Talking Security: Insights from Microsoft Security Experts

Securing AI Agents: Blueprints and Agent 365 with Derk van der Woude

Talking Security: Insights from Microsoft Security Experts

Show Notes

Got something to say to this podcast? Send a voicemail, and you might hear yourself on the next episode! How do you secure AI agents in Microsoft Entra? Security MVP Derk van der Woude explains agent identity blueprints, classic vs modern agents and Agent 365. In the relaunch of MVP Security Insights, Frans and Pouyan talk with Derk about AI agent security from both the attacker and the defender side.

In this episode • What a secure AI assessment and a secure AI landing zone look like in practice • Workload identity risk: multi-tenant apps with high-privileged application permissions • Classic vs modern agents, and why most security controls only work on modern agents • Agent identity blueprints: the four-layer model and why attackers go after the blueprint • What you won't see in the UI: inherited permissions that only show up in the token • Agent 365 explained: control plane, license and security controls in Entra, Defender, Purview and Intune • Conditional Access for agents and the new AgentsInfo hunting table • Where to start if you have one week to secure the agents in your tenant

Chapters 00:00 Welcome to MVP Security Insights 02:27 From a 486 to Microsoft Certified Master 07:12 Building a secure AI landing zone 11:57 Workload identity posture management 15:04 Classic vs modern agents 19:53 Agent identity blueprints explained 26:46 What the UI and audit logs miss 31:12 Agent 365 and Conditional Access 37:53 Where to start in one week 41:59 Rapid fire, IT/OT and advice

Guest: Derk van der Woude – CTO Cybersecurity at BBTG, Microsoft Security MVP (https://blue16.nl)

Hosts: Frans Oudendorp & Pouyan Khabazi

Watch on YouTube: https://youtu.be/JgH00RYLbHg More episodes: https://talkingsecurity.nl

More from Talking Security: Insights from Microsoft Security Experts

Dec 11, 2025

Got something to say to this podcast? Send a voicemail, and you might hear yourself on the next episode! Join Frans Oudendorp and Pouyan Khabazi in this special episode of Talking Security – Let’s Talk, where we sit down with Javier Soriano, Principal Product Manager for Microsoft Sentinel. We dive deep into: - The evolution of Sentinel from day zero to today - The new Sentinel Data Lake and how it transforms long-term log retention and investigations - Why Sentinel Graph matters for SOC teams - The Model Context Protocol (MCP) and its role in agentic AI workflows - What’s next for cloud-native security: automation, AI, and new operating models If you’re curious about the future of Microsoft Sentinel and want practical insights for your security team, this episode is packed with value.

Nov 28, 2025

Got something to say to this podcast? Send a voicemail, and you might hear yourself on the next episode! In this episode of Talking Security – MVP Security Insights, we sit down with Ronny de Jong to explore his remarkable journey from cybersecurity MVP to his current role at Microsoft. Ronny shares insights on: 💎 His career path and what inspired him to join Microsoft 💎 The unique cybersecurity challenges facing governments and public institutions 💎 How Microsoft’s security portfolio supports national resilience 💎 Balancing innovation, compliance, and operational realities in the public sector 💎 Future trends in threat intelligence and security operations 💎 Practical advice for aspiring cybersecurity professionals 💎 The meaning of true cyber resilience and moving from reactive to proactive security

Oct 8, 2025

Got something to say to this podcast? Send a voicemail, and you might hear yourself on the next episode! In this episode of Let’s Talk, part of the Talking Security podcast, Frans Oudendorp and Pouyan Khabazi break down the biggest announcements from Microsoft Secure 2025. We explore how Microsoft Sentinel is evolving into an agentic AI platform, the introduction of Sentinel Graph and Model Context Protocol (MCP), and how Security Copilot agents are changing the game for SecOps automation. You’ll also hear about: Graph-based context and why it matters for threat detection Developer extensibility for custom connectors and AI agents Sentinel Data Lake for affordable long-term storage Real-world use cases for agentic AI in security operations Plus, we share community highlights, upcoming events like YellowHat 2025 and KustoCon, and a fun geeky quiz to wrap things up. 👉 Question for you: If you could build your own Security Copilot agent, what would it do? Let us know! 🎙️ Stay safe, stay secure, and keep talking security!

Jul 2, 2025

Got something to say to this podcast? Send a voicemail, and you might hear yourself on the next episode! In this episode of Talking Security – MVP Security Insights, Frans Oudendorp and Pouyan Khabazi sit down with Eric Woodruff—Chief Identity Architect at Semperis and long-time identity expert—to explore his journey from managing Active Directory in the public sector to shaping cutting-edge identity strategies in the cloud era. Eric shares what it means to truly be “in” cybersecurity, the evolving role of Entra ID, and the significance of identity research like the UnOAuthorized project. We also dive into global challenges in identity management, the balance between strong security and business agility, and how community collaboration through IDPro is driving vendor-agnostic progress. Whether you're new to identity or a seasoned expert, this conversation is packed with real-world insights, practical advice, and forward-looking trends shaping the future of identity and access management.

Jun 11, 2025

Got something to say to this podcast? Send a voicemail, and you might hear yourself on the next episode! In this episode of our MVP Security Insights series, we sit down with Stefan Schörling—a cybersecurity veteran with over 25 years of experience, SANS-certified professional, and Microsoft MVP.

See all episodes →