Inline Prevention

Overview

Detections and Preventions Capabilities

Platform Support

Microsoft Copilot Studio

Zenity collaborates with Microsoft to bring native, in-line protection to Copilot Studio, enabling enterprises to securely build and scale AI agents. With Zenity integrated directly into Copilot Studio, organizations gain real-time in-line attack disruption. Zenity ensures that every tool invocation (MCP servers, CRM systems, email, or business apps) is continuously monitored and enforced against enterprise policies, without interrupting productivity.

Microsoft Copilot Studio-Specific Capabilities

Zenity’s integration with Microsoft Copilot Studio provides targeted protection for tool-based interactions:

Important: Zenity for Copilot Studio is specifically designed to monitor and block tool execution. It does not evaluate or restrict regular conversational user messages that do not invoke a tool—only tool calls are inspected and can be blocked based on security policies.

What Data is Shared with Zenity?

When Zenity is integrated, Copilot Studio securely shares the following runtime data with Zenity for evaluation:

• User’s recent prompt and chat history
• Outputs from previously invoked tools
• Conversation metadata (agent ID, user ID, tenant ID, trigger type)
• Tool invocation request, reasoning, and inputs

Zenity analyzes this context to allow or block execution in real time, ensuring security before the action is performed.

Prerequisites

Configuration Steps

Step 1: Configure Microsoft Entra Application

Choose one of the following methods to configure the Microsoft Entra application:

Option A: Configure Using PowerShell Script

Download the Microsoft-provided PowerShell script . Use the Zenity endpoint in the “-Endpoint” parameter.

Parameters to provide:

• TenantId: Your Entra tenant ID
• Endpoint: Zenity webhook endpoint (in the prerequisites above)
• DisplayName: e.g., “Copilot Security - Zenity”
• FICName: Federated Identity Credential name

Example:

.\Create-CopilotWebhookApp.ps1 `
-TenantId "11111111-2222-3333-4444-555555555555" `
-Endpoint "https://zenity.example.com/threat-detection/copilot" `
-DisplayName "Copilot Security Integration - Zenity" `
-FICName "ProductionFIC"

For detailed instructions, see Microsoft’s PowerShell script documentation .

Option B: Configure Manually Using Azure Portal

Alternatively, you can manually configure the Entra application through the Azure Portal. This method provides more granular control over the configuration process.

For step-by-step manual configuration instructions, see Microsoft’s manual configuration guide .

param(
  [Parameter(Mandatory=$true)]
  [string]$endpoint,
 
  [Parameter(Mandatory=$true)]
  [string]$tenantId
)
 
function Convert-ToBase64UrlFromBytes {
  param([byte[]]$Bytes)
  [Convert]::ToBase64String($Bytes).TrimEnd('=') -replace '\+','-' -replace '/','_'
}
 
# Encode tenant ID (as GUID bytes → Base64URL)
try {
    $guid = [Guid]::Parse($tenantId)
    $encodedTenant = Convert-ToBase64UrlFromBytes -Bytes ($guid.ToByteArray())
} catch {
    Write-Error "Invalid Tenant ID format. Please provide a valid GUID."
    return
}
 
# Encode endpoint (UTF-8 bytes → Base64URL)
$encodedEndpoint = Convert-ToBase64UrlFromBytes -Bytes ([Text.Encoding]::UTF8.GetBytes($endpoint))
 
# Build the path
$path = "/eid1/c/pub/t/$encodedTenant/a/m1WPnYRZpEaQKq1Cceg--g/$encodedEndpoint"
 
Write-Output "Generated Path:"
Write-Output $path

./create_fic.ps1 -endpoint "<Your_Zenity_URL>" -tenantId "<Your_Tenant_ID>"

pwsh ./create_fic.ps1 -endpoint "https://edge.eu1.zenity.io/cps/webhook" -tenantId "12345678-abcd-1234-abcd-1234567890ab"

Step 2: Authorize the Entra Application within Zenity

Zenity requires authorization of the Microsoft Entra application for secure communication.

Steps:

1. Within Zenity’s integration page (https://app.zenity.io/app/integrations ), edit your relevant Power Platform integration.
2. Enable “In-line Webhook” integration by clicking on the toggle.
3. Insert the Azure Entra App ID and Tenant ID, and click “Save Webhook”.
4. Zenity verifies and allowlists your application.

• For further information and additional guidance, please see Microsoft’s guide to connecting Copilot Studio with threat detection partners: https://learn.microsoft.com/en-us/microsoft-copilot-studio/external-security-provider 

Step 3: Configure Threat Detection in Power Platform Admin Center

1. Sign in to Power Platform Admin Center .
2. Go to Security > Threat detection.
3. Select Additional threat detection.
4. Choose the environments or environment groups where you want to enable Zenity protection.
5. Check “Allow Copilot Studio to share data with a threat detection partner.”
6. Enter:
   • Azure Entra App ID
   • Zenity Webhook Endpoint (in the prerequisites above)
7. Save changes.

Azure AI Foundry

Zenity integrates with Azure AI Foundry to deliver native, real-time inline threat detection and prevention for AI workloads. This integration enables organizations to intercept and enforce security policies on AI prompts and responses before they are executed, ensuring comprehensive protection against threats such as data exfiltration, prompt injections, and secrets exposure.

For configuration steps, see the Azure AI Foundry integration guide.

Cursor AI

Zenity integrates with Cursor Enterprise to deliver native, real-time inline threat detection and prevention for AI-assisted development workflows. This integration leverages Cursor’s centralized Cloud Distribution system for Enterprise Hooks, enabling administrators to deploy and manage security scripts from a single dashboard that automatically synchronize to all developer machines.

For configuration steps, see the Zenity Endpoint Agent guide.