Speaker 0: Welcome to episode 415 of the Microsoft Cloud IT Pro podcast recorded live from Microsoft Ignite on 11/18/2025. This is a show about Microsoft '3 65 in in Azure from the perspective of IT pros and end users, where we discuss a topic or recent news and how it relates to you. It's Microsoft Ignite week. So, surprise, surprise, we have an Ignite show for you. Unfortunately, Scott wasn't able to join Ben at Ignite this week.

So Scott is recording from home while Ben is bringing you all the live action from Ignite. Hopefully, we'll get Scott back out here next year. But, in this episode, we cover a bit of the theme of Ignite this year, how Ignite announcements have kinda changed over the years, and of course, a couple of the big announcements focused around Microsoft Security Copilot and Microsoft Agent three sixty five. Let's dive into the show.

Speaker 1: Welcome, Ben, to Ignite twenty twenty five. Made it to another one. We get to listen to a congested Ben who's been on flights and traveling across the country to get all the way out to Ignite for us and be our remote reporter this year. Our boots on the ground as it were.

Speaker 0: And Scott waking me up early because I'm on the West Coast now.

Speaker 1: Well, you're still on East Coast time. So I am

Speaker 0: I am still on East Coast time, but, yes, my alarm went off.

Speaker 1: Well, it is 8AM for me and 5AM for you. Let's be honest. It's really still 8AM for you until probably Wednesday or Thursday when you finally Yeah. Crash out and come back the other way.

Speaker 0: I adjusted probably quicker than I thought I would because I took a late flight in Sunday night. So I didn't get to my hotel till, like, 10PM West Coast time Sunday night. And then I was out late last night because it's ignite and it's friends and it's dinners and parties and all the things. So realistically, I didn't go to bed last night until, like, ten or 11PM West Coast time. I did set an alarm this morning in 04:45 or 04:30, whenever it went off.

Felt early.

Speaker 1: Alright. Well, let's get you through this and get you back

Speaker 0: to bed soon. Meetings and I can go take my nap. I'm gonna go take a nap after this before the keynote.

Speaker 1: You can go take take a nap before Judson's keynote and get that out there. So Ignite this year, interesting one. We continue to see a lot of AI AI. I don't think there's any big surprises there And security, yep, with AI.

Speaker 0: I would say, like, those two. Yeah. That is partly AI. But I don't know like, we got the book of news. Right?

And I was talking to other people about this last night too because a lot of us got a little bit of a preview of what's coming. And it really is. It's like AI and security people are like, there's like no big SharePoint stuff, no big Teams stuff, nothing around Teams devices. Like, if you go look, I don't know that there's anything like loop or I just look for loop. Loop is mentioned once in the entire book of news and it's not a product loop.

It's looping between different things. There was a little bit of a like Ignite is not like where's all these other products that Microsoft has because it's really focused on AI and security and really security is still focused on AI because there's not there's a couple things I saw in here from a security device management Intune perspective that wasn't AI, but it was very limited and few and far between. I mean, we'll get into some of these announcements. I think it could be two things. One, rapid release cadence.

Right? The cloud makes it different. People are not gonna be holding back SharePoint announcements for six months and not coming out with anything between April and November or May and November just to have a whole big splash of announcements at Ignite. So I feel like Ignite is turning into I don't know if I'd call it a Microsoft trade show, but it's not as much focused, I don't think, on big announcements because of rapid releases of the cloud. And as such, you don't see maybe as many of those things because nothing's been held back to have a big release about here's everything coming to SharePoint in the next year because you've gotten it trickle out over the last six months.

Speaker 1: I look at it in a couple of different ways. You mentioned trade show. Absolutely. Like, there's tons of partners there. I think if you go into the Expo Hall any given year, and this year

Speaker 0: It's big this year. I walked through it already.

Speaker 1: Yep. There's a ton of partners in there, tons of kinda partner stories and how they integrate into the ecosystem. To your point about things trickle out over the course of time, like, just when they're ready, let's put them out there. I think that is very much true. That's certainly the approach, like, within my organization.

Like, we don't hold things back. We wanna put it out there. But Ignite, for me at least, and for my team, and my product managers, and for my peers, It's our opportunity to come together and tell a story. So here's all these things that we have released over the course of the last six months, but, you know, you saw them as this thing and this thing. How does it all actually compose and come together?

Because I think every time, we'd love to push everything out there all at once, but that's just not the way release cadence works and everything else comes together. So yeah. So I think what we can do for this one is we're kinda going through things rather than just doing, like, a rundown of the random news and kinda smattering of things. Given that there's this large focus on AI, I think there's also an undercurrent and a little bit of thematic flow here to things like security, governance, manageability of your workloads, and for these AI clients and AI agents that exist out there. Like, more and more as IT pros, developers who are involved in this ecosystem of Azure and Microsoft three sixty five, you are either going to be building these things, you're gonna be managing them, or you're certainly gonna be encountering them as a user.

So I think understanding what some of those constraints are, what some of the tools that are available to you. Like, I know, like, every single day, there's a new article that comes out that says, hey. Here's how an MCP server was jailbroken, or it leaked something out there, or it did something weird. Like, you sent me an article a couple days ago about MCP horror stories, WhatsApp data exfiltration. Right?

Like, so so so these things are very real. Like, they sit out there. They run-in your environments. They're often running under identities that you might not even have known existed depending on your governance system and what happened. So what I was thinking we could do today is focus on some of these security governance management constructs that are out there that are going to help IT pros and developers kinda come together and think about ways that they can start to, if they haven't already, embrace this change.

Like, it is coming. It's it's it's gonna be pushed on you one way or another, and the the only way out is through. So let's go ahead and kind of embrace it, get back to our roots, and think about how to do some of that stuff. So to your point of, like, loops not in the book of news, like, well, we're not gonna spend a lot of time on, like, fuzzy stuff or maybe things that have been out there before. I just wanna kinda focus on a couple of high level points that'll help guide folks in.

Like, if you are an IT pro, if you're a developer who's interested in managing these things, having a more kinda secure state for these AI agents, AI workflows in your environment, what are the tools that are available to you both today, and then what are the things that are coming? And I think that's what it what Ignite is good for is also saying, like, hey. Back to that whole, let's tell the story around all the things that are already there. There's absolutely new things coming as well that are gonna be tacked on to that and continue to extend that over the the next several months to a year depending on how things go and rollouts and everything else that's out there. So being those themes, security, governance, manageability, why don't we start with security?

I think there's some goodness coming for Security Copilot, so maybe we can start with that one.

Speaker 0: Quick before I get into that, I think even looking through the book of news, it's similar to what you said where as we looked through it, you could pull out new releases or new features. But if you combine all those new features together in the book of news, I think it does start to tell a story this year about kinda what Microsoft's focus is, particularly around agents and security. So it is. It's not just feature releases, but if you kinda combine all of them together, like, what are they coming out with in all these different products? It's like, oh, there is very much a theme here, I felt like, to some of this.

But like you said, with Security Copilot, this one's an interesting one. I want to see more articles around this particular one and this one specifically because when I read the book of news, I was like, I think I know what this means, but I'm not a 100% sure. So this starts out and it talks about Security Copilot and new Security Copilot agents. So there's 12 new Security Copilot agents that are gonna built into Defender that are coming around Entra, Intune, Purview. Some of these are available in Preview now.

There's also gonna be 30 new agents coming from partners to help tie more agents into security copilot, help with your sock, with your identity, with data security. But then as you get through this, down under, like, all these announcements around agents again, we're talking about security copilot. Everybody's like, well, I can't afford $90 a year for security copilot or a 120 or Microsoft's base recommendation isn't there. It says to help security teams get started with agents more quickly, Security Copilot will be available to all Microsoft three sixty five e five customers. Rollout Stouts starts in Frontier, which is kinda like Microsoft's insider ring now for Copilot.

Speaker 1: I recommend that folks go sign up for that one. At least have one person in your org. Like, go and click that button and fill out that form, and sign up for the Frontier program if you haven't.

Speaker 0: Yep. Coming out in the coming months. This is interesting. Right? Security Copilot is technically already available for e five customers.

You just have to pay for it. Does this mean

Speaker 1: I think this is a lot about, like, the agents that are coming out. So we were chatting a little bit about this before we started recording. So particularly with remote hosted agents, so they're running compute, often GPU as well, to be able to respond to LLMs, pull in their context windows, all these kinds of things. So, like, it's very nice when there's things like remote MCP servers there. I don't know what the runway is for all SaaS and service providers to continue to provide remote MCPs for free, but certainly enjoy them while they're here and the functionality that you get with them Yeah.

And things like that. So I imagine some of this is like you mentioned, there's 10 plus new agents coming to Security Copilot. So these are baked agents ready to go, purpose built. So there's the governance agent, there's the IT, the ID security agent, and then you're gonna be able to build your own agents on things like the Graph SDKs, on top of the Microsoft three sixty five agent ID SDK and the agent SDK, all these different things that are out there. So these all take resources, and those resources today are very finite.

Like, GPUs are not running around, like, freely available still. Like, it's not like we're all just going into, like, our local micro center or Best Buy or whatever and able to get, like, the hottest and latest GPU, and certainly not for data center providers either. So I I imagine part of this is both enable the licenses, but make sure that you can push down the functionality in a measured way and get it out there so that you can start to understand, like, literally, what's the size of the fleet that I need to run for resources on the back end, for compute, GPU, memory, networking, all those kinds of things to to get them to where they need to be? I think the more interesting thing will be, does a shoe drop here, because we've seen this a couple times in Microsoft three sixty five land, where experiences come out built around AI experiences, like Copilot, things like that, where they've started let's take m three sixty five Copilot as an example. When it came out, it was an add on SKU.

Like, go pay an extra $30 per user per month. And now some of that functionality has started to trickle down into the regular m three sixty five SKUs without an additional add on. That said, those SKUs got incrementally a little bit more expensive. So I wonder if this is kinda just sign of the times for e fives where they've been quite baked for a while now, and you've had a good set of add ons, but those add ons really added up. I mean, you can get to a 100 plus dollars a month per user per month very quickly, even in e five land.

I wonder if this is just let's start to push down some of that basic functionality, figure out over time what those costs are, what the material benefit is to customers versus service provider and Microsoft and things like that, and where it all bakes out. I saw this when you pointed it out to me. I kinda giggled in the back of my head, and I said, well, e fives, enjoy your current run rates while they're there until your next renewal because it's probably gonna be $2, $3, whatever, US dollars a month more.

Speaker 0: Yeah. And this is what I would say to keep an eye on because I'm curious too, like, are they going to bring like, is the SCU as we know it going to go away because it's gonna be bundled with e five and it's gonna be there or is it going to be Right. Or is it gonna be like these agents? We're gonna give you like Security Copilot lite. There's gonna be a reduced version where you can leverage these agents in Intune and Defender for some of that.

But you're not gonna get like the full blown let me go query everything in Sentinel with Security Copilot and build out the full blown security experience. So this is when I would say Again, we're recording this before the announcements, so so we're using it from the book of news. By the time you hear this on Thursday, the things we're gonna be talking about are gonna be out in the public. There's gonna be more blog posts about it. There's gonna be sessions about it.

I would go back and look at this one especially if you're interested in Security Copilot. There are three breakout sessions around this four, around Security Copilot protect at the speed and scale of AI, transform security with IT Security Copilot agents, AI powered data security, predictive SOC, and then what are on building the SOC of the future. So there's gonna be some things that I would go watch if you're interested in this to see how all of this shakes out and what the coming months are gonna look like for Security Copilot. Do you feel overwhelmed by trying to manage your Office three sixty five environment? Are you facing unexpected issues that disrupt your company's productivity?

Intelligink is here to help. Much like you take your car to the mechanic that has specialized knowledge on how to best keep your car running, Intelligent helps you with your Microsoft cloud environment because that's their expertise. Intelligent keeps up with the latest updates in the Microsoft cloud to help keep your business running smoothly and ahead of the curve. Whether you are a small organization with just a few users up to an organization of several thousand employees, they want to partner with you to implement and administer your Microsoft cloud technology. Visit them at inteliginc.com/podcast.

That's intelligink.com/podcast for more information or to schedule a thirty minute call to get started with them today. Remember, Intelligink focuses on the Microsoft cloud so you can focus on your business.

Speaker 1: When I think about Security Copilot, maybe I'm always a little simplistic about it. So I always kinda think about it first as Sentinel and then Intune and then Entra. Like, hey. Let's kinda wrap those three things together. But that actually doesn't cover the whole suite of things because Security Copilot is also Defender, and then it's also Purview.

So the way Microsoft frames it, like, if you were gonna go out and try and figure out, like, hey, which pillars do all these fit fit into, is you've got security operations. So we talked about SOC stuff and all these sessions being focused on SOC. So security operations is really Defender and Sentinel. That's it. Done.

Out the door. Data security is Purview. Great. Let's manage things, have DLP, all that kind of stuff. Identity and access control, Entra, and then endpoint management with Intune.

But you do have those kind of four buckets of security operations, data security, identity and access, and endpoint management to get through. So I wonder over time if maybe some of that kind of functionality or what comes in the free versus the paid or not the free, but the included versus the paid.

Speaker 0: E five version versus yeah.

Speaker 1: Is like, do you get Security Copilot with Sentinel, but maybe you're missing some things in Purview? Do you get Security Copilot with Entrance Sentinel, but But then maybe you're missing some things in Intune. I don't know how that's gonna bake and what it's gonna come out like. I do think at some point, like, you're not gonna see it all there for free. So the number of signals that Sentinel pulls in, it's all stored in Kusto and things like that.

It's not free to run those queries and get all that stuff up and running, especially when you're talking about, like, a large scale environment, maybe with tens of thousands of users. That could be billions of signals, if not trillions, coming into your environment that you have to need to filter and sort through. Like, sorry, folks. Like, that stuff ain't free, but It's not. We'll see where it bakes out.

I think it is a good one for folks who are either in Security Copilot land today. Like, hey. There's some niceties here for you. Like, there's new agents. There's new things.

Not a lot probably changes for you. But if you're an e five customer who hasn't adopted the Security Copilot, even if it is a little bit of a mixed offering where maybe it doesn't include all the pillars or have all those things, I still think there's gonna be a bunch of value there. And it's gonna start to get you into this ecosystem back to that theme around, like, hey, what's here for you as an IT pro? Sentinel is not just the discovery components or security copilot. It's not just the discovery stuff.

There's also manageability aspects and other things that are important to think about there.

Speaker 0: Yeah. And to your point about signals, in here it talks about Microsoft, their threat intelligence is informed by over 100,000,000,000,000 daily signals. So, yeah, it's not cheap or free to run this because that's a lot of daily signals to process.

Speaker 1: A little bit here and there. Yeah. So I I mean, like the like I said, there there's goodness there. I think there's things to watch for. Like, if you're somebody who's listening to this and you're like, oh, that sounds interesting, and you didn't attend Ignite or maybe you wanna come back, like, check out the show notes.

We'll have links in there to the breakouts and and things like that so you can go back and watch the recordings. We kinda I think most companies, at least in The United States, had a slow period here as we get into, like, Thanksgiving and Christmas, things like that. Like, hey. Maybe this is your chance to catch up on some learning and figure out what's out there.

Speaker 0: Yeah. So with Security for Copilot, we talked about agents, all the agents coming. We also recognize that there has been a bit of a gap here with managing certain things in Microsoft March. Right? Like, people are adding agents or adding agents and agents and Microsoft is adding agents.

And I've started having these conversations with customers that are like, well, how do I govern agents? How is my agent security configured?

Speaker 1: They're unregovernable. Yeah. Store. That's not right.

Speaker 0: How do I manage agents? All these things, like, the last couple years have been all about Copilot. I feel like this year is all about agents. Like, we have these security agents that are accessing a bunch of security data. How do we govern these types of agents and know what they're accessing or maybe put certain controls in place because security?

Speaker 1: I think it's less about, like, like, the built in agents than it is about the custom ones that come or, let's say, your finance department or your sales team is working with Salesforce and you use Salesforce CRM, and you adopt their agent, and somebody in sales goes and just clicks next on a SaaS product that was maybe And gets it all out there. A little wily in your environment, and then that has the ability to get configured. And then what does it have access to, and what's it have going on? Like, it's one thing to hear an MCP horror story about, like, WhatsApp data exfiltration. Tell you what, it's gonna be another one to hear about a a Salesforce CRM horror story when all of a sudden, like, all your sales records leak or all your contacts or things like that.

So for this one, I think

Speaker 0: It's the security copilot agents, like, the 30 agents that third parties are adding. So I agree with you. It's not necessarily Microsoft agents. It's agents are coming everywhere from third parties.

Speaker 1: I think you need to think about those. So so there's always been the shadow IT thing. And businesses and organizational units and divisions are always gonna go out and what do what they do. I think it is more important than ever to be vigilant about these things and understand what's running in your environment, who's it associated with, who are the users that use it, all those kinds of things. So I think this next topic's a good one.

So let's kind of dive into Microsoft Agent three sixty five. And as we're talking about this one, folks can think about this as a control plane or a manageability layer for AI agents within your, today, Microsoft three sixty five environment. This is gonna manifest in other ways across things like Azure AI Foundry and other parts of the Azure ecosystem, but we'll kind of focus on Microsoft three sixty five agent, what's there. So we know that teams are out there. Right?

They're adding agents or they're deploying MCP servers to augment their workflows and probably almost, like, every single one that's out there. Your sales team is gonna have their own CRM thing. HR is gonna have something maybe tied into, like, Monday or Workday or something like that. You're gonna have custom agents, all the Copilot agents. You're gonna have your IT department with, like, a troubleshooting agent or, like, a little bit of, like, a help desk, things like that that are out there.

So it's a little different than the world of, we bought a SaaS app where things are more like static and you could go read the manual and understand their functionality. Now you have these little autonomous things just running out there. They can potentially talk to users. Users can interact with them. They can also interact with each other if they have the right set of hooks and identity and all those kinds of things.

And in some cases, they're taking action on behalf of users because I can tell you not every user is reading the prompt and saying, like, oh, no. Don't do that. They're just Nexting their way through it. So you wanna make sure you understand what's out there. There's a ton of sprawl.

Traditional I'm identity and access wasn't necessarily built for this kind of stuff. And now you have this explosion of potentially service principles, managed identities, all these other things within your environment that you need out there. So Microsoft three sixty five agent or agent three sixty five is a new offering that's gonna kinda wrap this together and give you a little bit of an umbrella and this control plane for AI agents. So one way you can think about this is maybe like the it's the Entra ID for agents without being Entra because there's identity components and management components and things that are out there. But I think it's gonna be really cool.

It brings a registry component. So as agents are deployed in your environment, they'll enter into a single registry. So not just the ones that your IT department deploys, but over time as M365 is seeing hooks and other things, they'll automatically add them to the registry that's out there. You'll be able to track your agents with unique IDs. You'll be able to see the agents that are like official in your organization.

Maybe think about it as like registered versus unregistered. So you'll start to get visibility into stuff that you can't see out there. You get access control. So let's bring in, like, things like conditional access policies, risk based conditional access policies, being able to limit what agents can talk to and have that out there. And then this whole kind of monitoring component, so be able to come in and see what agents are out there, how are they performing, what are they doing, what are the impacts that agents are having on your organization.

And then, of course, it all ties back to the security stuff as well. So things like Defender will have hooks in to be able to understand and try and detect inter agent to agent, user to agent service, attacks, things like that that are out there. You'll have Purview with all the data management components and all that stuff. So I think this is a good one. It kinda brings agents as better citizens in your environment.

They all get lifted up, just kinda like your MSIs and SPNs and regular user accounts were. So less an afterthought, more front and center and ready to go for you.

Speaker 0: Right. You're starting to get all of those same security controls that you can apply to agents or security controls that you can apply to users also being able to apply to agents. Like you said, now you can go in and put DLP policies in place that agents have to adhere to. You can go put in conditional access policies that agents have to adhere to. So all of those different security controls so that, let's face it, an agent is kinda like a user going in and querying data and looking at data and accessing data and all of that.

So from a security perspective, you do want a lot of those types of controls in place. And that's kind of the theme that I started picking up, at least from an IT pro perspective. As I was looking through the book of news as it's all the purview announcements are tied back to kinda like this agent three sixty five where it's all these purview features are focused on securing data that agents can access. All the interest security things are focused on we can now do conditional access and better access management for agents. And all the defender stuff is there's like a secure score for agents now.

So you can go in and get how secure are my different agents. That seems to be a big overarching theme of all the individual announcements in the book of news from what I've read so far on the IT Pro stuff.

Speaker 1: Very much so. So I do hope it, like, coalesces and kinda does come together and make sense over time. I think things like having something like agent three sixty five there, at least like that centralized registry. Like, let's at least put all the metadata in the same place and then start to pull in some of the operational usage and centralize that as well. So just looking through and this stuff will probably change over time, but looking through some of the the media screenshots and things, having that registry is not gonna just tell you, like, the inventory of things that are out there, who's using it, potentially how much time they're saving, things like that.

But you'll also be able to do stuff like apply those I'm policies, risk based conditional access policies. Because it's a registry and because agents are trying to access things in your environment, so let's say you are installing that new CRM agent and it wants access to a SharePoint site, things like that, you're gonna have the ability to block those flows by default and then be able to kinda do, hey. I'm gonna register this agent. So as an admin, now you're gonna have operational controls to do things like go in and approve pending request for agents. You'll be able to see ownerless agents.

So, again, let's tie that back to metadata and that registry, have it all all together. You'll be able to provide exceptions for agents. Unclear, like, what those are, those, like, time bound exceptions, or, like like like, what do they need to be? But I think there's gonna be a bunch of good, like, operational control there and just baked in at the top layer of the admin experience for m three sixty five. So this isn't gonna be buried in some submenu or things like that.

You're gonna have, like, Copilot, your users, your role, your billing agents just sitting right there at the top and screaming in your face. And I think Microsoft also is trying to, like, set a little bit of expectations just from looking at some of, like, the marketing screenshots and stuff. So kind of the one for the overview dashboard has environment with 58,000 active users and an agent inventory of 26,000 plus. So I think that'll give you an idea of the sprawl and potentially what you're talking about managing. But even if you're a small organization, I bet you could see potentially hundreds, if not thousands, of these things just running around and doing stuff on behalf of your users, and it's all gotta be controlled.

Speaker 0: Yes. Agent sprawl is absolutely a real thing. I'm glad. I mean, I would have 100% hoped Microsoft wouldn't have missed the need for that, but I'm glad to see they did recognize the need for that. Now, are seem to be addressing it in a big way in the coming months to help organizations manage that agent sprawl, agent security because it was absolutely desperately needed in the platform.

Speaker 1: Alright. Well, Ted, I think it takes us through a little bit of a high level. Again, for folks, if you're listening to that this week, we hope you go out, check out some of the sessions. We'd love to hear about what you learned. Please reach out to either Better Myself on LinkedIn or the podcast page, and let us know what was exciting and interesting for you, and we'll see you for the next one.

You'll hear us for the next one.

Speaker 0: You'll hear us for the next one. Yeah. I don't know that we'll hear them. But yeah. And I'm sure we'll have some follow-up episodes on some of this too going into more details around certain aspects of this.

So thanks. Enjoy your week. Enjoy sunny, warm Florida while I've been raining cold San Francisco.

Speaker 1: Well, it's a remote ignite for me, so I can't complain about the weather. But I'll let you have fun this week. Hope you feel better, and we'll talk to you next time. Thanks,

Speaker 0: Ben. Thanks. Talk to another Scott. If you enjoyed the podcast, go leave us a five star rating in iTunes. It helps to get the word out so more IT pros can learn about Office three sixty five and Azure.

If you have any questions you want us to address on the show, or feedback about the show, feel free to reach out via our website, Twitter, or Facebook. Thanks again for listening, and have a great day.