ARMOR In Action with Microsoft Security: Securing AI at Enterprise Scale

As AI moves from pilot projects into delivering business-critical services, security becomes a critical factor in successful AI deployments. To help organizations address this challenge, WWT developed a vendor-agnostic AI security framework - ARMOR (AI Readiness Model for Operational Resilience). Built through collaboration with NVIDIA and strengthened by real-world engagement with the Texas A&M University System, ARMOR provides security leaders with a practical framework for assessing and managing AI risk. It organizes AI security into seven domains: Governance, Risk and Compliance (GRC); Model Protection; Secure AI Operations; Infrastructure Security; Identity Security; Data Security; and the Secure Software Development Lifecycle. Together, these domains help organizations build cyber-resilient AI environments 

ARMOR's seven domains focus on key elements of securing AI systems and related processes, helping organizations understand security control points inside and between these systems, and their interactions with the surrounding environment. This is key to understanding how AI security mechanisms mesh with traditional security solutions and is vital to identifying present gaps. ARMOR also accommodates organizations at different maturity levels.  

Microsoft's distinctive contribution to ARMOR is reach. Microsoft's security portfolio, as an integrated security platform that connects Defender, Sentinel, Entra, Purview, Intune, Agent 365, and Security Copilot through shared security context, native workflows, unified experiences, and third-party extensibility. Signals from endpoints, identities, cloud workloads, and now AI applications all feed into one shared data model, which matters a lot in AI security since securing an AI deployment touches the infrastructure, data, application, and model layers all at once. No other vendor covers the full stack as well, particularly in an enterprise Windows and Azure environment. 

 For many enterprises, Microsoft Security already spans the digital estate: Defender protects identities, endpoints, email and collaboration, cloud workloads, applications, and AI; Entra governs access; Purview protects data and compliance; and Sentinel unifies security operations. Layering ARMOR's AI specific controls onto that existing foundation, rather than standing up a parallel stack, means lower total cost of ownership, less integration complexity, a single vendor relationship, and less alert fatigue since AI signals land in the same Sentinel workspace security teams already use. 

 Under its Secure Future Initiative, launched November 2023 and backed by a five-year cybersecurity investment commitment, Microsoft has mobilized the equivalent of more than 34,000 full-time engineers to reduce risk and harden its platforms, and is continuously shipping new capability out of that work. That engine is now pointed at the agentic era. Microsoft's framing is three-part: secure agents, secure the foundations they run on, and defend using agents and experts. Here some of the recent innovations in these areas:  

• Sentinel, the   agentic defense SIEM/SOAR layer that ingests Microsoft and third-party telemetry, correlates AI signals with the broader environment, and provides analytics, automation, playbooks, data federation, and agent-assisted operations.
• Security Copilot as an AI powered analyst that accelerates response
• Purview DSPM and DLP for AI data risk
• Defender for Cloud's new AI Security Posture Management and AI Bill of Materials
• Agent 365 and Entra Agent ID for agent inventory, identity, and governance
• MDASH, Project Perception and ISOC, released in preview Summer/Fall of 2026, are the latest in the Microsoft AI security innovation.

Mapping Microsoft Security's portfolio to ARMOR domains 

Microsoft's platform approach connects controls across compliance, identity, agent governance, model lifecycle, and security posture management, giving it coverage across every ARMOR domain. Two domains stand out: Secure AI Operations, covered by Microsoft Defender XDR, Microsoft Sentinel, Microsoft Security Copilot, Microsoft Defender for Cloud, and Microsoft Security Exposure Management, and Identity Security, covered by Microsoft Entra ID, Entra PIM, Entra Agent ID, and Entra Global Secure Access. 

Across the seven ARMOR domains, Microsoft Security's alignment can be summarized as follows: 

The sections below describe how each solution contributes to the domains it primarily supports and the domains it secondarily reinforces. 

1. Microsoft Agent 365  / Entra Agent ID 

ARMOR Domains: Governance, Risk & Compliance (Primary); Identity Security (Primary); Secure AI Operations, Model Protection, Secure Development Lifecycle, Infrastructure Security, Data Security (Overlap) 

Microsoft Agent 365 and Microsoft Entra Agent ID treat every AI agent as a governed identity with an owner, a lifecycle, and an audit trail. Agents can act, hold permissions, and touch data on their own, which most governance programs were never built to handle. 

Notable capabilities include: 

• Agent Inventory & Lifecycle Governance: Discovers, registers, and governs AI agents across their full lifecycle.
• Agent Identity & Access Control: Assigns identity, ownership, and zero-trust access control to individual agents.
• Auditability: Provides the ownership and audit trail needed for agent accountability.
• Agent-Specific Security Posture: Extends classification and posture controls to agents as first-class identities.

2. Microsoft Entra ID / PIM / Identity Governance & Entra Global Secure Access 

ARMOR Domains: Identity Security (Primary); GRC, Model Protection, Secure AI Operations, Infrastructure Security, Data Security (Overlap) 

This solution group is the core of Microsoft's Identity Security coverage. Conditional access, privileged access, and Zero Trust network access work together across human, workload, and agent identities. 

Notable capabilities include: 

• Conditional Access & Identity Governance: Identity-centric access control for users, workload identities, and AI resource access.
• Just-In-Time Privileged Access (PIM): Just-in-time privileged role activation for AI infrastructure administrators and platform operators.
• Zero Trust Private Access (Global Secure Access): Zero Trust access to private AI resources, apps, and network paths.
• Continuous Risk-Based Access Evaluation: Sign-in risk, user risk, and workload identity Conditional Access, feeding Defender XDR and Sentinel.
• Phishing-Resistant Authentication: MFA and passwordless sign-in (Windows Hello, FIDO2 passkeys) for the people and admins operating AI platforms.

3. Microsoft Purview 

ARMOR Domains: Governance, Risk & Compliance (Primary); Data Security (Primary); Secure AI Operations, Secure Software Development Lifecycle, Identity Security (Overlap) 

Microsoft Purview spans both GRC and Data Security domains. It shows security and compliance teams where sensitive data meets AI, and keeps the audit trail regulators expect as AI interactions scale across the enterprise. 

Notable capabilities include: 

• DSPM for AI: Data risk insights, AI interaction visibility, sensitive data exposure assessment, and policy recommendations.
• Audit, eDiscovery & Communication Compliance: Audit, investigation, retention, and compliance handling for supported AI interactions.
• Information Protection & DLP: Data classification, sensitivity labels, insider risk management, and DLP for AI data flows.
• Purview DLP for Microsoft 365 Copilot and Copilot Chat: Controls for sensitive prompts, labeled files and emails, and supported grounding scenarios.

4. Microsoft Priva 

ARMOR Domains: Governance, Risk & Compliance (Secondary); Data Security (Overlap) 

Microsoft Priva supplies the privacy-specific layer of GRC coverage: the workflows that turn a data-subject request or a privacy risk finding into a tracked, closed action. 

Notable capabilities include: 

• Privacy Risk Management: Identifies and helps manage privacy risk across data estates that feed AI systems.
• Data Subject Rights Workflows: Structured workflows for handling data subject rights requests.
• Privacy Operations Support: Operational support for ongoing privacy program management.

5. Microsoft Sentinel, Defender XDR & Security Copilot 

ARMOR Domains: Secure AI Operations (Primary); GRC, Infrastructure Security, Data Security, Secure Software Development Lifecycle, Identity Security (Overlap) 

Microsoft Defender XDR discovers and protects AI agents in real time; Microsoft Sentinel correlates that signal with the rest of enterprise telemetry, and Microsoft Security Copilot puts AI-assisted investigation in front of the analyst doing the work. This seamlessly connected detection-to-response layer for AI is why Secure AI Operations is a strong domain for Microsoft. Project Perception (in preview), covered below, extends this domain with agentic red, blue and green defense. 

Notable capabilities include: 

• AI Agent Discovery & Real-Time Protection (Defender XDR): AI agent discovery, posture assessment, real-time protection, incident correlation, hunting, and investigation.
• AI-Aware SIEM/SOAR (Sentinel): Analytics, automation, playbooks, and correlation with broader enterprise telemetry.
• AI-Assisted Investigation (Security Copilot): AI-assisted triage, investigation, hunting, KQL support, incident summaries, and response guidance.

6. Microsoft Defender for Cloud 

ARMOR Domains: Secure AI Operations (Secondary); Infrastructure Security (Primary); GRC, Model Protection, Secure Software Development Lifecycle, Data Security, Identity Security (Overlap) 

Microsoft Defender for Cloud anchors both Secure AI Operations and Infrastructure Security domains. It discovers what AI and application assets exist, assesses how they are deployed, and detects threats against generative AI applications and agents at runtime. 

Notable capabilities include: 

• AI Security Posture Management: AI-BOM discovery, AI asset visibility, security recommendations, and attack path analysis.
• AI Threat Protection: Runtime threat detection for generative AI applications and agents, with alerts surfaced into Defender XDR.
• Infrastructure Posture Management: Misconfiguration detection and vulnerability prioritization, paired with Microsoft Security Exposure Management.

7. Microsoft Security Exposure Management 

ARMOR Domains: Secure AI Operations (Seconday); Infrastructure Security (Primary); Identity Security (Overlap) 

Microsoft Security Exposure Management shows how exposed each AI asset is, not just that it exists. It pulls signal across Defender, Entra, and Secure Score to prioritize the attack paths that matter most. 

Notable capabilities include: 

• Unified Exposure Insights: Unified exposure insights and attack path analysis across Defender, Entra, Secure Score, and external data sources.
• Infrastructure Posture Management: Infrastructure posture, misconfiguration detection, and vulnerability prioritization, paired with Microsoft Defender for Cloud.

8. Microsoft Foundry / Azure ML Model Registry 

ARMOR Domains: Model Protection (Primary); Secure Software Development Lifecycle (Seconday); GRC, Secure AI Operations, Infrastructure Security, Data Security (Overlap) 

Microsoft Foundry and the Azure ML Model Registry hold the lifecycle, evaluations, and access controls for models managed through Foundry.  

Notable capabilities include:

•  Model & Agent Lifecycle Management: Model and agent lifecycle management, development, deployments, RBAC, networking, and policy controls.
• Evaluations & Tracing: Safety, quality, groundedness, and tool-calling evaluations across development and pre-production.
• Responsible AI Assessment Artifacts: Versioning, traceability, and responsible AI assessment artifacts for model governance.

9. Azure API Management AI Gateway / AI Gateway in Foundry 

ARMOR Domains: Model Protection (Primary); GRC, Secure AI Operations, Secure  Secure Software Development Lifecycle, Infrastructure Security, Data Security (Overlap) 

Applications reach models and agents through APIs, so the gateway is where enforcement belongs. Azure API Management's AI Gateway centralizes enforcement, from access control through pre-production validation. 

Notable capabilities include: 

Centralized Access Control & Policy Enforcement: Centralized access control, policy enforcement, throttling, quota management, and model/API mediation. 

Governed AI Traffic & Observability: Governed AI traffic, quotas, rate limits, monitoring, and tracing, paired with Microsoft Foundry observability. 

Pre-Production Validation: Pre-production validation of API policies, quotas, content safety, and authentication. 

10. Project Perception (preview) 

ARMOR Domains: Secure AI Operations (Primary); GRC, Secure Software Development Lifecycle, Infrastructure Security, Data Security, Identity Security (Overlap) 

Project Perception is an agentic security system that turns signals into real-time protections, combining signals, context, models, and specialized agents into a continuously learning system of defense. Attackers now generate exploits and scale campaigns at machine speed, faster than human-paced defense can absorb. Perception maps primarily to Secure AI Operations, running detection, investigation, and remediation as a continuous loop across the live estate with humans in control. Notable capabilities include: 

• Red, blue, and green agents: Red agents probe like an attacker, blue agents investigate like a responder, and green agents remediate and harden, closing the loop from finding to fix without a hand-off at every step.
• Real-time security context: A continuously updated view of assets, identities, relationships, risks, and activities gives agents a shared, near real-time understanding, which improves reasoning accuracy and cuts the time, compute, and cost to operate at scale.
• Multi-model architecture: Perception selects the best model for each task, including the purpose-built MAI-Cyber-1-Flash, optimizing for quality and cost so always-on AI defense stays affordable.
• Actuators and human control: Integration across Microsoft Security products (Starting with Microsoft Defender) turns insights into action. Defenders set objectives and guardrails, and every high-impact action stays under human sign-off.

11. MDASH (preview) 

ARMOR Domains: Secure Software Development Lifecycle (Primary); Secure AI Operations (Overlap) 

MDASH is Microsoft's software vulnerability multi-model team of agents, now running MAI-Cyber-1-Flash, that hunts and crash-proves real flaws in code rather than emitting more static findings. Attacker automation outpaces defender capacity most sharply here: exploits are written faster than code can be reviewed and fixed. MDASH maps primarily to the Secure Development Lifecycle domain, shifting AppSec from signature-based scanning to attacker-style discovery. Core capabilities include: 

• Multi-agent vulnerability hunting: An orchestrated team of agents works a codebase together, the first Perception scenario delivered to customers.
• Benchmark-proven detection: 96% any-crash score on CyberGym, against a prior MDASH configuration
• Cost-efficient model routing: Almost 50% cost savings versus the MDASH configuration in market today, from a well-tuned multi-model system with rich historical training data.
• On-ramp to broader agentic defense: MAI-Cyber-1-Flash will extend to more Perception workflows beyond software vulnerabilities.

Ready to get started? 

At WWT, we help organizations operationalize ARMOR with the partners who can deliver against it. Microsoft Security's portfolio is strongest in Agentic Governance, Secure AI Operations and Identity Security, anchored by Agent365, Defender XDR, Perception (Preview) and Sentinel for detection and response, Entra ID for identity and privileged access, and Purview for data governance and compliance. 

If you are standing up a new AI platform or tightening the posture of one already running, start with visibility and prioritization.