs on. Public endpoints, key-based authentication, and unmanaged encryption keys all widen the attack surface, independent of what the agent itself is doing.

LEARN MORE
Security Controls Audit2 RISKS
gpt4-prod-eu
Local Auth Disabled
Key-based auth is disabled. Entra ID managed identities only.
Network ACL: Deny default
Public network access requires explicit IP allowlisting.
text-embed-ada
Local Auth Enabled
API key auth is active. Keys can be exfiltrated without Entra visibility.
Network ACL: Allow default
Endpoint is reachable from any IP. Restrict to trusted CIDRs.
Content Filter Policy Audit
gpt4-prod-euConfigured
Microsoft.DefaultV2
gpt35-turbo-batchConfigured
CustomPolicy-Batch
text-embed-adaNo Policy
No policy configured
What TENET audits

Automated configuration guardrails

See which deployments have content filter policies, track blocked requests, and find unprotected deployments. TENET also flags resources with no audit logging and models that are deprecated or near end of life.

LEARN MORE
Quota pressure

Flag deployments running close to their token or request quota, since capacity pressure is itself a posture risk.

Encryption and key management

Check whether keys are customer-managed or platform-managed.

Clear scope

Govern identity and configuration

TENET applies identity governance and posture management to AI agents and Azure AI resources.

AI governance scope
AI agent identitiesGoverned
Azure AI resource postureGoverned
Suspicious agent sign-insFlagged in Identity Threat Detection
Prompts and outputNot monitored
Business Benefits

Benefits of governing AI in TENET

Reduce AI-native attack surface
Close configuration gaps and identity gaps before they are exploited, instead of discovering them after an incident.
Close the ownership gap
Find ownerless, unsponsored agent identities accumulating unmanaged access across the tenant, and track the fix.
One view of AI risk
See agent identity risk and AI configuration risk in the same risk-driven platform as the rest of your Azure and Microsoft 365 estate.
Build trust in AI adoption
Give leadership and customers a defensible answer to how AI agents and AI services are governed.

FAQs

What does "AI governance" mean in TENET?
It covers two things: identity governance for AI agents in your tenant, including those from Copilot Studio, Azure AI Foundry and Microsoft Agent 365 (ownership, sponsorship, permission reach, and access scope), and security posture management for the underlying Azure AI resources (network exposure, authentication, content filter policy, quota pressure, and key management). Together, these are the identity and configuration risks that come with adopting AI on Microsoft cloud.
Does TENET monitor what my AI agents say or do?

No. TENET governs the identity and access of AI agents and the configuration of the Azure AI resources they run on. It does not monitor conversation output or prompts, although suspicious agent sign-ins are flagged in Identity Threat Detection.

Read more about Identity Threat Detection.

How is this different from AI for IT Ops?

AI for IT Ops is about using AI internally, inside TENET, to help your team detect, investigate, and resolve risk faster. AI Governance is the opposite direction: governing the AI agents and Azure AI services your organisation has deployed, so they don’t become an ungoverned risk surface themselves.

Read more about AI for IT Ops.

What counts as an AI agent identity?

Any agent identity registered in your tenant, including through Copilot Studio, Azure AI Foundry or Microsoft Agent 365. TENET inventories these the same way it inventories human and other non-human identities, tracking ownership, sponsorship, and what permissions and data each one can reach.

Read more about agent identity security.

What Azure AI services does the posture side cover?

Azure OpenAI, Cognitive Services, Azure AI Search, Azure Bot Service, and other Azure AI resources connected to your tenant, audited for network exposure, authentication configuration, content filter policy, quota pressure, and key management.

Read more about AI security posture management.

Explore AI-Performance Monitoring →

Bring AI into your governance

See ownership, access, and configuration risk across every AI agent and Azure AI resource in one place.

FREE ASSESSMENTREQUEST DEMO

No credit card required. Connects to Azure and M365 in minutes.