Express: Microsoft Secure AI and Cloud Workloads

Secure AI and cloud workload landscape How AI changes cloud security assumptions Identity, data, model, agent, and network domains AI apps vs agents vs cloud workloads Risk-to-control mapping for AI projects Identity and access controls Microsoft Entra as the control plane Conditional Access, groups, and roles Workload and managed identities Privileged Identity Management and reviews Securing Microsoft Foundry and AI workloads Foundry projects, endpoints, and data connections Trust boundaries for users, apps, and agents Securing model, tool, and data access Prompt injection and data exfiltration risks Defender for Cloud for AI and cloud workloads Security posture management and secure score Recommendations and remediation priority Workload protection for compute and data AI workload posture scorecard Cloud infrastructure security baseline Secure compute, containers, Functions, and AKS Storage, database, and network controls Key Vault, secrets, certificates, and rotation Azure Policy and compliant-by-default deploys Data protection and Purview controls Sensitivity labels, DLP, and retention Data access boundaries for Copilot and agents Sensitive sources, vector data, and outputs Governed data handoff to Fabric Analytics Microsoft 365 AI agent governance Agent discovery, inventory, and ownership Identity and access governance for agents Protecting data accessed by agents Monitoring agent threats and anomalies Security review and exception management Secure-by-design review gates Risk acceptance, owner, and expiration Go-live checklist for AI and cloud workloads Handoff to SOC and operations teams Portfolio security workshop Apply the risk-to-control matrix to a workload Select controls across Entra, Defender, Purview Document go/no-go recommendations