Wild ideas, safe agents

Innovation needs freedom. Enterprise AI needs control. The trick is getting both without strangling creativity or opening the door to chaos.

This session shows you how to let your Copilot Studio agents explore bold ideas while keeping them grounded in safe, predictable behavior. We’ll walk through the full lifecycle of an agent, from early experimentation to disciplined, compliant execution, and show you how to turn “wild ideas” into reliable business processes.

You’ll learn how to design conversational agents with built‑in guardrails, how to set up “electric fences” that keep users on safe paths, and how to distinguish a creative hallucination from a useful prediction. We’ll also look at Agent 365 and Entra Agent ID to understand how identity, access, and authorization shape what your agents can (and cannot) do.

Come curious. Leave with the patterns to build agents that are creative, safe, and enterprise‑ready.

Stop securing the AI. Secure the data.

Level: 300
Duration: 45/60 minutes

Everyone is worried about what Copilot and AI agents can access. But how well do you actually know your own data?

Years of oversharing, forgotten SharePoint sites, excessive permissions and sensitive documents sitting in the wrong places haven't suddenly become new problems. AI has just made them harder to ignore.

And blocking Copilot won't fix any of it.

In this session, we'll look at how to get your data under control using Microsoft Purview, SharePoint and Defender for Cloud Apps.

We'll go through how to identify sensitive data, find oversharing, clean up permissions, introduce sensible sensitivity labels and use DLP to protect information without making everyday collaboration impossible.

We'll also look at what you need to keep monitoring after the initial clean-up. Because data governance isn't something you configure once and then forget about.

No complicated frameworks or endless governance discussions. Just practical steps, configuration examples and the things you should check before giving AI access to your environment.

What you'll learn

How to identify sensitive data and oversharing across Microsoft 365.

How to use Microsoft Purview to classify and protect information.

How to find and address risky SharePoint and OneDrive permissions.

How to introduce sensitivity labels and DLP without disrupting collaboration.

How to keep your data environment under control as Copilot and AI agents become part of everyday work.

Assumed knowledge

Basic understanding of Microsoft 365, SharePoint, Microsoft Purview and Microsoft 365 Copilot.

Target audience
Microsoft 365 administrators, security consultants, architects and IT professionals responsible for data protection and Copilot readiness.

Session takeaway

You'll leave with a practical approach to finding and fixing the data security problems that should have been addressed long before AI arrived.

Out of scope

Basic Copilot deployment, licensing and introductory sensitivity labelling.

Seven things everyone gets wrong in Microsoft Purview

Session level: 300, Intermediate to advanced
Duration: 60 minutes
Category: Microsoft Purview, Data Security, Microsoft 365

Microsoft Purview is a brilliant tool for protecting your data. But it's also remarkably easy to configure it in ways that make everyone's life miserable.

Too many sensitivity labels, default labels that classify everything for you, DLP policies that block legitimate work and encryption settings that make collaboration a nightmare. Sound familiar?

And then there's the classic approach of switching everything on, declaring the environment secure and hoping nobody asks too many questions.

In this session, we'll go through seven common mistakes organisations make when implementing Microsoft Purview. We'll look at why they happen, what problems they cause and, more importantly, how to fix them.

We'll cover sensitivity labels, encryption, permissions, DLP, endpoint protection and the settings that often get overlooked. I'll show practical configuration examples, what to test before enabling enforcement and how to avoid creating more problems than you're solving.

No endless governance slides or complicated frameworks. Just seven mistakes, their consequences and what you should actually do instead.

Because having Microsoft Purview configured doesn't necessarily mean your data is protected.

What you'll learn
1. How to design sensitivity labels that people understand and actually use.
2. Why default labels can create problems and how to introduce deliberate classification.
3. How encryption settings affect collaboration, external sharing and access.
4. How to configure and test DLP policies without blocking legitimate work.
5. How Endpoint DLP works, where its limitations are and what needs to be configured.
6. Which Purview prerequisites and integration settings are commonly overlooked.
7. How to monitor, maintain and improve your configuration after deployment.

Assumed knowledge
Attendees should have a basic understanding of Microsoft 365 administration, Microsoft Purview and sensitivity labels. Some experience with DLP and information protection is useful.

This is not an introduction to Microsoft Purview.

Target audience
Microsoft 365 administrators, security architects, compliance specialists and consultants responsible for implementing or maintaining Microsoft Purview.

Session takeaway
You'll leave with seven specific things to check in your own Purview configuration, along with practical recommendations for fixing them.

Out of scope

Basic Microsoft 365 licensing, introductory compliance concepts, Copilot deployment and a complete tenant security assessment.

Urgent access without security compromise!

Your lead architect is on holiday. Naturally, that's when something breaks.

A critical incident requires immediate access to a sensitive project. The person who can fix it is sitting in a hotel abroad, using an unfamiliar network.

Do you relax your security controls to get the problem fixed, or leave everyone waiting while the incident gets worse?

Neither sounds particularly appealing.

In this session, we'll show how Microsoft Entra and Microsoft Purview can help organisations handle urgent access requirements without simply switching off security.

We'll walk through a realistic incident scenario involving Conditional Access, authentication context, sensitivity labels and protected documents.

We'll also look at how to grant appropriate access, how to make it temporary where supported and what needs to be configured before an emergency happens.

Because discovering that your emergency access process doesn't work during an actual emergency is probably not the best testing strategy.

What you'll learn
1. How to plan secure access for urgent business situations.
2. How Conditional Access and authentication context can support sensitive access scenarios.
3. How sensitivity labels and encryption protect confidential documents.
4. How to use time-limited access mechanisms where appropriate.
5. How to test emergency access procedures before they're needed.

Assumed knowledge
Experience with Microsoft Entra, Conditional Access and Microsoft Purview sensitivity labels.

Target audience
Identity specialists, security architects, Microsoft 365 administrators and incident response teams.

Wild ideas, safe agents

Building an agent in Copilot Studio is getting easier. Making sure it only accesses the information it should, performs the right actions and behaves as expected takes a little more effort.

Especially when someone decides the agent should also update records, send messages and connect to another five systems.

What could possibly go wrong?

In this session, we'll build and review a Copilot Studio agent from a security and governance perspective.

We'll look at authentication, knowledge sources, permissions, actions and the controls organisations should consider before publishing agents to users.

We'll also explore where Microsoft Entra Agent ID and Agent 365 fit into agent management, including identity, access and lifecycle considerations.

Along the way, we'll test what happens when an agent encounters information or actions it shouldn't have access to.

The goal is to build useful agents without giving them more access or responsibility than they need.

What you'll learn
1. How to plan permissions and knowledge access for Copilot Studio agents.
2. How authentication and authorisation affect agent behaviour.
3. How to review actions and connected systems before deployment.
4. How Agent 365 and Entra Agent ID fit into enterprise agent governance.
5. How to test, monitor and maintain agents after publishing.

Assumed knowledge
Basic experience with Copilot Studio, Microsoft 365 and identity or access management.

Target audience
Copilot Studio developers, Microsoft 365 architects, security specialists and administrators responsible for agent governance.

Purview strategies for when your data has no boundaries.

ome organisations have a sharing culture. Others have a sharing problem.

If your SharePoint permissions have been accumulating since 2015, nobody really knows who has access to what and sensitive documents are available to half the organisation, you might have a problem.

And adding another sensitivity label won't magically fix it.

In this session, we'll look at how to identify and reduce oversharing across SharePoint and OneDrive.

We'll explore how Microsoft Purview can help identify sensitive information and how SharePoint governance and access controls can address the underlying exposure.

We'll also look at common mistakes, including relying on classification to solve permission problems, assuming external sharing is the only risk and forgetting about access that was granted years ago.

Expect practical examples of what to investigate, what to fix first and how to keep permissions from becoming a mess again.

What you'll learn
1. How to recognise common oversharing patterns in SharePoint and OneDrive.
2. How to identify sensitive information in exposed locations.
3. How to investigate broad, inherited and external access.
4. How classification and access controls address different risks.
5. How to establish a repeatable process for reviewing exposure.

Tactical blueprint for AI‑ready data

AI doesn’t fail because of bad prompts, it fails because your data isn’t ready. For most organizations, the biggest threat to a safe Copilot rollout is years of unchecked “over‑sharing” buried inside SharePoint and OneDrive. If your permissions are a mess, Copilot will surface it instantly.

This session gives you a clear, tactical blueprint for building a secure data foundation before AI starts indexing anything. We’ll show how Microsoft Purview and Defender for Cloud Apps work together to expose sensitive data piles, validate whether “private” is actually private, and enforce labeling at scale. No theory. No governance poetry. Just the structural work your environment needs before Copilot or other AI driven tools arrives.

If you want AI to respect your boundaries, you need to build boundaries worth respecting.

Governance and Operational Control in the Era of AI Agents

The integration of automated AI agents and Microsoft Copilot represents a significant shift in operational efficiency. However, as AI tools increasingly read, interpret, and act upon data from Teams, Outlook, and SharePoint, organizations face new challenges regarding data control and decision-making authority.

This session addresses the governance implications of deploying intelligent assistants as "digital colleagues." We will examine the critical balance between efficiency and oversight, focusing on:

- Data Access Boundaries: Managing what Copilot can access and interpret.
- Automated Decision Making: Establishing guardrails for AI-driven actions.
- Information Lifecycle: Ensuring data hygiene in connected M365 workloads.

Join this session to learn frameworks for maintaining organizational control while maximizing the productivity benefits of Microsoft Copilot.

Data Readiness and Security Prerequisites for Microsoft Copilot

Assigning Copilot licenses is easy. Making sure Copilot doesn’t expose the wrong data is not. Before AI can safely operate in your tenant, you need a data estate that won’t betray you the moment Copilot starts indexing.

This session cuts through the noise and focuses on the architectural and compliance groundwork required for a secure Copilot deployment. We’ll walk through how to classify and protect sensitive data with Microsoft Purview, how to eliminate years of permission “technical debt,” and how to align AI usage with GDPR and internal security policies. We’ll also cover the human side — how to train users to interact with AI safely without slowing them down.

You’ll leave with a clear, actionable plan for preparing your data environment so Copilot delivers value without creating new risks.

Assumed Knowledge
- Familiarity with Microsoft Purview and sensitivity labeling concepts.
- Understanding of SharePoint/OneDrive permission models and common misconfigurations.
- Basic awareness of GDPR and internal compliance frameworks.
- Experience with organizational change or user‑training programs is helpful.

Practical Takeaways
Data Classification: How to use Microsoft Purview to label and protect sensitive assets before Copilot touches them.
Access Management: How to identify and remediate permission debt that leads to oversharing.
Compliance Strategy: Aligning AI usage with GDPR and internal security policies.
User Adoption: Training patterns that help users work safely with AI without slowing innovation.

Out of Scope
- Copilot licensing, setup, or feature demos.
- Sensitivity label basics or introductory governance theory.
- Non‑Microsoft compliance or DLP tooling.

How to Architect Zero Trust AI

You’ve deployed M365 Copilot. Licenses are assigned. Excitement is high, and so is the risk. Once the “toy phase” ends, the real question hits: how do you operationalize AI inside a verified Zero Trust architecture?

This session skips the basics and goes straight to the engineering work. We’ll show how to automate label application using trainable classifiers so Copilot only touches what it should. We’ll break down the Semantic Index and how to influence what it surfaces. And we’ll go deeper into the identity layer, examining Agent 365 and Entra ID’s Agent ID to understand how AI agents authenticate, authorize, and request access in a Zero Trust world.

Finally, we’ll look at how to implement Just‑in‑Time access for AI agents so elevated permissions aren’t left lying around for Copilot (or anyone else) to misuse.

If you want Copilot to behave like a Zero Trust citizen, you need to architect it that way. This session shows you how.

Target Audience: Enterprise Architects & Security Leads who are done with the basics and ready to harden their AI environment.

Shadow AI: Find It. Control It.

Your users have already found ways around your AI restrictions. They're using ChatGPT, browser-based PDF tools, unapproved AI services and whatever application someone recommended on LinkedIn last week.

Blocking Copilot doesn't stop them from uploading company data somewhere else.

So what can you actually do about it?

In this session, we'll look at how to discover Shadow AI usage with Microsoft Defender for Cloud Apps, how Microsoft Purview Endpoint DLP can help protect sensitive information and what you need to consider when allowing external AI services.

We'll go through practical configuration examples, supported controls and the limitations you need to understand before promising that everything is protected.

We'll also look at Bring Your Own Model scenarios in Azure and the governance decisions organisations need to make when introducing their own AI solutions.

The goal isn't to block everything. It's to understand what's being used, protect the information that matters and give people a safer way to work.

Because telling people not to use AI has been working brilliantly so far, hasn't it?

What you'll learn

1. How to discover and investigate Shadow AI usage with Defender for Cloud Apps.
2. How to configure Endpoint DLP for supported sensitive-file activities.
3. How to test restrictions involving browsers and external destinations.
4. What governance considerations apply to AI models hosted in Azure.
5. How to introduce controls without blocking legitimate work.

Assumed knowledge
Experience with Microsoft 365 administration, basic Microsoft security concepts and familiarity with cloud applications.

Target audience
Security architects, Microsoft 365 administrators, compliance specialists and IT professionals responsible for AI governance and data protection.

Solving the Security-Availability Paradox

In cybersecurity, airtight access controls often collide with real‑world emergencies. When key personnel are off‑grid, abroad, or simply unreachable during a critical incident, organizations face an impossible choice: weaken security for speed, or risk operational failure.

This session introduces a third path: context‑aware resilience.

Åsne Holtklimpen and Per‑Torben Sørensen will break down how Microsoft Entra and Microsoft Purview can work together to create a modern, data‑centric “Break Glass” model. Instead of relying on static perimeters or brittle emergency accounts, you’ll learn how to design access that adapts to user context, data sensitivity, and real‑time risk signals.

If you want emergency access that’s fast and secure, this is the architecture that makes it possible.

The Zero Trust power couple, why identity without data protection is just half a marriage

We've spent years securing identities. Conditional Access, MFA, device compliance and access reviews. All important things.

But what happens after someone successfully signs in?

Being authenticated doesn't automatically mean someone should be allowed to access every document, download sensitive information or share it with the wrong people.

And now we're introducing AI into the same environments.

In this session, Per-Torben and Åsne will show why identity security and data protection need to work together.

We'll look at how Microsoft Entra controls access, how Microsoft Purview protects information and how sensitivity labels, Conditional Access and DLP can support a more complete Zero Trust approach.

Through practical examples, we'll show what happens when identity controls work but data protection is missing, and how the right combination of controls changes the outcome.

Because a successful sign-in isn't the same as permission to do absolutely everything.

And like most marriages, things work considerably better when both parties communicate.

What you'll learn
1. Where identity security ends and data protection begins.
2. How Conditional Access and sensitivity-based controls can complement each other.
3. How sensitivity labels and encryption affect access to protected information.
4. How DLP can restrict risky activities after authentication.
5. How to design a practical approach combining Entra and Purview.

Assumed knowledge
Familiarity with Microsoft Entra, Conditional Access and Microsoft 365 security.

Target audience
Security architects, identity specialists, Microsoft 365 administrators and consultants responsible for Zero Trust architecture.

Women in Tech: Real stories, real change

A session for everyone who wants to build a more inclusive tech industry

If you've ever assumed a Women in Tech panel wasn't for you — this one is.

Whether you're a woman navigating the realities of a male-dominated industry, or a man who wants to be a better colleague, mentor, or ally, this session was built with you in mind. It is not a conversation about women for women — it is a space for everyone who cares about creating a more equitable, supportive, and empowering tech environment.

Bringing together a group of experienced women from across the tech industry, this honest, story-driven session explores the real barriers women face in tech — from confidence gaps and stereotyping to workplace culture, trust in emerging technologies, and the painful moments that make people question whether they belong at all.

Every panellist brings a turning point — a moment where things shifted, where support arrived, or where they found their voice. And crucially, every story comes with something you can do with it — practical takeaways and a clearer picture of what real, meaningful change looks like in your team, your organisation, and your day-to-day decisions.

Each panellist tackles a distinct topic, drawing on personal experience to explore themes including:

- Navigating male-dominated environments and finding your footing
- The gender gap in AI adoption — why trust matters
- Confidence, stereotyping, and how to push through both
- The power of male allies — and why this conversation needs more of them
- How to pitch yourself in 60 seconds and truly mean it
- Security, trust, and the broader picture for women in tech

Moderated by Peter Rising, the session closes with a set of actionable takeaways — concrete things attendees, allies, and organisers can do to help build a more inclusive tech industry for everyone.

Moderator: Peter Rising
Panellists: Ewelina Paczkowska · Nikki Chapple · Effie Antoniadi · Aasne Holtklimpen · Jacqueline Stockwell