Video summary

Expert panel – How to prepare for an agentic future | Microsoft Identity Security Summit 2026

Main summary

Key takeaways

Technology

Technological Concepts & Product/Feature Themes

Preparing for Agentic AI (multi-step autonomous work)

  • One organization described a journey from ChatGPT → Claude, eventually moving into agentic AI over ~18 months.
  • Their agentic push focuses on gaining many external data connections via MCP (Model Context Protocol).
  • Agents are used not only for chat, but also for:
    • Research across wide datasets
    • Supporting a data science team that performs scraping/data collection through agent workflows

Why the Claude ecosystem was preferred (relative assessment)

  • A panelist compares Claude vs alternatives as:
    • Better toolset
    • A better LLM
  • They also mention a security stance: they were comfortable with certain risks because they enable read access rather than write access in particular scenarios.

MCP servers and internal integrations

  • They run MCP servers, including internal MCP servers.
  • They enable Claude/agents to access other teams’ data through MCP-powered direct connections.

Licensing and training at scale

  • Approximately 95 users have Claude + ChatGPT licensing.
  • They run ongoing training as new Claude features arrive, treating adoption as an operational program rather than a one-time rollout.

Governance as a control layer (“guard rails”)

Multiple speakers emphasize that governance is essential, because AI adoption can outpace security controls.

An operational pattern suggested:

  • Use Microsoft Defender / risk scoring (explicitly called out) to evaluate AI products based on risk appetite and selectively allow usage.
  • Avoid blanket bans that stall innovation, since teams may bypass controls anyway.

Key governance objective:

  • Know what AI/agents exist, where they run, and what data they can access, then apply guard rails.

Governance is the mechanism to keep AI velocity from outrunning security.

Treating each agent like a “person”

For agentic systems, governance should define:

  • What the agent can see
  • How it can handle data
  • What it can respond to

Example of the “control” problem:

  • An agent integrated with systems like SSO/OpenID Connect, M365, and SharePoint could potentially access far more than intended—including the risk of write/change behavior.
  • The remedy is to narrow access to specific sites and permissions.

Identity- and label-based access control (including agent identity)

Panelists highlight that the agent needs identity in addition to permissions:

  • Use agent ID / delegated rights so the agent’s access can match the end user or be constrained.
  • Emphasize that boundaries must combine:
    • agent identity
    • user identity
    • labeling/protection

They also note a complication:

  • Non-Microsoft agents/models (e.g., Claude agents and “thousands” of other agent tools) make consistent control harder.

Authentication “control plane” for agents

  • Proposed approach: require agents to log into something like Entra (Microsoft Entra ID).
  • The org can then:
    • authenticate the agent
    • observe what it accesses
    • log/monitor it via a central control plane

Dynamic runtime control / Conditional Access

  • Use Global Secure Access (GSA) so agent traffic to services like SharePoint doesn’t go over open internet.
  • Claimed benefits:
    • enforce conditional access for agents at runtime
    • support “break-glass”-style severing (described as the ability to “kill it off”)
  • Noted limitation:
    • conditional access policies may not apply cleanly to Linux-based boxes running agents, requiring CA policy rewrite/support for Linux/IP scenarios.

Shift from static permissions to runtime enforcement

Speakers frame the move as progressing toward:

  • dynamic runtime attestations/controls because agents may act unsupervised and permissions must adapt quickly.

Review / Guide / Tutorial Content Highlighted

Upskilling strategy for GPT/Anthropic users

  • They used an external training provider for the basics and sensible usage.
  • They add ongoing training plus a weekly cadence:
    • a Friday showcase where users demonstrate what they’re doing with AI
  • They also create:
    • knowledge-sharing channels (team chats)
    • vendor sessions for MCP presentations

Prompt engineering guidance

Key guidance themes:

  • “Turn users into sophisticated prompt engineers” using multiple practical angles:
    • Don’t accept the first response—have the AI ask questions and refine itself (iterative prompting)
    • Provide as much detail as possible, and ask AI to ask you questions back
    • Add strong context/constraints (e.g., specify British English, define goal, include boundaries)
    • One technique: build an adoption space/knowledge hub with good and bad prompt examples to train behavior quickly
    • Prefer conversation-like use over one-shot requests

Critical thinking and verification

  • “Humans in the loop” is required: humans must check everything before external sharing.
  • Governance includes insisting on fact-checking, especially for materials reviewed by partners.

Verification is a gating step, not an afterthought.

Security / Analysis Insights (Threat Trends)

Increase in AI-enabled phishing / social engineering

  • Security ops notes increased phishing, with users more likely to fall for it because AI makes messages more accurate and convincing.
  • AI-generated attacks also impact the supply chain (via third-party compromise).
  • A counter-effect: some users report “everything as phishing,” increasing workload.

Need for AI-assisted triage

  • Suggested response: use additional threat intelligence (including AI assistance) to manage higher volumes of reported suspicious emails.

Deepfakes affecting recruitment and executive fraud

  • Discussion includes deepfake risks such as:
    • interview deepfake skepticism tests
    • prior financial services CEO deepfake fraud
  • Overall risk: deepfakes are becoming easy/cheap and highly convincing.

Opportunities Emphasized

Productivity and value creation

  • Users become more efficient and spend less time on formatting/boilerplate and more on substance (e.g., focusing on reports vs “getting the indent right”).
  • AI helps analysts and security operations by reducing:
    • alert fatigue
    • initial triage burden
  • This allows teams to focus on real incidents and higher-value work.
  • From a managed security provider perspective:
    • scale output without proportionally adding headcount

Main Speakers / Sources

  • Maninda (TDR)
  • Anna (panel; referenced for governance/telemetry/security operations insights)
  • Dave (security/governance and long-term AI management; also discusses GSA/conditional access concepts)

Original video