The three-level hierarchy
Microsoft's agent model has three levels, and permissions inherit down the chain. That inheritance is exactly where risk hides: grant too much at the top and every layer below it carries the same reach. Senserva walks all three levels and reports what each can do.
Deterministic agent checks
These checks read live configuration from Microsoft Graph and report exactly what is there. No guessing, no sampling. This is the inventory and least-privilege backbone.
| Check | What it inspects | Severity |
|---|---|---|
| Least privilege for agent functions | Inheritable scopes on agent blueprints, flagged when an agent can do more than its job needs. | High |
| High-risk scopes on agent blueprints | Inherited scopes checked against high-risk Graph permissions such as Directory.ReadWrite.All and RoleManagement.ReadWrite.Directory. | High |
| Agent identity blueprints discovered | Every blueprint in the tenant, with its display name and inherited scopes. | Medium |
| Inheritable permissions on blueprints | The presence and content of inheritable permissions that propagate to every agent and user under a blueprint. | Medium |
| Agent identities (service principals) | The service principals running as agents under each blueprint, with their granted OAuth scopes. | Medium |
| Agent users | User accounts bound to an agent identity, inheriting its permissions. | Medium |
High-risk scopes Senserva flags include Directory.ReadWrite.All, RoleManagement.ReadWrite.Directory, Application.ReadWrite.All, Mail.Send, Files.ReadWrite.All, Sites.ReadWrite.All, Policy.ReadWrite.ConditionalAccess, and PrivilegedAccess.ReadWrite.AzureAD, among others.
Why over-privileged agents are dangerous
An agent follows instructions, and those instructions can be poisoned. A single prompt-injection, hidden in a document, an email, or a web page the agent reads, can redirect it. If the agent is over-privileged, that injection becomes a path to act with the agent's full reach, no human in the loop.
- An agent with Mail.Send can be turned into a phishing or exfiltration channel.
- An agent with RoleManagement.ReadWrite.Directory or Directory.ReadWrite.All can escalate privilege or alter the directory.
- An agent with Files.ReadWrite.All or Sites.ReadWrite.All can read, change, or move data across the tenant.
- An agent with Policy.ReadWrite.ConditionalAccess can weaken the very controls meant to contain it.
Least privilege is the antidote. Scope every agent to the functions it genuinely performs, and the blast radius of any injection shrinks accordingly. Senserva tells you, deterministically, where that principle is being broken.
Know your agents, then constrain them
Inventory comes first, least privilege comes next, and proof closes the loop. Senserva does all three on the Microsoft side and ranks the work so you start with the agents that can do the most damage. For the full Microsoft AI surface, see Microsoft AI security, and for the governance-standard view, see ISO/IEC 42001.