AI Agent Activity

AI Agent Activity — Instructions

Purpose

This skill reports the runtime activity of AI agents built on Agent 365 / Copilot Studio / Microsoft 365 Copilot / Work IQ across a tenant — who invoked which agents, what tools and connectors ran, over which channels, with what token/inference usage, and what the content-safety layer (Prompt Shield jailbreak / XPIA) caught.

It answers "what are the agents actually doing?" — the behavioral counterpart to the configuration-focused ai-agent-posture skill.

Use them together: run ai-agent-posture to find the risky configurations, then run this skill to see which of those agents are active-and-dangerous at runtime.

References:

• Query library (all validated KQL): queries/cloud/agent365_observability.md — this skill references those queries rather than duplicating them. It contains the Plane A + Plane B equivalents, the RawEventData ↔ UnifiedAgentObservability field crosswalk, and the Defender-parity matrix.
• Security for AI native alerts (companion signal): see Core Queries C12 below — for tenants with Microsoft Defender's Security for AI capability enabled, covers the native AlertInfo/AlertEvidence alert family (ServiceSource == "Security for AI": malicious URL, obfuscated/encoded payload, and other runtime-threat alerts) that is broader than, and complementary to, the Prompt Shield jailbreak/XPIA signal in §7.
• Agent 365 Observability SDK
• Agent 365 observability concepts
• Detect and investigate threats to AI agents using Microsoft Defender (Preview)

📑 TABLE OF CONTENTS

1. Critical Workflow Rules
2. Data Plane Detection & Selection — the core generalization
3. Execution Workflow — phase-by-phase
4. Scopes — tenant-wide / single-agent / single-user
5. Agent Clustering Methodology — LLM-derived, non-rigid
6. Risk Signal Catalog — flexible signals (no composite score)
7. Core Queries — compact adapted set for report generation (C0 = prompt/reply content)
8. Mermaid Diagram Templates — user→agent→tool paths
9. Output Modes — inline / markdown / both
10. Report Templates — tenant-wide / single-agent / single-user
11. Known Pitfalls
12. Quality Checklist

⚠️ CRITICAL WORKFLOW RULES - READ FIRST ⚠️

1. 🔴 DETECT THE DATA PLANE FIRST. Probe UnifiedAgentObservability (Plane A) and CloudAppEvents (Plane B) before any analysis and proceed with whatever exists. Never assume a plane is present. See Data Plane Detection & Selection.

2. 🔴 SAFETY VERDICTS ONLY COME FROM CloudAppEvents CopilotInteraction. UnifiedAgentObservability has no jailbreak/XPIA column. If CloudAppEvents is absent, state the safety gap explicitly.

3. 🔴 If Plane A exists, run C0 — prompt/reply text is the highest-value evidence here. parse_json(EventOriginalRequestDetails).text returns empty on 100% of rows (no .text key); replies for Copilot Studio agents are on AISpanOutput. Never report a content gap without C0's coverage check.

4. ASK the user for scope and output format before generating:

   • Scope: tenant-wide (default) · single-agent · single-user
   • Output: inline chat · markdown file (reports/ai-agent-activity/) · both

5. ⛔ Evidence-based analysis only. Report ONLY what query results show. Use the explicit absence pattern (✅ No [finding] detected) for 0-result queries. Never invent agents, users, IPs, or counts.

6. 🔴 NO composite /100 score. Surface the Risk Signal Catalog items, assign each a 🟢/🟡/🔴 verdict from the evidence, and show the reasoning.

7. 🔴 DERIVE agent clusters from the actual inventory using the Agent Clustering Methodology. The example categories are illustrative only.

8. Timestamp column depends on the plane — UnifiedAgentObservability and CloudAppEvents in Data Lake use TimeGenerated; CloudAppEvents via Advanced Hunting uses Timestamp. See Known Pitfalls.

9. Enrich notable IPs (highest-volume agent egress IP, any jailbreak-source IP) with enrich_ips.py — parse the JSON via PowerShell, never read_file the .txt.

10. Report elapsed time after each phase.

Data Plane Detection & Selection

The Agent 365 Observability SDK fans the same agent telemetry out to independent sinks. This skill uses the queryable planes and picks whichever the tenant has. (A fourth plane — Purview / DSPM for AI — carries the sensitive content of prompts; this skill points to it but does not build queries against it.)

Phase 0 detection probes

Run both probes (safe, cheap). Proceed based on which returns rows.

Probe A — Plane A present?

// mcp_sentinel-data_query_lake, workspaceId: "default"
UnifiedAgentObservability
| where TimeGenerated > ago(1d)
| summarize Rows = count()

• Returns rows → Plane A available. (If it returns SemanticError: Failed to resolve table, the connector is not enabled → Plane A absent.)

Probe B — Plane B present?

// RunAdvancedHuntingQuery (or query_lake with workspace GUID)
CloudAppEvents
| where Timestamp > ago(1d)
| where ActionType in ("InvokeAgent","InferenceCall","ExecuteToolBySDK","ExecuteToolByGateway","ExecuteToolByMCPServer","CopilotInteraction")
| summarize Rows = count()

• Returns rows → Plane B available.

Probe C — Plane C (CopilotActivity) present?

// RunAdvancedHuntingQuery (or query_lake)
CopilotActivity
| where TimeGenerated > ago(1d)
| summarize Rows = count()

• Returns rows → Plane C available. Table-not-found is unlikely (this is the standard Microsoft Copilot unified-audit connector) but still probe it — some tenants may not have the connector enabled.

Selection matrix

Plane C is additive, not a substitute — always layer it in when present (regardless of the A/B outcome), specifically for §7a below. It does not change the primary-plane decision above; it supplements whichever plane was selected with governance/runtime-protection signal neither A nor B carries.

🔴 MANDATORY report banner

Every report MUST open with a plane banner so the analyst knows what was and wasn't inspectable:

> 🛰️ Data plane: <A · Data Lake | B · Defender | A+B> [+ C · CopilotActivity governance].
> Prompt text / tool args / tokens: <available (Plane A) | not available (Plane B — content is in Purview)>. 
> Safety verdicts (jailbreak/XPIA): <available via CloudAppEvents | UNAVAILABLE — CloudAppEvents not present>.
> ClientIP source enrichment: <available (Plane B) | not available (Plane A only)>.
> Governance/runtime-protection (Plane C): <available — CopilotActivity present | not available>.

Execution Workflow

Phase 0 — Detect, scope, mode

1. Run Probe A and Probe B → apply the selection matrix.
2. Ask the user for scope (tenant-wide / single-agent / single-user) and output mode (inline / markdown / both).
3. Confirm the lookback (default 30d). If >30d and using Plane B, use query_lake against the workspace GUID, not Advanced Hunting (AH silently truncates to 30d).

Phase 1 — Volume & inventory

• ActionType volume breakdown (events, distinct users, first/last seen).
• Daily event trend (for the volume mermaid chart).
• Agent inventory — every named agent with event count, distinct users, channels.
• If Plane A is present: run C0 now to confirm content coverage and capture the prompt/reply corpus. Do this before writing any "content not available" statement.

Phase 2 — Tool / connector usage

• Tool-invocation inventory per agent (tool name, tool type, calls).
• Tool-type distribution across the fleet.
• Agent-to-agent handoffs (C13; on Plane A also run C14 blueprint-family discovery) — detect parent→sub-agent orchestration for the Phase 5 diagrams.
• (optional) New-tool first-seen vs prior baseline.

Phase 3 — Channel & user distribution

• Per-(user, channel) prompt volume; source-IP spread (Plane B).

Phase 4 — Safety layer (requires CloudAppEvents)

• Prompt Shield jailbreak / XPIA verdicts by agent, user, channel.
• Drill down the most recent / highest cluster; correlate source IP.
• 🔴 For every flagged turn, pull the actual prompt AND the agent's reply via C0. The verdict boolean alone cannot tell you whether the attempt succeeded. See Detection ≠ prevention.
• If the tenant has Microsoft Defender's Security for AI capability enabled, also run C12 below — this surfaces a broader runtime-threat alert family (malicious URL, obfuscated/encoded payload, etc.) as full Defender alerts/incidents, not just a jailbreak boolean.

Phase 4a — Governance & runtime-protection signal (Plane C, if present)

• Run the Plane C supplemental queries — AppHost/RecordType surface breakdown, plugin/agent lifecycle events, and Defender Runtime Protection tool FailClose posture.
• This is genuinely additive over Plane A/B (validated empirically — see the Plane C row above) and should be run regardless of which plane was primary, whenever Probe C returns rows.

Phase 5 — Clustering & path derivation

• Apply the Agent Clustering Methodology: group agents into environment-specific clusters and name them.
• Treat a parent + sub-agent(s) sharing a blueprint (C14) or linked by a handoff (C13) as one multi-agent family — cluster them together rather than as unrelated agents.
• Build the user→agent→tool mermaid diagram for each material cluster. Where C13/C14 found handoffs, use the Agent → Agent handoff + tools diagram so both agent→tool and agent→agent edges appear in one topology.

Phase 6 — IP enrichment

• Enrich notable IPs (top agent egress IP, jailbreak-source IPs) with enrich_ips.py. Parse the JSON via PowerShell.

Phase 7 — Risk signals + report

• Evaluate the Risk Signal Catalog; assign 🟢/🟡/🔴 from evidence.
• Generate the report in the requested mode/scope.
• Report total elapsed time.

Scopes

Ask which scope at the start. All three share Phases 0–1; they differ in depth and filtering.

Tenant-wide (default)

Full-fleet inventory + clustering + safety + risk signals. Uses the tenant-wide template.

Single-agent drill-down

Filter every query to one agent name. Include:

• Agent inventory row (events, users, channels, first/last seen).
• Tool inventory for the agent; per-tool call counts.
• Sub-agent handoffs — does this agent hand off to (or get handed off from) another agent? Run C13 scoped to the agent (| where Source == "<agent>" or Target == "<agent>"); on Plane A check its blueprint family (C14). Draw the Agent → Agent handoff + tools diagram if any handoff exists.
• User list + channels + (Plane B) source IPs.
• Session reconstruction — Plane A: full prompt+tool+reply timeline (query library Query 3a/3b). Plane B: metadata-only timeline (agent/tool/channel/time, no content).
• Safety flags for the agent (CopilotInteraction). Uses the single-agent template.

Single-user drill-down

Filter to one UPN. Include:

• Every agent the user invoked + prompt counts + channels + IPs.
• Tools that ran on the user's behalf.
• Safety flags attributed to the user.
• Plane A: the user's prompt text where relevant. Uses the single-user template.

Agent Clustering Methodology

Agent categories are environment-specific — derive them, don't impose them. Group the observed agents into a small number of clusters (typically 3–6) using any combination of these signals, then give each cluster a short descriptive name from what the data shows:

Illustrative example clusters (NOT a required taxonomy — name your own): Personal / Autonomous background agents, Security-Operations agents, Finance agents, Customer/Supplier-facing agents, Build/Test agents. Your report's clusters should reflect this tenant's data.

For each material cluster, produce: a short table (agents, primary users, channels, representative tools) + a user→agent→tool mermaid diagram (templates below).

Volume concentration is common and usually benign: one autonomous/background agent frequently dominates total tool-call volume (single user, single IP, steady 24/7 cadence). Call it out explicitly and separate it from the human-interactive long tail so it doesn't drown the analysis.

Risk Signal Catalog

No composite /100 score. Evaluate each signal below against the query evidence, assign a 🟢/🟡/🔴 verdict, and show the reasoning. Only include signals the available plane can support (note gaps).

Present these as a findings table with per-signal verdict, evidence, and a recommendation.

Core Queries

These are the compact, report-driving queries. The full validated set (Plane A 1a/4a/8a, Plane B 1b/4b/7b/8b, safety Query 9, session reconstruction 3a/3b, tool failures Q6) lives in queries/cloud/agent365_observability.md — use those for anything beyond the basics.

Timestamp column: TimeGenerated for UnifiedAgentObservability and for CloudAppEvents via Data Lake; Timestamp for CloudAppEvents via Advanced Hunting. Queries below show the CloudAppEvents (Plane B) form using Timestamp — swap to TimeGenerated when running via query_lake.

C0 — Prompt & reply content extraction (Plane A, MANDATORY when Plane A is present)

🔴 parse_json(EventOriginalRequestDetails).text returns empty on 100% of rows — there is no .text key. The payload shape varies by agent hosting platform, and Copilot Studio agent replies are emitted on a separate AISpanOutput event, not on InvokeAgent. Use the shape-aware extractor below.

Payload shape crosswalk (validated live)

The extractor

let ReqText = (s:string) { case(
    isempty(s), "",
    s startswith "[", tostring(parse_json(s)[0].parts[0].content),   // Copilot Studio OTel array
    s startswith "{", "",                                            // JSON object = tool args, not a message
    s) };                                                            // bare string = Foundry/Teams message
let ResText = (s:string) { case(
    isempty(s), "",
    s == "[]", "<<EMPTY REPLY — blocked/suppressed>>",                // meaningful safety signal, not missing data
    s startswith "[", tostring(parse_json(s)[0].parts[0].content),
    s startswith "{", "",
    s) };
UnifiedAgentObservability
| where TimeGenerated > ago(30d)
| where EventOriginalType in ("InvokeAgent","AISpanOutput")
| extend Agent = iff(isnotempty(SrcAgentName), SrcAgentName, tostring(TargetAgentName))
| extend Prompt = ReqText(EventOriginalRequestDetails),
         Reply  = ResText(EventOriginalResultDetails)
| where isnotempty(Prompt) or isnotempty(Reply)
| project TimeGenerated, EventOriginalType, Agent, ActorUsername, EventSessionId,
          Prompt = substring(Prompt, 0, 1000), Reply = substring(Reply, 0, 1000), EventUid
| order by TimeGenerated asc

Reading the output: a Copilot Studio turn spans two rows — the InvokeAgent row carries the prompt, the following AISpanOutput row carries the reply. A Foundry/Teams turn is a single InvokeAgent row carrying both. Do not conclude "reply not captured" from an empty InvokeAgent result column without checking for a paired AISpanOutput.

Multi-part messages: [0].parts[0] takes the first part of the first message, which covers ordinary user turns. For multi-part/multi-modal payloads, mv-expand the array instead.

Full text: substring(...) truncates for readability — pull the untruncated payload by EventUid for forensic review.

Coverage self-check (run this before writing any content-gap statement)

UnifiedAgentObservability
| where TimeGenerated > ago(30d)
| where isnotempty(EventOriginalRequestDetails) or isnotempty(EventOriginalResultDetails)
| extend ReqShape = case(EventOriginalRequestDetails startswith "[", "json-array",
                         EventOriginalRequestDetails startswith "{", "json-object",
                         isempty(EventOriginalRequestDetails), "empty", "bare-string"),
         ResShape = case(EventOriginalResultDetails startswith "[", "json-array",
                         EventOriginalResultDetails startswith "{", "json-object",
                         isempty(EventOriginalResultDetails), "empty", "bare-string")
| summarize Rows = count(), Agents = make_set(iff(isnotempty(SrcAgentName), SrcAgentName, tostring(TargetAgentName)), 6)
    by EventOriginalType, ReqShape, ResShape
| order by EventOriginalType asc, Rows desc

If this returns rows, content exists — any failure to surface it is an extraction bug, not a telemetry gap. Only report a content gap when this query returns 0 rows or the shapes are all empty.

Detection ≠ prevention: always check the reply

A Prompt Shield JailbreakDetected = true verdict means the classifier fired, not that the request was blocked. Validated live: a system-prompt-extraction prompt was flagged true and the agent still returned its full system prompt, while an unflagged DAN-style prompt in the same session was suppressed ([] reply). Always pair the verdict with the reply text and report the outcome explicitly:

Also inspect partial compliance: an agent that refuses the literal action ("I can't send email") but still produces the payload (a ready-to-paste draft containing the exfil address/URL) has not actually refused.

C1 — ActionType volume breakdown (Plane B)

CloudAppEvents
| where Timestamp > ago(30d)
| where ActionType in ("InvokeAgent","InferenceCall","ExecuteToolBySDK","ExecuteToolByGateway","ExecuteToolByMCPServer","CopilotInteraction")
| summarize Events = count(), DistinctUsers = dcount(AccountId), FirstSeen = min(Timestamp), LastSeen = max(Timestamp) by ActionType
| order by Events desc

Plane A equivalent: UnifiedAgentObservability | where TimeGenerated > ago(30d) | summarize Events=count() by EventOriginalType.

C2 — Agent inventory (Plane B)

CloudAppEvents
| where Timestamp > ago(30d)
| where ActionType in ("InvokeAgent","InferenceCall","ExecuteToolBySDK","ExecuteToolByGateway","ExecuteToolByMCPServer")
| extend d = parse_json(RawEventData)
| extend AgentName = tostring(d.AgentName), TargetAgent = tostring(d.TargetAgentName)
| extend AgentName = iif(isnotempty(AgentName), AgentName, TargetAgent)
| summarize Events = count(),
            UserPrompts = countif(ActionType == "InvokeAgent" and tostring(d.AgentBlueprintId) == "00000000-0000-0000-0000-000000000000"),
            ToolCalls   = countif(ActionType startswith "ExecuteTool"),
            DistinctUsers = dcountif(tostring(d.UserId), tostring(d.UserId) != "N/A" and isnotempty(tostring(d.UserId))),
            SourceIPs   = dcount(tostring(d.ClientIP)),
            Channels    = make_set(tostring(d.ChannelName), 10),
            FirstSeen = min(Timestamp), LastSeen = max(Timestamp)
    by AgentName
| order by Events desc

Plane A equivalent: query library Query 1a (adds token usage + session-join agent-name attribution).

C3 — Tool inventory per agent (Plane B)

CloudAppEvents
| where Timestamp > ago(30d)
| where ActionType in ("ExecuteToolBySDK","ExecuteToolByGateway","ExecuteToolByMCPServer")
| extend d = parse_json(RawEventData)
| extend Agent = tostring(d.AgentName), ToolName = tostring(d.ToolName), ToolType = tostring(d.ToolType)
| where isnotempty(ToolName)
| summarize Calls = count(), Sessions = dcount(tostring(d.SessionIdentity)),
            FirstCall = min(Timestamp), LastCall = max(Timestamp)
    by Agent, ToolName, ToolType, ToolPath = ActionType
| order by Agent asc, Calls desc

Plane A equivalent: query library Query 4a.

C4 — Tool-type distribution (Plane B)

CloudAppEvents
| where Timestamp > ago(30d)
| where ActionType in ("ExecuteToolBySDK","ExecuteToolByGateway","ExecuteToolByMCPServer")
| extend d = parse_json(RawEventData)
| where isnotempty(tostring(d.ToolName))
| summarize Calls = count(), Agents = dcount(tostring(d.AgentName)) by ToolType = tostring(d.ToolType)
| order by Calls desc

C5 — Channel & user distribution (Plane B)

CloudAppEvents
| where Timestamp > ago(30d)
| where ActionType == "InvokeAgent"
| extend d = parse_json(RawEventData)
| where tostring(d.AgentBlueprintId) == "00000000-0000-0000-0000-000000000000"   // user prompts only
| where tostring(d.UserId) != "N/A" and isnotempty(tostring(d.UserId))
| summarize Prompts = count(), Conversations = dcount(tostring(d.ConversationId)),
            SourceIPs = dcount(tostring(d.ClientIP)), Agents = make_set(tostring(d.TargetAgentName), 10),
            FirstPrompt = min(Timestamp), LastPrompt = max(Timestamp)
    by Actor = tostring(d.UserId), Channel = tostring(d.ChannelName)
| order by Prompts desc

Plane A equivalent: query library Query 8a.

C6 — Daily event trend (for the volume chart, Plane B)

CloudAppEvents
| where Timestamp > ago(30d)
| where ActionType in ("InvokeAgent","InferenceCall","ExecuteToolBySDK","ExecuteToolByGateway","ExecuteToolByMCPServer")
| summarize Events = count(), Users = dcount(AccountId) by bin(Timestamp, 1d)
| order by Timestamp asc

C7 — Safety: Prompt Shield jailbreak / XPIA (ALWAYS CloudAppEvents)

CloudAppEvents
| where Timestamp > ago(30d)
| where ActionType == "CopilotInteraction"
| where RawEventData has_any ("JailbreakDetected","jailbreakDetected","xpiaDetected","indirectPromptInjection","classifications")
| extend P = parse_json(RawEventData)
| mv-expand Msg = P.CopilotEventData.Messages
| extend Jb = tobool(coalesce(Msg.JailbreakDetected, Msg.jailbreakDetected)),
         Xpia = tobool(coalesce(Msg.xpiaDetected, Msg.indirectPromptInjectionDetected))
| where Jb == true or Xpia == true
| extend AgentName = tostring(coalesce(P.AgentName, P.CopilotEventData.TargetAgentName)),
         UserUpn = tostring(P.UserId), AppHost = tostring(P.CopilotEventData.AppHost)
| summarize Hits = count(), Users = dcount(UserUpn), FirstSeen = min(Timestamp), LastSeen = max(Timestamp)
    by AgentName, AppHost, Verdict = case(Jb, "jailbreak", Xpia, "xpia", "other")
| order by Hits desc

JailbreakDetected is PascalCase in current tenants. Drill a cluster by adding | where tostring(P.UserId) =~ "<upn>" and projecting TimeGenerated, IPAddress, AgentName, ThreadId=tostring(P.CopilotEventData.ThreadId).

C13 — Agent-to-agent handoff detection (Plane B)

Detects sub-agent handoffs — a parent agent routing a turn to a sub-agent — plus every agent→tool edge, in one edge list ready for the Agent → Agent handoff + tools diagram. There is no dedicated "Agent A invoked Agent B" event: a handoff is revealed by a compound ConversationId on the sub-agent's InvokeAgent rows — the parent's own ConversationId, then _, then a new child GUID (<parentConversationId>_<childConversationId>). Safe to split on _ because conversation GUIDs use only hyphens.

let Lookback = 30d;
let Raw =
    CloudAppEvents
    | where Timestamp > ago(Lookback)
    | where ActionType in ("InvokeAgent","ExecuteToolBySDK","ExecuteToolByGateway","ExecuteToolByMCPServer")   // most selective filter first
    | extend d = parse_json(RawEventData)   // parse once
    | extend SrcAgent = tostring(d.AgentName), DstAgent = tostring(d.TargetAgentName),
             ToolName = tostring(d.ToolName), ToolType = tostring(d.ToolType),
             ConvId = tostring(d.ConversationId), SessionId = tostring(d.SessionIdentity)
    | extend ConvParts = split(ConvId, "_")
    | extend RootConvId = tostring(ConvParts[0]), IsSubThread = array_length(ConvParts) > 1;
let ThreadOwner = Raw
    | where ActionType == "InvokeAgent" and isnotempty(DstAgent)
    | summarize OwnerAgent = take_any(DstAgent) by ConvId;
let AgentToTool = Raw
    | where ActionType in ("ExecuteToolBySDK","ExecuteToolByGateway","ExecuteToolByMCPServer")
    | where isnotempty(SrcAgent)
    | summarize Count = count(), Sessions = dcount(SessionId), FirstSeen = min(Timestamp), LastSeen = max(Timestamp)
        by Source = SrcAgent, EdgeType = "Agent -> Tool", Target = ToolName, Detail = ToolType;
let AgentToAgent = Raw
    | where ActionType == "InvokeAgent" and IsSubThread
    | join kind=leftouter (ThreadOwner | project RootConvId = ConvId, ParentAgent = OwnerAgent) on RootConvId
    | where isnotempty(ParentAgent) and ParentAgent != DstAgent
    | summarize Count = count(), Sessions = dcount(SessionId), FirstSeen = min(Timestamp), LastSeen = max(Timestamp)
        by Source = ParentAgent, EdgeType = "Agent -> Agent (handoff)", Target = DstAgent, Detail = "sub-agent conversation";
union AgentToTool, AgentToAgent
| project Source, EdgeType, Target, Detail, Count, Sessions, FirstSeen, LastSeen
| order by Source asc, EdgeType asc, Count desc

Plane A equivalent: query library Query 10b (same edge shape, simpler — SrcAgentName/TargetAgentName/ToolName are typed columns, no RawEventData parsing). Scope to one agent by appending | where Source == "<Agent>" or Target == "<Agent>".

C14 — Agent-family discovery via shared blueprint (Plane A only)

Groups agent identities that share a SrcAgentBlueprintId — a direction-agnostic signal that a parent orchestrator and its sub-agent(s) belong to the same deployed multi-agent solution. CloudAppEvents never populates the sub-agent's identity, so this cross-check is Data-Lake-only. Use it as a fast tenant-wide sweep to find handoff candidates, then run C13 for direction + counts.

// mcp_sentinel-data_query_lake, workspaceId: "default"
UnifiedAgentObservability
| where TimeGenerated > ago(30d)
| where isnotempty(SrcAgentName) and isnotempty(SrcAgentBlueprintId) and SrcAgentBlueprintId != "00000000-0000-0000-0000-000000000000"
| summarize Agents = make_set(SrcAgentName), AgentIds = make_set(SrcAgentId), Events = count() by SrcAgentBlueprintId
| extend AgentCount = array_length(Agents)
| where AgentCount > 1
| order by AgentCount desc

A row with AgentCount > 1 is a candidate multi-agent solution. Keep the zero-GUID SrcAgentBlueprintId exclusion — M365 Copilot built-ins all share it and would otherwise collapse into one false-positive "family."

Scope filters

• Single-agent: add | where tostring(d.AgentName) =~ "<agent>" (or tostring(P.AgentName) / tostring(P.CopilotEventData.TargetAgentName) for safety) to C2–C7.
• Single-user: add | where tostring(d.UserId) =~ "<upn>" (or tostring(P.UserId) for safety).

Plane C supplemental queries — CopilotActivity governance & runtime-protection

Run these whenever Probe C returns rows, in addition to whichever of Plane A/B was selected as primary. They surface signal that neither Plane A nor Plane B carries. Full query set and pitfalls: queries/cloud/copilot_activity_investigation.md.

C8 — Full surface breakdown by AppHost/RecordType

CopilotActivity
| where TimeGenerated > ago(30d)
| summarize Events = count(), Actors = dcount(ActorName), Agents = dcountif(AgentId, isnotempty(AgentId)),
            FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated)
    by RecordType, AppHost
| order by Events desc

Reveals surfaces the Plane B ActionType filter misses entirely — Security Copilot (AppHost prefixed SecurityCopilot-<guid>, frequently the single largest volume source in the tenant), Edge, SharePoint, M365AdminCenter, OutlookSidepane, Copilot Studio, pva-maker-evaluation. Use this to sanity-check that the Plane B agent inventory isn't missing an entire surface.

C9 — Defender Runtime Protection tool evaluations (fail-close posture)

CopilotActivity
| where TimeGenerated > ago(30d)
| where RecordType == "CopilotInteraction"
| extend AR = parse_json(tostring(LLMEventData.AccessedResources))
| mv-expand AR
| where tostring(AR.Type) == "SecurityWebhook"
| extend EvalText = tostring(AR.Action)
| extend ToolName = extract(@"Evaluated tool name: ([^,]+)", 1, EvalText),
         FailClose = extract(@"Fail close configuration is set to: (\w+)", 1, EvalText)
| summarize Evaluations = count() by ToolName, FailClose
| order by Evaluations desc

High-value, Plane-C-exclusive signal. Flag any sensitive tool name (mail-send, data-write, security-query connectors) with FailClose = False — the agent proceeds even if the security evaluation can't complete. This has no equivalent in Plane A or Plane B.