AI data security for agents now extends beyond Microsoft Purview

At a glance

What this is: Nightfall argues that Microsoft Purview’s native DLP strength in Microsoft 365 does not fully cover AI agents, MCP servers and broader SaaS data flows.

Why it matters: This matters because identity, access and data control now have to follow machine-driven workflows across tools, not stop at the Microsoft tenant boundary.

By the numbers:

• Nightfall states that Microsoft Purview has 25% lower precision and 50% lower recall than Nightfall for detecting PII, PCI, PHI and secrets.

Context

Data loss prevention is no longer just a Microsoft 365 problem. As AI agents, copilots, MCP servers and SaaS apps move sensitive data across chat, code, storage and browser sessions, controls that depend on a single ecosystem leave visible gaps in policy enforcement and response.

The identity angle is real because AI agents and MCP workflows act like machine users that can retrieve, transform and disclose sensitive content on behalf of people or systems. When access, inspection and remediation do not follow those flows, governance fails at the moment data leaves the managed boundary.

Key questions

Q: What fails when DLP only covers Microsoft 365 but not AI agent workflows?

A: The control fails at the workflow boundary. Sensitive data can leave the Microsoft tenant through agents, MCP tools, browsers or connected SaaS apps before policy enforcement or remediation can act, so visibility remains partial and response becomes too late to reduce exposure.

Q: Why do AI assistants and MCP servers create new access-control risks?

A: They are not just productivity tools. Many can read files, call APIs, access databases, and interact with external services, which means they operate inside the trust boundary normally reserved for approved software and users. Without scoped permissions and enforcement, they can become a fast path to secrets exposure and lateral movement.

Q: Why do Mac users need content-aware DLP for SaaS and AI apps?

A: Because the risk is no longer just malware on the device. Sensitive data can be copied, uploaded or pasted into approved tools in ways that look normal unless the control can classify the content and enforce policy at the moment of transfer.

Q: How do data governance and identity governance intersect in AI programmes?

A: They intersect at the point where systems decide what data to trust and who is accountable for that trust. Identity teams bring ownership, approval and review discipline, while data governance brings classification, lineage and context. AI programmes need both, because access without trustworthy context still produces poor decisions.

Technical breakdown

Why Microsoft-native DLP stops at the ecosystem edge

Microsoft Purview DLP works best where the workflow stays inside Microsoft 365, because policy evaluation, remediation and telemetry are tightly coupled to the native stack. The problem appears when data moves into Slack, Salesforce, Google Workspace, browser-based AI apps or MCP tool calls. At that point, enforcement depends on connectors, onboarding state, browser coverage, licensing and application-specific prerequisites, which creates uneven control depth. That is less a product flaw than a boundary issue: DLP that assumes one control plane will always miss some cross-app movement.

Practical implication: map where sensitive data actually moves before you assume a single DLP control plane is enough.

How AI agent and MCP workflows change data exposure

AI agents and MCP servers are not just additional apps. They are machine-mediated retrieval and transformation paths that can pull sensitive content from connected systems and then expose it through prompts, outputs or downstream tool calls. That shifts the risk from document storage to runtime access and disclosure. The key technical issue is that the agent is acting as an intermediary identity, often with broader reach than a human user would need. If inspection happens after content has already entered the model context, containment becomes harder and governance becomes reactive.

Practical implication: inspect tool calls and agent context before sensitive data reaches the model or downstream workflow.

Why inline remediation matters more than alerting alone

Traditional DLP often produces alerts, queues or analyst worklists, which is workable for slow human workflows but weak for machine-speed movement. Nightfall’s framing is that modern control has to act inline, with quarantine, redaction, deletion, revocation or user coaching occurring in the same workflow where the exposure appears. This matters because the value of detection falls sharply if the data has already been copied, shared or embedded elsewhere. In practice, remediation latency becomes a security control in its own right, especially for SaaS and AI-integrated environments.

Practical implication: design controls that can block or modify data in flow, not just record the event.

Threat narrative

Attacker objective: The objective is to move sensitive data out of the best-controlled environment and into less governed SaaS or AI workflows where it is harder to contain.

1. Entry occurs when sensitive data is accessed through Microsoft 365, a SaaS app or an MCP-connected tool path that sits outside the strongest native control boundary.
2. Credentialed or authorised machine workflows then move that data into agent context, prompt history or downstream application fields where the original policy no longer applies cleanly.
3. Exposure escalates when the data is copied, shared or transformed across browser sessions and SaaS integrations faster than alert-based remediation can intervene.
4. Impact is unauthorised disclosure or propagation of PII, PCI, PHI, secrets or credentials across channels the original DLP posture does not fully govern.

Breaches seen in the wild

• Smithery.ai MCP hosting breach 2025: A Smithery.ai build flaw gave GitGuardian a live fly.io token controlling 3,000+ hosted MCP servers and the API keys their clients sent.
• CoPhish OAuth phishing via Copilot Studio: Datadog showed Copilot Studio agents on a Microsoft domain can front OAuth consent phishing and forward stolen tokens; no victims reported.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

AI data security is now a governance problem about workflow boundary control, not just content inspection. The article shows that legacy DLP assumptions break when sensitive data moves through AI agents, MCP servers and heterogeneous SaaS paths. The practical point is that classification alone does not govern disclosure if the enforcement plane cannot follow the workflow.

MCP expands the number of machine identities that can touch sensitive data without looking like a conventional user session. That matters because the access path may be technically authorised while still being governance-poor, especially when tool calls can retrieve records, secrets or customer data at runtime. Practitioners need to treat the MCP layer as part of the identity and access surface, not just an integration detail.

Remediation latency is becoming a security control, not an operational inconvenience. Alerting after the fact does not meaningfully reduce exposure when AI systems and SaaS workflows can move data instantly. This shifts the control objective toward inline containment, where the decision to redact, quarantine or revoke happens at the moment of disclosure.

Data security programmes need a named concept for the control gap this article exposes: the AI data movement blind spot. That blind spot appears when policy is still anchored to the primary collaboration suite while the real disclosure path has shifted to agents, browsers and connected SaaS tools. Practitioners should assume that any control design which stops at the tenant boundary is incomplete.

OWASP-NHI and MCP-related governance intersect here because machine-mediated workflows behave like non-human access paths with their own lifecycle and exposure profile. The relevant question is not whether data is classified, but whether the machine path retrieving it is inventoried, bounded and observable. Identity teams and data security teams need shared ownership of that boundary.

From our research library:

• 24,008 unique secrets were exposed in MCP configuration files in 2025 alone, the protocol's first year of widespread adoption, according to the State of Secrets Sprawl 2026.
• Read next: MCP Security Guide

What this signals

The control problem here is not whether organisations have a DLP product, but whether that product still governs disclosure once AI agents and MCP servers start acting as data-moving intermediaries. In practice, the risk boundary now sits at runtime tool calls and browser-mediated interactions, not just at the collaboration suite.

AI data movement blind spot: that is the gap between where policy is written and where data is actually disclosed. Organisations that leave this gap ungoverned will keep seeing coverage, latency and remediation failures whenever agents move data across SaaS and browser contexts.

The broader programme implication is that identity, endpoint and data security teams have to share ownership of machine-mediated access paths. According to the 2026 Infrastructure Identity Survey, 70% of organisations grant AI systems more access than they would give a human employee performing the exact same job, which makes scoped access and inline control a near-term governance issue rather than a future concern.

For practitioners

• Map AI and SaaS data movement paths Inventory where sensitive data can flow through Microsoft 365, browser AI, SaaS connectors and MCP tool calls, then document which paths are covered only by alerts versus inline controls.
• Treat agent and MCP access as governed runtime identity Require explicit control review for AI agents, copilots and MCP-connected tools that can retrieve or transform protected data, including the scope of tool calls and downstream destinations.
• Prioritise inline remediation over queue-based response Use redaction, quarantine, deletion, revoke and block actions where possible so exposure is contained before copied content spreads into browser sessions or SaaS records.
• Validate non-Microsoft coverage before scaling AI use Test Slack, Salesforce, Google Workspace and browser-based AI coverage separately, because connector prerequisites, licensing and remediation depth vary by application.

Key takeaways

• Modern DLP failures increasingly come from data moving outside the ecosystem where native controls are strongest, especially across AI agent and SaaS workflows.
• Machine-mediated access paths change the security problem from static file protection to runtime governance of disclosure, inspection and remediation.
• Inline containment is now the differentiator that determines whether sensitive data is merely detected or actually prevented from spreading.

Key terms

• AI Data Privacy: AI data privacy is the discipline of protecting personal and regulated information as it moves through training, tuning, inference, and operational use. It focuses on preventing exposure, memorization, misuse, and unauthorized reuse of sensitive data in AI systems that process large, varied, and constantly changing inputs.
• MCP Server: An MCP server is a tool endpoint that connects an AI agent to external systems and data sources through Model Context Protocol. Because it extends what the agent can reach, it becomes part of the identity and access surface and must be reviewed like any other privileged connector.
• Inline remediation: Inline remediation is the practice of presenting security guidance directly in the developer environment where code is written. It reduces context-switching and can speed up fixes, but it only improves governance when the guidance is accurate, explainable, and consistently adopted by engineering teams.
• Human-Mediated Access: Human-mediated access is any identity event that depends on a person making a judgment or taking an action to grant, restore, or expand access. Examples include password resets, approval workflows, and exception handling, all of which attackers can target through manipulation or impersonation.

Deepen your knowledge

NHI Mgmt Group covers identity security, NHI governance, and agentic AI through independent research, practitioner guides, and the NHI Foundation Level course. Explore the NHI Foundation Level course, the industry's only accredited NHI security programme, to connect machine identity governance with your broader security programme.