AI Agents - Organization-wide Shared

Hunt Hypothesis

This hunt targets the potential exposure of sensitive data by identifying AI agents configured with organization-wide sharing permissions, which may inadvertently grant excessive access to unauthorized users. Proactively hunting for these configurations in Azure Sentinel is critical to mitigate the risk of lateral movement and data exfiltration stemming from overly permissive agent scopes before they are exploited by adversaries.

KQL Query

let IdentityIdtoUPN = materialize (
    IdentityInfo
    | where isnotempty(AccountObjectId) and isnotempty(AccountUpn)
    | summarize arg_max(Timestamp, AccountUpn) by AccountObjectId
    | project AccountObjectId = tostring(AccountObjectId), AccountUpn);
AgentsInfo
| summarize arg_max(Timestamp, *) by AgentId
| where LifecycleStatus != "Deleted"
| where array_length(SharedWith) > 0
| mv-expand Shared = SharedWith to typeof(string)
| where tostring(Shared) == "*"
| extend OwnerId = tostring(Owners[0])
| join kind=leftouter IdentityIdtoUPN on $left.OwnerId == $right.AccountObjectId
| project-rename OwnerUpn = AccountUpn
| project-away Shared, OwnerId, AccountObjectId
| project-reorder CreatedDateTime, AgentId, Name, Platform, SharedWith, OwnerUpn

Analytic Rule Definition

id: 8a53cf8e-04b1-4de6-95f2-916cc7c2b805
name: AI Agents - Organization-wide Shared
description: |
  This query identifies AI agents that are shared with the entire organization (SharedWith contains "*").
  Such configurations significantly increase the risk of unauthorized access by unintended users, which could lead to data exposure or misuse of agent capabilities.
  Broad sharing is especially sensitive when the agent has access to sensitive data sources, tools, or credentials.
  Recommended Action: Review these agents to confirm whether organization-wide sharing is necessary for the business scenario.
  If not, restrict access to specific users or groups and apply least-privilege principles. For broadly shared configurations, ensure proper governance and compliance checks are in place.
requiredDataConnectors: []
tactics: []
relevantTechniques: []
query: |
  let IdentityIdtoUPN = materialize (
      IdentityInfo
      | where isnotempty(AccountObjectId) and isnotempty(AccountUpn)
      | summarize arg_max(Timestamp, AccountUpn) by AccountObjectId
      | project AccountObjectId = tostring(AccountObjectId), AccountUpn);
  AgentsInfo
  | summarize arg_max(Timestamp, *) by AgentId
  | where LifecycleStatus != "Deleted"
  | where array_length(SharedWith) > 0
  | mv-expand Shared = SharedWith to typeof(string)
  | where tostring(Shared) == "*"
  | extend OwnerId = tostring(Owners[0])
  | join kind=leftouter IdentityIdtoUPN on $left.OwnerId == $right.AccountObjectId
  | project-rename OwnerUpn = AccountUpn
  | project-away Shared, OwnerId, AccountObjectId
  | project-reorder CreatedDateTime, AgentId, Name, Platform, SharedWith, OwnerUpn
entityMappings:
  - entityType: Account
    fieldMappings:
      - identifier: FullName
        columnName: OwnerUpn
  - entityType: Host
    fieldMappings:
      - identifier: HostName
        columnName: Name
version: 1.0.0

Required Data Sources

References

• [Source Query](https://github.com/Azure/Azure-Sentinel/blob/main/Hunting Queries/AI Agents/AgentsInfoOrganizationWideShared.yaml)

False Positive Guidance

Here are 5 specific false positive scenarios for the AI Agents - Organization-wide Shared detection rule, including context and recommended filters:

• Global HR Onboarding Bot Deployment

  • Scenario: The IT team deploys a new Microsoft Copilot or ServiceNow AI agent designed to assist all employees with onboarding queries. To ensure immediate availability for the entire workforce without manual user assignment, the admin explicitly sets the SharedWith scope to “Entire Organization” during the initial configuration phase.
  • Filter/Exclusion: Exclude agents where the Owner belongs to the HR-Admins or IT-Ops security groups AND the agent name contains keywords like “Onboarding,” “Welcome,” or “General-Assist.”

• Scheduled Compliance Reporting Agent

  • Scenario: A scheduled job runs nightly using a Power BI AI agent or Tableau Pulse to generate and distribute compliance summaries. This agent is configured with organization-wide sharing permissions so that any department head can access the live dashboard without needing individual invite links, triggering the rule upon every scheduled execution window.
  • Filter/Exclusion: Create an exclusion for agents where CreationDate falls within a known maintenance window (e.g., 02:00–04:00 UTC) AND the agent name starts with “Report-” or “Compliance-”.

• Enterprise-Wide Knowledge Base Integration

  • Scenario: The organization integrates a centralized AI knowledge base (e.g., a custom Azure Bot Service or Salesforce Einstein Agent) that serves as the primary interface for internal wiki searches. This agent is provisioned by the Enterprise Architecture team with SharedWith set to the root domain container to allow seamless discovery across all sub-tenants and departments.
  • Filter/Exclusion: Filter out agents where the Description field contains “Knowledge Base,” “Wiki