https://xdrinternals.com/docs/microsoftxdr/securityforai/ Recent content in Microsoft XDR/SecurityForAi on XDR table schema Hugo en-us https://xdrinternals.com/docs/microsoftxdr/securityforai/agentsinfo/ Mon, 01 Jan 0001 00:00:00 +0000 https://xdrinternals.com/docs/microsoftxdr/securityforai/agentsinfo/ <h1 id="agentsinfo-schema"> AgentsInfo Schema <a class="anchor" href="#agentsinfo-schema">#</a> </h1> <h2 id="table-description"> Table description <a class="anchor" href="#table-description">#</a> </h2> <table> <thead> <tr> <th>TableSection</th> <th>TableType</th> <th>TableSectionName</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td>SecurityForAi</td> <td>Regular</td> <td></td> <td>Inventory information about AI agents discovered by Microsoft Security for AI (Sai) across providers including A365, Copilot Studio, and Azure AI Foundry.</td> </tr> </tbody> </table> <h2 id="table-retention"> Table retention <a class="anchor" href="#table-retention">#</a> </h2> <table> <thead> <tr> <th>HotDays</th> <th>ColdDays</th> <th>TotalInteractiveDays</th> </tr> </thead> <tbody> <tr> <td>30</td> <td>0</td> <td>30</td> </tr> </tbody> </table> <h2 id="schema"> Schema <a class="anchor" href="#schema">#</a> </h2> <table> <thead> <tr> <th>Name</th> <th>Description</th> <th>Type</th> </tr> </thead> <tbody> <tr> <td>AgentId</td> <td>Unique identifier for the agent.</td> <td>String</td> </tr> <tr> <td>Availability</td> <td>The deployment scope of the agent (that is, whether deployed to all users, specific groups, or individual users).</td> <td>String</td> </tr> <tr> <td>Capabilities</td> <td>The intents, actions, skills, and orchestrations of the agent.</td> <td>Object</td> </tr> <tr> <td>Channels</td> <td>The channels or surfaces where the agent can operate, such as Microsoft 365 applications or APIs.</td> <td>Object</td> </tr> <tr> <td>ConnectedAgents</td> <td>List of other agents connected to the agent for multi-agent orchestration.</td> <td>Object</td> </tr> <tr> <td>CreatedDateTime</td> <td>Date and time when the account user was created</td> <td>DateTime</td> </tr> <tr> <td>DeclaredDataSources</td> <td>The data repositories and knowledge sources the agent can access.</td> <td>Object</td> </tr> <tr> <td>DeclaredTools</td> <td>Functional tools the agent can invoke at runtime.</td> <td>Object</td> </tr> <tr> <td>Description</td> <td>Description of the information gathered</td> <td>String</td> </tr> <tr> <td>Endpoints</td> <td>List of agent runtime endpoints, including URL, transport type, and external connectivity flag.</td> <td>Object</td> </tr> <tr> <td>EntraAgentID</td> <td>The agent&rsquo;s unique enterprise application object identifier in Microsoft Entra ID. This is the authoritative identity used for role-based access control (RBAC), lifecycle management, auditing, and Microsoft Graph operations.</td> <td>String</td> </tr> <tr> <td>EntraBlueprintID</td> <td>Entra identity for Blueprint agents. The service principal ID assigned to the Blueprint template from which agent instances are derived.</td> <td>String</td> </tr> <tr> <td>Guardrails</td> <td>Guardrails attached to the agent and their coverage.</td> <td>Object</td> </tr> <tr> <td>InstanceCount</td> <td>Number of agent instances created from the same Microsoft Entra ID agent identity blueprint.</td> <td>Int64</td> </tr> <tr> <td>Instructions</td> <td>The agent&rsquo;s system prompt or instructions that define its behavior.</td> <td>String</td> </tr> <tr> <td>LastPublishedDateTime</td> <td>Date and time when the agent was last published or deployed.</td> <td>DateTime</td> </tr> <tr> <td>LastUpdatedDateTime</td> <td>Date and time when the agent&rsquo;s metadata was last modified.</td> <td>DateTime</td> </tr> <tr> <td>LifecycleStatus</td> <td>The agent&rsquo;s current operational state in the tenant; possible values: Active, Blocked, Uninstalled, Deleted.</td> <td>String</td> </tr> <tr> <td>McpServers</td> <td>The Model Context Protocol (MCP) servers connected to the agent, including server URLs and credential configuration.</td> <td>Object</td> </tr> <tr> <td>Memory</td> <td>The agent&rsquo;s declarative memory store configuration.</td> <td>Object</td> </tr> <tr> <td>Model</td> <td>Model name or number of the product from the vendor or manufacturer; only available if device discovery finds enough information about this attribute</td> <td>String</td> </tr> <tr> <td>Name</td> <td>Display name of the agent.</td> <td>String</td> </tr> <tr> <td>ObservabilityID</td> <td>Unique identifier used to correlate the agent with its usage and activity data in Agents for Microsoft 365.</td> <td>String</td> </tr> <tr> <td>Owners</td> <td>Primary owners of the agent.</td> <td>Object</td> </tr> <tr> <td>Permissions</td> <td>Contains an array of permission objects; each permission object includes PermissionName, TargetAppId, TargetAppDisplayName, PermissionType, PrivilegeLevel, UsageStatus</td> <td>Object</td> </tr> <tr> <td>Platform</td> <td>The platform that provided the information about the agents; possible values: Copilot Studio</td> <td>String</td> </tr> <tr> <td>PublishedStatus</td> <td>The agent&rsquo;s publications status; possible values: Draft, Published.</td> <td>String</td> </tr> <tr> <td>RawAgentInfo</td> <td>Contents of the raw JSON that describes the agent and contains configuration details, as received from the provider</td> <td>Object</td> </tr> <tr> <td>SharedWith</td> <td>The users and security groups the agent has been shared with.</td> <td>Object</td> </tr> <tr> <td>Skills</td> <td>Skills attached to the agent.</td> <td>Object</td> </tr> <tr> <td>SourceAgentId</td> <td>The platform-native identifier for this agent, scoped by OriginatingStore.</td> <td>String</td> </tr> <tr> <td>Timestamp</td> <td>Date and time when the record was generated</td> <td>DateTime</td> </tr> <tr> <td>ToolsAuthenticationType</td> <td>Structured summary of agent identity, authentication, and authorization model.</td> <td>String</td> </tr> <tr> <td>Triggers</td> <td>List of the agent&rsquo;s triggers.</td> <td>Object</td> </tr> <tr> <td>Version</td> <td>Version of the agent.</td> <td>String</td> </tr> </tbody> </table> <h2 id="schema-changes"> Schema changes <a class="anchor" href="#schema-changes">#</a> </h2> <table> <thead> <tr> <th>Date</th> <th>Action</th> </tr> </thead> <tbody> <tr> <td>2026-08-19</td> <td>Table added to tracking</td> </tr> </tbody> </table>