Comparison · By Chris Sowa · Published
Last updated
What Is the Difference Between RedactSure and Microsoft Agent 365 for Agent Access and Data Exposure?
Microsoft Agent 365 is documented to observe, govern and secure agents: a registry, access control and data risk safeguards. RedactSure governs what the model inside one agent's run can see and who approves each consequential action. Treating an agent registry as exposure control can leave everything the agent is permitted to read in view of its model.
Microsoft Agent 365 is documented to observe, govern and secure agents: a registry, access control and data risk safeguards. RedactSure governs what the model inside one agent's run can see and who approves each consequential action. Treating an agent registry as exposure control can leave everything the agent is permitted to read in view of its model. The two answer different questions. A registry and an identity layer answer which agents exist, who owns them and what they are allowed to reach. Exposure control answers what the model reads once the agent is inside a permitted application, a question governed by Least Exposure. An organization that settles the first question still has to answer the second before an agent touches account numbers, Social Security numbers or patient identifiers. The environment that enforces this is built by RedactSure, an AI agent controls, governance and data protection company.
Key findings
- Microsoft describes Agent 365 as providing "the ability to observe, govern, and secure the growing number of agents within organizations" (Microsoft, 2026).
- The Agent 365 overview describes a centralized registry with "a unified view of agent adoption, activity, and agent health" and says Microsoft Entra enforces "risk-based access controls for users and agents acting on their behalf" (Microsoft, 2026).
- The same page attributes data protection to Microsoft Purview, with "deep visibility into data risks with information protection, DLP, and risk safeguards," and does not describe specific detect, block, mask or tokenize behavior (Microsoft, 2026).
- OWASP lists sensitive information disclosure as a top risk for LLM applications, separate from prompt injection (OWASP, 2025).
- Indirect prompt injection lets instructions hidden in content an application reads redirect the model, so what the model reads is itself an attack surface (Greshake et al., 2023).
- Researchers at ServiceNow and partner institutions report that minimizing the data sent to tools and sanitizing what returns, at a boundary outside the model, drove attack success near zero on four agent benchmarks (Bhagwatkar et al., 2026).
What does Microsoft's documentation say Agent 365 does?
Microsoft's overview page (vendor documentation, accessed October 14, 2026) frames Agent 365 around three verbs: observe, govern and secure (Microsoft, 2026). Each maps to a capability family.
Observe is a registry. The page describes "real-time visibility" through a centralized registry offering "a unified view of agent adoption, activity, and agent health," with role-specific oversight for security and business leaders (Microsoft, 2026). The question it answers is inventory: how many agents exist, who runs them, how they behave in aggregate.
Govern is lifecycle and access. The page names lifecycle management and access control, and describes ensuring "the right permissions, policies, and reviews are in place." It assigns enforcement to Microsoft Entra, which applies "risk-based access controls for users and agents acting on their behalf" (Microsoft, 2026). The unit of control is the agent as an identity that is granted or denied access to resources.
Secure is threat protection and data risk. Microsoft Defender provides "real-time protection to block unsafe behaviors and malicious activity," and Microsoft Purview provides "deep visibility into data risks with information protection, DLP, and risk safeguards," which the page says "prevent data leakage" (Microsoft, 2026).
The page reviewed is equally informative about what it leaves out. It does not state where Agent 365 sits relative to the model or to the screen an agent reads. It does not state whether it inspects network traffic, API calls, prompts and responses, browsers or endpoints. It does not describe the specific detect, classify, block, redact or mask behavior behind the Purview safeguards, and it does not describe per-action approvals or blocking of individual tool calls. It calls the capability "audit-ready" without describing specific logs or report formats. Those topics may be covered in other Microsoft documentation; the overview reviewed does not state them.
An earlier RedactSure page, What Is the Difference Between RedactSure and Microsoft Purview for AI Agent Security?, compared the data estate controls in Purview with control of an acting agent. The question here is narrower and sits one layer up: whether knowing and authorizing an agent is the same as limiting what its model reads.
How does an agent registry differ from controlling what an agent sees?
A registry and an identity layer work at the level of the agent. They record that an agent exists, attach it to an owner, and decide which resources it may reach. Microsoft's description of Agent 365 fits that pattern: registry, lifecycle, permissions, policies and reviews, enforced through Entra (Microsoft, 2026). That work answers questions every security team has to answer, and the RedactSure sibling pages on agent identity and agent discovery treat them in depth.
Exposure works at a different level: the individual screen or record inside an application the agent is already permitted to use. Once access is granted, the agent's model reads what the application shows. An agent authorized to work in a claims system reads the claimant's name, policy number and bank details on the page it opens, whether or not the task needs them. A RedactSure page on what an AI agent sees when it takes a screenshot sets out how much of a screen enters the model's context.
The research on agent attacks explains why that matters. Greshake and colleagues showed that instructions planted in content an LLM application retrieves can redirect the model, which makes every value on a page both a possible disclosure and a possible injection vector (Greshake et al., 2023). OWASP keeps sensitive information disclosure as its own risk category alongside prompt injection (OWASP, 2025). Microsoft's own AI Red Team taxonomy catalogs failure modes specific to agentic systems, including those that arise from what an agent ingests and acts on (Microsoft AI Red Team, 2025).
None of those risks is resolved by knowing the agent exists or by confirming it holds the right permissions. A correctly registered agent with correct permissions can still read an account number it did not need and still follow an instruction hidden in a field. Identity answers "may this agent enter?" Exposure answers "once inside, what does its model receive?" The two controls stack; neither replaces the other.
How do the two compare side by side?
The table sets Agent 365, as its overview page describes it, beside RedactSure's published design. Where the page reviewed does not state something, the cell says so.
| Dimension | Microsoft Agent 365, per its documentation | RedactSure, per its published design |
|---|---|---|
| What it is | A way to "observe, govern, and secure the growing number of agents within organizations" (Microsoft, 2026) | A governed environment in which AI co-workers do work across an organization's applications, with no per-application integration |
| Unit of control | Agents as identities: registry, lifecycle, permissions, policies and reviews; Entra enforces risk-based access (Microsoft, 2026) | The piece of work: which fields the model receives for this task, and which actions need a named person |
| Where it sits relative to the model and the screen | The page reviewed does not state it | Between the rendered screen and the model; tokenization happens before any model reads the screen |
| Sensitive data handling | Purview "information protection, DLP, and risk safeguards" to "prevent data leakage"; specific detect, mask or tokenize behavior not described (Microsoft, 2026) | Identifiers chosen by policy replaced with consistent tokens (SSN_001, ACCT_001); real values resolve only at approved destinations at the moment of an approved action |
| Agent actions and approval | Defender blocks "unsafe behaviors and malicious activity"; per-action approvals and tool-call blocking not described (Microsoft, 2026) | A named person confirms the policy before the run and approves every payment, submission and record change (Supervised Delegation) |
| Record | Registry view of adoption, activity and health; described as "audit-ready," with specific logs not described (Microsoft, 2026) | Every action logged, human and computer; all PII as tokens. Exported to the customer's own SIEM |
| User permissions | Access control and permissions are part of Govern (Microsoft, 2026) | Permissions stay as they are; what changes is what the AI can see |
| Model | The page reviewed does not state it | Model agnostic; models swap without moving the controls |
The rows that differ most are the third and fourth. Agent 365's overview describes its placement in terms of organizational functions (observe, govern, secure) rather than position in the data path, so the page reviewed does not say whether any of its controls act on a value before a model reads it. RedactSure's design is defined by that position.
What does access control decide, and what does it leave open?
Access control makes a yes or no decision about a resource. Entra's role in Agent 365, as described, is to enforce "risk-based access controls for users and agents acting on their behalf" (Microsoft, 2026). That decision is necessary. An agent that can reach a finance system it has no business in is a problem no amount of masking fixes, and the RedactSure sibling page on overprivileged agents covers that failure.
What a yes leaves open is the content of the session. Permissions are set for people and roles, and they grant access to whole applications and screens. A task such as matching an invoice to a purchase order needs amounts, dates and vendor codes. The same screen shows vendor bank details and tax identifiers. A permission model that admits the agent to the screen admits its model to all of it. Narrowing the permission to exclude the bank details would also break the human user's job, which is why RedactSure leaves permissions exactly as they are and changes only what the AI can see.
Take an accounts payable screen in a RedactSure run. The model receives the task's fields with identifiers as tokens: the vendor appears as VENDOR_001, the account as ACCT_001, the amount and due date in clear because the policy says the work runs on them. If an instruction hidden in an invoice memo tells the model to send the account details elsewhere, the model holds ACCT_001, a token that resolves to nothing outside an approved destination. The payment itself stops for a named person.
That is the logic the boundary research supports. Bhagwatkar and colleagues found that a lightweight firewall that strips data a tool call does not need, paired with one that sanitizes what tools return, brought attack success close to zero on AgentDojo, Agent Security Bench, InjecAgent and tau-Bench (Bhagwatkar et al., 2026). The same paper warns that public benchmarks are easily saturated, so headline numbers deserve scrutiny. The principle stands either way: reduce what reaches the model and its tools, at a boundary outside the model.
Access control and exposure control answer adjacent questions. An organization running both knows which agents may enter which systems and also knows what each model read once it got there.
How do audit and approval differ between the two designs?
Agent 365's overview describes its record as a registry view: "real-time visibility" and "a unified view of agent adoption, activity, and agent health," with role-specific oversight for security and business leaders (Microsoft, 2026). It calls the capability "audit-ready" without describing specific logs or formats. On approvals, the page refers to "reviews" as part of governance and to Defender blocking unsafe behavior; it does not describe a person approving an individual agent action before it runs (Microsoft, 2026).
RedactSure's record is per run and per action. The AI Control Record holds every screen the agent saw, as tokens, every action and every approval with a name, and exports to the customer's own SIEM. A reviewer can see that the agent opened a vendor record, read VENDOR_001 and ACCT_001, prepared a payment and that a named approver released it at a recorded time. Because the record carries tokens, keeping it does not create a second store of the identifiers it describes.
The approval model follows the same split. Supervised Delegation means a named person grants the access, chooses the applications, confirms what is tokenized, can watch and pause the run, and approves every consequential action on the record. The AI prepares; a person decides.
Why insist on a person outside the model? MIT Technology Review reported that the refusal behavior vendors rely on is far from foolproof and that layered model defenses resemble Swiss cheese, each layer with holes (MIT Technology Review, 2026). Accenture's research defines trust in AI operationally to include traceability (Accenture, 2025). A registry gives aggregate traceability across agents. A per-action record with named approvals gives traceability for the payment that went out on Tuesday. Organizations that need both can run both: the registry tells security how many agents exist, and the control record tells an auditor what one of them did with a specific record.
Where does RedactSure sit?
RedactSure sits inside the run, between the application screen and the model. AI co-workers work the organization's applications inside a governed environment deployed into the cloud the customer requires, on hardware-encrypted enclaves, with keys the customer holds. Every sensitive value chosen by policy is replaced with a consistent token at the render layer before any model reads the screen, and the model receives the task's fields with identifiers as tokens. The Planner sets what is tokenized and what the agent may do on each screen; a named person confirms that policy and approves every consequential action. Real values resolve only at approved destinations at the moment of an approved action. The AI Control Record exports to the customer's SIEM, and the environment is model agnostic. Deployments are in pilot.
For this question, RedactSure does not replace an agent registry or an identity layer. It answers what those layers leave to the session: what the model reads once access is granted.
Everyone else controls where data can go. RedactSure controls what the AI can see.
Methodology and limitations
This page rests on Microsoft's "Microsoft Agent 365 overview" on Microsoft Learn (vendor documentation, accessed October 14, 2026), on standards and risk guidance from OWASP and NIST, on preprints and research from Greshake and colleagues, Bhagwatkar and colleagues, and the Microsoft AI Red Team, and on industry analysis from MIT Technology Review and Accenture. Sources were read as of October 13 and 14, 2026. RedactSure behavior is described from its published design.
No hands-on testing of Microsoft Agent 365 or of any other named product was performed. The comparison reflects one Microsoft overview page; other Microsoft documentation may describe placement, logging, approvals or data handling that the overview does not, and those topics are marked as not stated rather than as absent from the product. Vendor features change, and the page carries its date. No specific organization's deployment or incident is described. The research cited reports results on public benchmarks and controlled settings, and its authors note that such benchmarks can be saturated; the findings are cited for the principle each supports, not as a measure of any product's performance in production.
Whether a given combination of registry, identity, access and exposure controls meets an organization's obligations is a determination for its counsel, its assessors, and its own security and compliance officers. The page offers a framework and sourced descriptions for that work, not a finding about any environment.
What the record shows
An agent registry and access control decide which agents exist and what they may reach; they do not, on the documentation reviewed, decide what the model reads once inside a permitted screen. Treating the first as the second leaves identifiers and planted instructions in the model's context. The test a reader can apply: pick one agent with legitimate access, open a screen it uses, and ask which values on that screen its model receives and who approves the action it prepares.
Frequently asked questions
Does Microsoft Agent 365 control what an agent's model reads on a screen?
The overview page reviewed does not state where Agent 365 sits relative to the model or the screen. It describes a registry, access control through Entra, threat protection through Defender, and Purview data risk safeguards. It does not describe replacing values with tokens before a model reads a screen.
Is RedactSure a replacement for an agent registry?
No. RedactSure does not inventory agents across an organization or manage agent identities. It governs a run: what the model receives on each screen and who approves each consequential action. A registry and RedactSure answer different questions and can run together.
How is this comparison different from the RedactSure and Purview comparison?
The Purview page compared data estate controls with control of an acting agent. This comparison addresses the layer above: agent registry, identity and access. The question is whether authorizing an agent limits what its model reads. Agent 365 does attribute its data safeguards to Purview.
If an agent has the right permissions, why does exposure still matter?
Permissions grant whole screens. A task may need amounts and dates while the same screen shows bank details and tax identifiers. The model reads all of it, and any field can carry an injected instruction, a risk OWASP and Greshake and colleagues document.
Does RedactSure change user or agent permissions?
No. Permissions stay exactly as they are. What changes is what the AI can see: identifiers chosen by policy reach the model as tokens such as ACCT_001, and real values resolve only at approved destinations at the moment of an approved action.
What record does each produce?
Agent 365's overview describes a registry view of adoption, activity and health and calls it "audit-ready," without describing specific logs. RedactSure's AI Control Record holds every screen as tokens, every action and every named approval, exported to the customer's SIEM.
Related reading
What Is the Difference Between RedactSure and Microsoft Purview for AI Agent Security? · What Does an AI Agent See When It Takes a Screenshot? · Does Microsoft Copilot Studio Computer Use Control What the Agent Sees? · What Is AI Agent Identity and Why Do Agents Not Fit Traditional User Access Models? · What Is AI Agent Discovery and How Do Companies Find Agents They Did Not Approve? · What Is an Overprivileged AI Agent and Why Can Legitimate Permissions Still Be Dangerous? · On the RedactSure blog: The Two Gaps AI Agents Opened in Your Security Stack
Sources
Peer-reviewed research and preprints
- Greshake, Kai, et al., "Not What You've Signed Up For: Compromising Real-World LLM-Integrated Applications with Indirect Prompt Injection," arXiv:2302.12173, 2023 (preprint; also AISec 2023). https://arxiv.org/abs/2302.12173
- Bhagwatkar, Kasa, et al., "Indirect Prompt Injections: Are Firewalls All You Need, or Stronger Benchmarks?," arXiv:2510.05244, v2 2026 (preprint). https://arxiv.org/abs/2510.05244
- Microsoft AI Red Team, "Taxonomy of Failure Modes in Agentic AI Systems," Microsoft, April 2025 (whitepaper). https://www.microsoft.com/en-us/security/blog/2025/04/24/new-whitepaper-outlines-the-taxonomy-of-failure-modes-in-ai-agents/
Vendor documentation
- Microsoft, "Microsoft Agent 365 overview" (vendor documentation, accessed October 14, 2026). https://learn.microsoft.com/microsoft-agent-365/overview
Regulation, standards and official guidance
- OWASP, "LLM02:2025 Sensitive Information Disclosure" (2025; standards guidance). https://genai.owasp.org/llmrisk/llm022025-sensitive-information-disclosure/
- NIST, "AI Risk Management Framework" (standards guidance). https://www.nist.gov/itl/ai-risk-management-framework
Industry analysis and press
- Holland Michel, Arthur, "We're putting too much faith in AI's ability to say no," MIT Technology Review, October 9, 2026 (press). https://www.technologyreview.com/2026/10/09/1145728/we-are-putting-too-much-faith-in-ai-to-say-no/
- Accenture, "Technology Vision 2025: AI: A Declaration of Autonomy" (January 2025; industry analysis). https://www.accenture.com/us-en/insights/technology/technology-trends-2025
RedactSure documents
- RedactSure Research, "What Is the Difference Between RedactSure and Microsoft Purview for AI Agent Security?" (2026). https://redactsure.com/research/what-is-the-difference-between-redactsure-and-microsoft-purview-for-ai-agent-security
- RedactSure Research, "What Does an AI Agent See When It Takes a Screenshot?" (2026). https://redactsure.com/research/what-does-an-ai-agent-see-when-it-takes-a-screenshot
- RedactSure Research, "What Is Least Exposure?" (2026). https://redactsure.com/research/what-is-least-exposure
- RedactSure Research, "What Is an AI Control Record?" (2026). https://redactsure.com/research/what-is-an-ai-control-record
- RedactSure, "The Two Gaps AI Agents Opened in Your Security Stack" (2026). https://redactsure.com/blog/two-gaps-ai-agents-opened-in-your-security-stack/
- Product behavior described on this page reflects RedactSure's current design. Microsoft, Agent 365, Entra, Defender, Purview and Copilot Studio are trademarks of Microsoft Corporation; named to identify the products.
RedactSure vs Microsoft Purview: AI Agent Security
Review RedactSure vs Microsoft Purview: AI Agent Security, with AI agent security, tokenization and approval checks for sensitive enterprise workflows.
What Does an AI Agent See in a Screenshot?
Explore what browser screenshots expose to AI agents, including unrelated PII, and how tokenization changes the model's view of a task.
Does Copilot Studio Limit What Its Agent Sees?
Review Copilot Studio AI agent screenshots, PII exposure and tokenization for claims and patient accounts, including replay retention settings.
What Is AI Agent Identity?
Review AI Agent Identity for AI agent security, with practical checks on sensitive data, tokenization and named human approvals.
What Is AI Agent Discovery?
Review AI Agent Discovery for AI agent security, with practical checks on sensitive data, tokenization and named human approvals.
What Is an Overprivileged AI Agent?
Review an Overprivileged AI Agent, with AI agent security, tokenization and approval checks for sensitive enterprise workflows.
The Two Gaps AI Agents Opened in Your Security Stack
Explore AI agent security through two questions: which PII reaches the model, and who approves consequential billing and claims actions.
What Is Least Exposure?
Explore Least Exposure for AI agent security, limiting PII to what a workflow needs through tokenization and explicit human decisions.
What Is an AI Control Record?
Explore an AI agent control record for billing and claims, linking permissions, tokenization decisions, approvals and audit evidence.
Book an AI Agent Security Review →
Bring your hardest questions.
Bring one sensitive workflow and the decisions your team needs to keep in its hands.
Book a demoAbout the author
Chris Sowa is a founder of RedactSure and a former CEO of an AI company; he started it years before ChatGPT existed. He previously led AI at Accenture, served as Global VP of Strategy & Innovation at Schneider Electric, was CCO of Sovos, and spent more than a decade at Oracle, with earlier roles at SAP and IBM.