Secure AI & Governance Newsletter: November 2026

The riskiest setting in your tenant is the one nobody chose

AI risk rarely arrives as a breach. It arrives as a default: a connector anyone can add, an account nobody reviewed, a sharing link your policies don't cover. This month, we look at the settings that quietly decide how exposed your AI really is. The question is no longer, "Did we turn the right controls on?" It is now:

• Can any maker connect an agent to any API?
• Whose identity is each agent using?
• Does an attacker need a zero-day, or just your defaults?
• Do your sharing policies cover the link Microsoft is about to ship?

🛡️ Threat Spotlight: The Attacker Who Doesn't Need a Zero-Day

Mythos-Ready Microsoft 365 Security Playbook (Free E-Book)

AI that reasons like a pen tester can turn weeks of reconnaissance into hours. It doesn't need an exploit. It needs a "temporary" Conditional Access exclusion, an app still holding permissions from a finished project, or an agent whose maker has left. Exposure lives in the defaults you stopped looking at. Kanwal Khipple's free playbook covers 12 misconfigurations attackers' chain together, a 15-minute scorecard and a 90-day plan using controls you already license.

→ Get the free playbook

🔦 Featured Story: The Setting Nobody Chose

Any Maker Can Connect an Agent to Almost Any API

Add a tool, enter a server name and a URL, and an agent can reach an outside API or MCP server. For MCP, authentication even comes preselected as None. The control that stops it isn't in Copilot Studio. It lives in your Power Platform data policy, and one tenant rule covers custom connectors and MCP servers alike. Unreviewed connectors are how agent sprawl becomes the new shadow IT.

→ Close the connector door before agents walk through it

🧠 The Strategic Shift: Agent Identity Is Leaving the Service Account

Your Agent Doesn't Need a Password, It Needs a Policy

Many agents still run on a service account: a regular user with a password, MFA and a license, shared by whoever built the agent. Copilot Studio agent accounts replace that with an identity Microsoft issue. There's no password to rotate, and you govern it with Conditional Access. The catch is in the fine print. The preview comes with limits on what agents can read and who they can talk to. Know the trade-offs before you switch.

→ Compare agent accounts and service accounts

📅 Deadline Watch: A New Sharing Link Lands by November 30

Your Link Policies Don't Apply to Hero Links

Microsoft is rolling out hero links, one sharing link per file, to every Microsoft 365 tenant by the end of November. They start private by default. But your existing link expiration and default link policies don't apply to them. Until Microsoft ships the expiring hero link controls it has announced, that's a gap in your sharing governance. Set your site defaults before the link arrives.

→ Plan for hero links before November 30

🛠️ Governance Without the Gridlock

The Agent PMO: AI Agent Governance Without Gridlock

When everyone can build an agent, who owns them? Agents outlive the people who built them, and most organizations have no intake, review or off-boarding for any of them. Kanwal Khipple's AI-Native Workplace Summit session deck gives you a lightweight framework of intake forms, risk reviews and success metrics. Teams keep building, and you keep control.

→ Get the free session deck

🗓️ Upcoming Trainings (Free)

Build Agents and Websites With Governance Built In

Move past the theory with 2toLead's Agent in a Day and Power Pages in a Day, free instructor-led sessions by Microsoft MVPs, where you get hands-on learning with labs. Spots are limited, so pick your session and register now!

Upcoming dates:

• December 3, 2026: Power Pages in a Day *spots are filling up quickly* → Register here
• December 10, 2026: Agent in a Day → Register here
• January 7. 2027: Agent in a Day → Register here
• January 21, 2027: Power Pages in a Day → Register here

Govern the Defaults You Have, Not the Ones You Assumed

Secure AI isn't about slowing adoption down. It's about being able to answer, with evidence:

• Which connectors and MCP servers your agents can reach
• Whose identity each agent runs on
• Which defaults an attacker could chain together
• Whether your sharing policies cover what Microsoft just shipped
• Who owns each agent once it's live

If your AI adoption has outpaced your settings review, 2toLead can help you find the gaps and fix them before someone else does.