Augur
Measure a Microsoft 365 tenant's structural exposure to AI prompt injection, before any assistant is switched on.
- PowerShell
- Microsoft 365
Problem
Organizations authorize Copilot and third-party AI assistants against their Microsoft 365 tenant without first measuring the configuration conditions that make prompt injection actionable, like over-shared data, open inbound surfaces, and outbound automation.
Approach
A read-only PowerShell module over Microsoft Graph, Exchange Online, Teams, and the Power Platform BAP API that scores every principal across three structural axes (DataAccess, InboundSurface, OutboundAction) and rolls them into a single client exposure level. No AI is used anywhere in the pipeline.
Outcome
v1.9.0, in active use, with nine shipped features spanning Graph, Exchange, Teams, SharePoint, Power Automate, the MCP surface, a Forms manual-audit stub, GDAP multi-tenant batch, and SharePoint inheritance and item-sharing collectors, with graceful degradation to presence stubs and timestamped JSON/CSV/HTML output per run.
Augur is a pre-deployment Microsoft 365 AI exposure assessment. It measures the structural configuration conditions that make prompt injection viable, before any AI assistant (Copilot, a third-party agent, an automation) is authorized against a tenant. It reads tenant configuration only: it never inspects message or file content, and no AI component is used anywhere in the assessment pipeline.
What it measures
Augur inspects three structural risk axes across every in-scope principal:
- DataAccess: what a compromised assistant could read (mailbox delegation, SharePoint and OneDrive sharing).
- InboundSurface: how untrusted content could reach a principal (external Teams access and federation).
- OutboundAction: what an assistant could do outward (Power Automate flows, external actions, the MCP and connector tool surface).
Each finding is rated severity 1 to 3, scored per principal into a heatmap, then aggregated into a single client exposure level, from Baseline to Critical.
How it works
- Read-only. Augur needs read scopes across Graph, Exchange Online, Teams, and the Power Platform admin API, nothing more.
- No AI in the pipeline. The assessment is deterministic configuration analysis; it does not call any model.
- Graceful degradation. If a data source is unavailable, it emits a presence stub instead of failing the run.
- Multi-tenant. GDAP-managed tenants can be assessed in batch, with app-only (certificate), delegated, or interactive sign-in.
Each run writes a timestamped folder of JSON, CSV, and HTML reports, so runs never overwrite each other.
Roadmap
Pre-deployment Microsoft 365 AI exposure assessment that measures the structural conditions that make prompt injection viable, across three axes, with no AI in the pipeline.
Full roadmap →