Welcome to episode 415
of the Microsoft Cloud IT Pro podcast recorded
live from Microsoft Ignite on 11/18/2025.
This is a show about Microsoft '3 65
in in Azure from the perspective of IT
pros and end users, where we discuss a
topic or recent news and how it relates
to you. It's Microsoft Ignite week. So, surprise,
surprise, we have an Ignite show for you.
Unfortunately,
Scott wasn't able to join Ben at Ignite
this week. So Scott is recording from home
while Ben is bringing you all the live
action from Ignite. Hopefully, we'll get Scott back
out here next year. But, in this episode,
we cover a bit of the theme of
Ignite this year, how Ignite announcements have kinda
changed over the years, and of course, a
couple of the big announcements
focused around Microsoft Security Copilot and Microsoft Agent
three sixty five. Let's dive into the show.
Welcome, Ben, to
Ignite
twenty twenty five. Made it to another one.
We get to listen to a congested Ben
who's been on flights
and traveling across the country to get all
the way out to Ignite for us and
be our remote reporter this year. Our boots
on the ground as it were. And Scott
waking me up early because
I'm on the West Coast now. Well, you're
still on East Coast time. So I am
I am still on East Coast time, but,
yes, my alarm went off. Well, it is
8AM for me and 5AM for you. Let's
be honest. It's really still 8AM for you
until probably Wednesday or Thursday when you finally
Yeah. Crash out and come back the other
way. I adjusted probably quicker than I thought
I would because I took a late flight
in Sunday night. So I didn't get to
my hotel till, like, 10PM West Coast time
Sunday night. And then I was out late
last night because it's ignite and it's friends
and it's
dinners and parties and all the things.
So realistically, I didn't go to bed last
night until, like, ten or 11PM West Coast
time. I did set an alarm this morning
in 04:45
or 04:30, whenever it went off. Felt early.
Alright. Well, let's get you through this and
get you back to bed soon. Meetings and
I can go take my nap. I'm gonna
go take a nap after this before the
keynote. You can go take take a nap
before Judson's keynote and get that out there.
So
Ignite this year, interesting one. We continue to
see a lot of AI
AI. I don't think there's any big surprises
there
And security, yep, with AI. I would say,
like, those two. Yeah. That is partly AI.
But I don't know like, we got the
book of news. Right? And I was talking
to other people about this last night too
because
a lot of us got a little bit
of a preview of what's coming.
And it really is. It's like AI and
security people are like, there's like
no big
SharePoint stuff, no big Teams stuff, nothing around
Teams devices.
Like, if you go look, I don't know
that there's anything
like
loop or I just look for loop. Loop
is mentioned once in the entire book of
news and it's not a product loop. It's
looping
between
different things. There was a little bit of
a like
Ignite is not like where's all these other
products that Microsoft has
because it's really focused
on
AI and security and really security is still
focused on AI because there's not there's a
couple things I saw in here from a
security device management
Intune perspective that wasn't AI, but it was
very limited and few and far between. I
mean, we'll get into some of these announcements.
I think it could be two things. One,
rapid release cadence. Right? The cloud makes it
different. People are not gonna be holding back
SharePoint announcements for six months and not coming
out with anything
between
April and November or May and November
just to have a whole big splash of
announcements at Ignite.
So I feel like Ignite is turning into
I don't know if I'd call it a
Microsoft trade show, but it's not as much
focused, I don't think, on big announcements because
of rapid releases of the cloud. And as
such, you don't see
maybe as many of those things because nothing's
been held back to have a big release
about here's everything coming to SharePoint in the
next year because you've gotten it trickle out
over the last six months. I look at
it in a couple of different ways. You
mentioned trade show. Absolutely. Like, there's tons of
partners there. I think if you go into
the Expo Hall any given year, and this
year It's big this year. I walked through
it already. Yep. There's a ton of partners
in there, tons of kinda partner stories and
how they integrate into the ecosystem. To your
point about things trickle out over the course
of time, like, just when they're ready, let's
put them out there. I think that is
very much true. That's certainly the approach, like,
within my organization. Like, we don't hold things
back. We wanna put it out there. But
Ignite, for me at least, and for my
team, and my product managers, and for my
peers,
It's our opportunity to come together and tell
a story. So here's all these things that
we have released over the course of the
last six months,
but, you know, you saw them as this
thing and this thing. How does it all
actually compose and come together? Because I think
every time, we'd love to push everything out
there all at once, but that's just not
the way release cadence works and everything else
comes together. So yeah. So I think what
we can do for
this one is we're kinda going through things
rather than just doing, like, a rundown of
the random news and kinda smattering of things.
Given that there's this large focus on AI,
I think there's also an undercurrent
and a little bit of thematic flow here
to
things like security,
governance,
manageability
of your workloads,
and for these AI clients and AI agents
that exist out there. Like, more and more
as IT pros, developers who are involved in
this ecosystem of
Azure and Microsoft three sixty five, you are
either going to be building these things, you're
gonna be managing them, or you're certainly gonna
be encountering them as a user. So I
think understanding
what some of those constraints are, what some
of the tools that are available to you.
Like, I know, like, every single day, there's
a new article that comes out that says,
hey. Here's how an MCP server was jailbroken,
or
it leaked something out there, or it did
something weird. Like, you sent me an article
a couple days ago about MCP horror stories,
WhatsApp data exfiltration. Right? Like, so so so
these things are very real. Like, they sit
out there. They run-in your environments.
They're often running under identities
that
you might not even have known existed depending
on your governance system and what happened. So
what I was thinking we could do today
is focus on
some of these security
governance
management constructs that are out there that are
going to help IT pros and developers
kinda come together and think about ways that
they can start to,
if they haven't already,
embrace this change. Like, it is coming. It's
it's it's gonna be pushed on you one
way or another, and the the only way
out is through. So let's go ahead and
kind of embrace it, get back to our
roots, and think about how to do some
of that stuff. So to your point of,
like, loops not in the book of news,
like, well, we're not gonna spend a lot
of time on, like, fuzzy stuff or maybe
things that have been out there before. I
just wanna kinda focus on a couple of
high level points that'll help guide folks in.
Like, if you are an IT pro, if
you're a developer who's interested in managing these
things, having a more kinda secure state
for these AI agents, AI workflows in your
environment,
what are the tools that are available to
you both today, and then what are the
things that are coming? And I think that's
what it what Ignite is good for is
also saying, like, hey. Back to that whole,
let's tell the story around all the things
that are already there. There's absolutely new things
coming as well that are gonna be tacked
on to that and continue to extend that
over the the next several
months to a year depending on how things
go and rollouts and everything else that's out
there. So being those themes, security, governance, manageability,
why don't we start
with security? I think there's some goodness coming
for Security Copilot, so maybe we can start
with that one. Quick before I get into
that, I think even looking through the book
of news, it's similar to what you said
where as we looked through it, you could
pull out new releases or new features. But
if you combine all those new features together
in the book of news, I think it
does start to tell a story this year
about kinda what Microsoft's focus is, particularly around
agents and security. So it is. It's not
just feature releases, but if you kinda combine
all of them together, like, what are they
coming out with in all these different products?
It's like, oh, there is very much a
theme here, I felt like, to some of
this. But like you said, with
Security Copilot, this one's an interesting one. I
want to see more articles around this particular
one and this one specifically
because when I read the book of news,
I was like, I think I know what
this means,
but I'm not
a 100%
sure.
So
this starts out and it talks about Security
Copilot and new Security Copilot agents. So there's
12 new Security Copilot agents that are gonna
built into Defender that are coming
around Entra, Intune,
Purview.
Some of these are available in Preview now.
There's also gonna be 30 new agents coming
from partners
to help tie more agents into security copilot,
help with your sock, with your identity, with
data security.
But then as you get through this,
down under, like, all these announcements around agents
again, we're talking about security copilot. Everybody's like,
well, I can't afford $90 a year for
security copilot or a 120 or Microsoft's base
recommendation isn't there.
It says to help security teams get started
with agents more quickly,
Security Copilot will be available to all
Microsoft three sixty five e five customers.
Rollout Stouts starts in
Frontier, which is kinda like Microsoft's insider ring
now for Copilot. I recommend that folks go
sign up for that one. At least have
one person in your org. Like, go and
click that button and fill out that form,
and sign up for the Frontier program if
you haven't.
Yep. Coming out in the coming months. This
is interesting. Right? Security Copilot is technically already
available for e five customers. You just have
to pay for it. Does this mean I
think this is a lot about, like, the
agents that are coming out. So we were
chatting a little bit about this before we
started recording. So particularly with
remote hosted agents, so they're running compute, often
GPU as well, to be able to
respond to LLMs, pull in their context windows,
all these kinds of things. So, like, it's
very nice when there's things like remote MCP
servers there. I don't know what the runway
is for all SaaS and service providers
to continue to provide remote MCPs for free,
but certainly enjoy them while they're here
and the functionality that you get with them
Yeah. And things like that. So I imagine
some of this is like you mentioned, there's
10 plus new agents coming to Security Copilot.
So these are baked agents ready to go,
purpose built. So there's
the governance agent, there's the IT,
the ID security agent, and then you're gonna
be able to build your own agents on
things like the Graph SDKs, on top of
the Microsoft three sixty five agent ID SDK
and the agent SDK, all these different things
that are out there. So these all take
resources, and those resources
today are very finite. Like, GPUs are not
running around, like, freely available still. Like, it's
not like we're all just going into, like,
our local micro center or Best Buy or
whatever and able to get, like, the hottest
and latest GPU, and certainly not for data
center providers either. So I I imagine part
of this is both enable the licenses,
but make sure that you can push down
the functionality
in a measured way and get it out
there so that you can start to understand,
like, literally, what's the size of the fleet
that I need to run
for resources on the back end, for compute,
GPU, memory, networking,
all those kinds of things to to get
them to where they need to be? I
think the more interesting thing will be, does
a shoe drop here, because we've seen this
a couple times in Microsoft three sixty five
land, where experiences come out built around AI
experiences, like Copilot, things like that, where
they've started let's take m three sixty five
Copilot as an example. When it came out,
it was an add on SKU. Like, go
pay an extra $30 per user per month.
And now some of that functionality has started
to trickle down into the regular m three
sixty five SKUs without an additional add on.
That said, those SKUs got incrementally a little
bit more expensive.
So I wonder if this is kinda just
sign of the times for e fives where
they've been quite baked for a while now,
and you've had a good set of add
ons, but those add ons really added up.
I mean, you can get to a 100
plus dollars a month per user per month
very quickly, even in e five land. I
wonder if this is just let's start to
push down some of that basic functionality,
figure out over time what those costs are,
what the material benefit is to customers versus
service provider and Microsoft and things like that,
and where it all bakes out. I saw
this when you pointed it out to me.
I kinda giggled in the back of my
head, and I said, well, e fives, enjoy
your current run rates while they're there until
your next renewal because it's probably gonna be
$2, $3, whatever,
US dollars a month more. Yeah. And this
is what I would say to keep an
eye on because I'm curious too, like, are
they going to bring
like, is the SCU
as we know it going to go away
because it's gonna be bundled with e five
and it's gonna be
there or is it going to be Right.
Or is it gonna be like these agents?
We're gonna give you like Security Copilot
lite. There's gonna be a reduced version where
you can leverage these agents in Intune and
Defender
for some of that. But you're not gonna
get like the full blown let me go
query everything in Sentinel
with Security Copilot
and build out the full blown security
experience. So this is when I would say
Again, we're recording this before the announcements, so
so we're using it from the book of
news. By the time you hear this on
Thursday,
the things we're gonna be talking about are
gonna be out in the public. There's gonna
be more blog posts about it. There's gonna
be sessions about it. I would go back
and look at this one especially if you're
interested in Security Copilot.
There are three breakout sessions around this
four, around
Security Copilot protect at the speed and scale
of AI, transform security with IT Security Copilot
agents,
AI powered data security,
predictive SOC, and then what are on building
the SOC of the future. So there's gonna
be some things that I would go watch
if you're interested in this to see
how all of this shakes out and what
the coming months are gonna look like for
Security Copilot.
Do you feel overwhelmed by trying to manage
your Office three sixty five environment? Are you
facing unexpected issues that disrupt your company's productivity?
Intelligink is here to help. Much like you
take your car to the mechanic that has
specialized knowledge on how to best keep your
car running, Intelligent helps you with your Microsoft
cloud environment because that's their expertise.
Intelligent keeps up with the latest updates in
the Microsoft cloud to help keep your business
running smoothly and ahead of the curve. Whether
you are a small organization with just a
few users up to an organization of several
thousand employees,
they want to partner with you to implement
and administer your Microsoft cloud technology.
Visit them at inteliginc.com/podcast.
That's intelligink.com/podcast
for more information or to schedule a thirty
minute call to get started with them today.
Remember, Intelligink
focuses on the Microsoft cloud so you can
focus on your business.
When I think about Security Copilot, maybe I'm
always a little simplistic about it. So I
always kinda think about it first as
Sentinel
and then Intune
and then Entra. Like, hey. Let's kinda wrap
those three things together.
But that actually doesn't cover the whole suite
of things because Security Copilot is also Defender,
and then it's also Purview. So the way
Microsoft frames it, like, if you were gonna
go out and try and figure out, like,
hey, which pillars do all these fit fit
into, is you've got security operations. So we
talked about SOC stuff and all these sessions
being focused on SOC. So security operations is
really Defender and Sentinel. That's it. Done. Out
the door.
Data security is Purview. Great. Let's manage things,
have DLP, all that kind of stuff. Identity
and access control, Entra, and then endpoint management
with Intune. But you do have those kind
of four buckets of security operations, data security,
identity and access, and endpoint management to get
through. So I wonder over time if maybe
some of that kind of functionality or what
comes in the free versus the paid or
not the free, but the included versus the
paid. E five version versus yeah. Is like,
do you get Security Copilot with Sentinel, but
maybe you're missing some things in Purview? Do
you get Security Copilot with Entrance Sentinel, but
But then maybe you're missing some things in
Intune. I don't know how that's gonna bake
and what it's gonna come out like. I
do think at some point, like, you're not
gonna see it all there for free. So
the number of signals that Sentinel pulls in,
it's all stored in Kusto and things like
that. It's not free to run those queries
and get all that stuff up and running,
especially when you're talking about, like, a large
scale environment, maybe with tens of thousands of
users. That could be billions of signals, if
not trillions, coming into your environment that you
have to need to filter and sort through.
Like, sorry, folks. Like, that stuff ain't free,
but It's not. We'll see where it bakes
out. I think it is a good one
for
folks who are either in Security Copilot land
today. Like, hey. There's some niceties here for
you. Like, there's new agents. There's new things.
Not a lot probably changes for you. But
if you're an e five customer who hasn't
adopted the Security Copilot,
even if it is a little bit of
a
mixed offering where maybe it doesn't include all
the pillars or have all those things, I
still think there's gonna be a bunch of
value there. And it's gonna start to get
you into this ecosystem back to that theme
around, like, hey, what's here for you as
an IT pro? Sentinel is not just the
discovery components or security copilot. It's not just
the discovery stuff. There's also manageability aspects and
other things that are important to think about
there. Yeah. And to your point about signals,
in here it talks about Microsoft,
their threat intelligence is informed by over 100,000,000,000,000
daily signals.
So, yeah, it's not cheap or free to
run this because that's a lot of daily
signals to process. A little bit here and
there. Yeah. So I I mean, like the
like I said, there there's goodness there. I
think there's things to watch for. Like, if
you're somebody who's listening to this and you're
like, oh, that sounds interesting, and you didn't
attend Ignite or maybe you wanna come back,
like, check out the show notes. We'll have
links in there to the breakouts and and
things like that so you can go back
and watch the recordings. We kinda I think
most companies, at least in The United States,
had a slow period here as we get
into, like, Thanksgiving and Christmas, things like that.
Like, hey. Maybe this is your chance to
catch up on some learning and figure out
what's out there. Yeah. So with Security for
Copilot, we talked about agents, all the agents
coming. We also recognize that there has been
a bit of a gap here with managing
certain things in Microsoft March.
Right? Like, people are adding agents or adding
agents and agents
and Microsoft is adding agents. And I've started
having these conversations with customers that are like,
well, how do I govern agents? How is
my agent security configured? They're unregovernable. Yeah. Store.
That's not right. How do I manage agents?
All these things, like, the last couple years
have been all about Copilot.
I feel like this year is all about
agents. Like, we have these security agents that
are accessing a bunch of security data.
How do we govern these types of agents
and know what they're accessing or maybe put
certain controls in place because
security? I think it's less about, like, like,
the built in agents than it is about
the custom ones that come or, let's say,
your finance department or your sales team is
working with Salesforce and you use Salesforce CRM,
and you adopt their agent, and somebody in
sales goes and just clicks next on a
SaaS product that was maybe And gets it
all out there. A little wily in your
environment, and then that has the ability to
get configured. And then what does it have
access to, and what's it have going on?
Like, it's one thing to hear an MCP
horror story about, like, WhatsApp data exfiltration. Tell
you what, it's gonna be another one to
hear about a a Salesforce
CRM horror story when all of a sudden,
like, all your sales records leak or all
your contacts or things like that. So for
this one, I think It's the security copilot
agents, like, the 30 agents that third parties
are adding. So I agree with you. It's
not necessarily Microsoft agents. It's agents are coming
everywhere from third parties. I think you need
to think about those. So so there's always
been the shadow IT thing. And businesses
and organizational units and divisions are always gonna
go out and what do what they do.
I think it is more important than ever
to be vigilant about these things and understand
what's running in your environment,
who's it associated with, who are the users
that use it, all those kinds of things.
So I think this next topic's a good
one. So let's kind of dive into
Microsoft Agent three sixty five. And as we're
talking about this one, folks can think about
this as
a control plane or a manageability layer
for AI agents
within your,
today, Microsoft three sixty five environment. This is
gonna manifest in other ways across things like
Azure AI Foundry and other parts of the
Azure ecosystem,
but we'll kind of focus on Microsoft three
sixty five agent, what's there. So we know
that teams are out there. Right? They're adding
agents
or they're deploying MCP servers to augment their
workflows and probably almost, like, every single one
that's out there. Your sales team is gonna
have their own CRM thing. HR is gonna
have something maybe tied into, like, Monday or
Workday or something like that. You're gonna have
custom agents, all the Copilot agents. You're gonna
have your IT department with, like, a troubleshooting
agent or, like, a little bit of, like,
a help desk, things like that that are
out there. So it's a little different than
the world of, we bought a SaaS app
where things are more like static and you
could go read the manual and understand their
functionality.
Now you have these little autonomous things just
running out there. They can potentially talk to
users. Users can interact with them. They can
also interact with each other if they have
the right set of hooks and identity and
all those kinds of things. And in some
cases, they're taking action on behalf of users
because I can tell you not every user
is reading the prompt and saying, like, oh,
no. Don't do that. They're just Nexting their
way through it. So you wanna make sure
you understand what's out there. There's a ton
of sprawl. Traditional
I'm
identity and access
wasn't necessarily
built for this kind of stuff. And now
you have this explosion of potentially service principles,
managed identities,
all these other things within your environment that
you need out there. So
Microsoft three sixty five agent or agent three
sixty five is a new offering that's gonna
kinda wrap this together and give you a
little bit of an umbrella and this control
plane for
AI agents. So one way you can think
about this is maybe like the it's the
Entra ID for agents
without being Entra because there's identity components and
management components
and things that are out there. But I
think it's gonna be really cool. It brings
a registry component. So as agents are deployed
in your environment, they'll enter into
a single registry. So not just the ones
that your IT department deploys, but over time
as M365
is seeing hooks and other things, they'll automatically
add them to the registry
that's out there. You'll be able to track
your agents with unique IDs. You'll be able
to see the agents that are like official
in your organization. Maybe think about it as
like registered versus unregistered. So you'll start to
get visibility into stuff that you can't see
out there. You get access control.
So let's bring in, like, things like conditional
access policies,
risk based conditional access policies, being able to
limit what agents can talk to and have
that out there. And then this whole kind
of monitoring component, so be able to come
in and see what agents are out there,
how are they performing, what are they doing,
what are the impacts that agents are having
on your organization.
And then, of course, it all ties back
to the security stuff as well. So things
like Defender
will have hooks in to be able to
understand and try and detect inter agent to
agent, user to agent service, attacks, things like
that that are out there. You'll have Purview
with all the data management components
and all that stuff. So I think this
is a good one. It kinda brings
agents as better citizens in your environment. They
all get lifted up, just kinda like your
MSIs and SPNs and regular user accounts
were. So
less an afterthought, more front and center
and ready to go for you. Right. You're
starting to get all of those same security
controls that you can apply to
agents
or security controls that you can apply to
users also being able to apply to agents.
Like you said, now you can go in
and put DLP policies in place that agents
have to adhere to. You can go put
in conditional access policies that agents have to
adhere to. So all of those different security
controls so that, let's face it, an agent
is kinda like a user going in and
querying data and looking at data and accessing
data and all of that. So from a
security perspective, you do want a lot of
those types of controls in place. And that's
kind of the theme that I started picking
up, at least from an IT pro perspective.
As I was looking through the book of
news as it's all the purview announcements
are tied back to kinda like this agent
three sixty five where it's all these purview
features are focused on
securing data that agents can access.
All
the interest security things are focused on we
can now do conditional access and better access
management
for agents. And all the defender stuff is
there's like a secure score for agents now.
So you can go in and get how
secure are my different agents. That seems to
be a big overarching theme of all the
individual announcements in the book of news from
what I've read so far on the IT
Pro stuff. Very much so. So I do
hope it, like, coalesces
and kinda does come together and make sense
over time. I think things like having something
like agent three sixty five there, at least
like that centralized registry. Like, let's at least
put all the metadata in the same place
and then start to pull in some of
the operational usage and centralize that as well.
So just looking through and this stuff will
probably change over time, but looking through some
of the
the media screenshots and things, having that registry
is not gonna just tell you, like, the
inventory of things that are out there, who's
using it, potentially how much time they're saving,
things like that. But you'll also be able
to do stuff
like apply those I'm policies, risk based conditional
access policies. Because it's a registry and because
agents are trying to access things in your
environment, so let's say you are installing that
new CRM agent and it wants access to
a SharePoint site, things like that, you're gonna
have the ability to block those flows by
default and then be able to kinda do,
hey. I'm gonna register
this agent. So as an admin, now you're
gonna have operational controls to do things like
go in and approve pending request for agents.
You'll be able to see ownerless agents. So,
again, let's tie that back to metadata and
that registry, have it all all together. You'll
be able to provide
exceptions
for agents.
Unclear, like, what those are, those, like, time
bound exceptions,
or, like like like, what do they need
to be? But I think there's gonna be
a bunch of good, like, operational control there
and just baked in at the top layer
of the admin experience for m three sixty
five. So this isn't gonna be buried in
some submenu or things like that. You're gonna
have, like, Copilot, your users, your role, your
billing agents just sitting right there at the
top and screaming
in your face. And I think Microsoft also
is trying to, like, set a little bit
of expectations just from looking at some of,
like, the marketing screenshots and stuff. So kind
of the one for the overview dashboard has
environment with 58,000
active users
and an agent inventory of 26,000
plus. So I think that'll give you an
idea of the sprawl and potentially what you're
talking about managing. But even if you're a
small organization,
I bet you could see potentially hundreds, if
not thousands, of these things just running around
and doing stuff on behalf of your users,
and it's all gotta be controlled. Yes. Agent
sprawl is absolutely a real thing. I'm glad.
I mean, I would have 100% hoped Microsoft
wouldn't have missed the need for that, but
I'm glad to see they did recognize the
need for that. Now, are seem to be
addressing it in a big way in the
coming months to help organizations
manage that agent sprawl, agent security
because it was
absolutely desperately
needed in the platform. Alright. Well, Ted, I
think it takes us through a little bit
of a high level. Again, for folks, if
you're listening to that this week, we hope
you go out, check out some of the
sessions. We'd love to hear about what you
learned.
Please reach out to either Better Myself on
LinkedIn or the podcast page,
and let us know what was exciting and
interesting for you, and we'll see you for
the next one. You'll hear us for the
next one. You'll hear us for the next
one. Yeah. I don't know that we'll hear
them. But yeah. And I'm sure we'll have
some follow-up episodes on some of this too
going into more details around certain aspects of
this. So thanks. Enjoy your week. Enjoy
sunny, warm Florida while I've been raining cold
San Francisco. Well, it's a remote ignite for
me, so I can't complain about the weather.
But
I'll let you have fun this week. Hope
you feel better, and we'll talk to you
next time. Thanks, Ben. Thanks. Talk to another
Scott.
If you enjoyed the podcast, go leave us
a five star rating in iTunes. It helps
to get the word out so more IT
pros can learn about Office three sixty five
and Azure.
If you have any questions you want us
to address on the show, or feedback about
the show, feel free to reach out via
our website, Twitter, or Facebook.
Thanks again for listening, and have a great
day.