Work IQ: Upload

🚨 The Signal: Autonomous agents can now upload files to Microsoft 365. This expands agent capabilities, increasing potential data exfiltration risks and requiring robust data governance.

The Impact

Security teams and data owners are affected by new data exfiltration and compliance risks from agent file uploads.

• Security teams face new data exfiltration vectors from agent-initiated uploads.
• Data owners must reassess data residency and compliance for agent-generated content.
• Compliance officers need to update policies for agent data handling and retention.
• Identity teams must review agent permissions for file upload capabilities.

The Action

1. Review and update Microsoft Purview Data Loss Prevention (DLP) policies to include agent identities and M365 destinations.
2. Audit agent identities in Entra ID for least privilege access, specifically for file upload permissions.
3. Implement or refine Microsoft Purview Information Protection (MIP) sensitivity labels for agent-uploaded content.
4. Establish clear data retention and disposal policies for content uploaded by agents.
5. Monitor Microsoft 365 audit logs for unusual file upload activity by agent identities.

Domain: Agentic-AI · Impact: high · Workload: Other