Agentless coverage

Where the Quint sensor isn’t installed, Quint can connect to the platforms below, only read from them, and record the agents and posture findings it finds there. Nothing is installed on the machine.

Sources

Platform type	Platforms	What Quint reads
Endpoint security	Microsoft Defender for Endpoint, CrowdStrike Falcon, SentinelOne	Each device’s process, file and network events, from which Quint identifies the AI agents on it and what each agent’s process tree did. Defender for Endpoint also reports the AI agents and MCP servers it discovers. Needs the platform’s EDR telemetry
SaaS agent platforms	Microsoft Copilot Studio and Power Platform, Salesforce Agentforce, ServiceNow AI Agents	Every agent your teams build: its owner, connectors, authentication and sharing, with posture findings
Enterprise AI assistants	Microsoft 365 Copilot, ChatGPT Enterprise, Claude Enterprise, Gemini for Google Workspace	Prompts, responses and user activity from Microsoft 365 Copilot, ChatGPT Enterprise and Claude Enterprise, through their compliance or interaction-export APIs. For Gemini, who used it, where and when, from Google Workspace’s audit log
Developer AI	GitHub Copilot (GitHub Enterprise Cloud), Cursor (Enterprise plan)	Usage and admin activity
Cloud AI platforms	Amazon Bedrock, Azure AI Foundry, Google Vertex AI	The agents, models and tools deployed in your cloud accounts, and when they are invoked, from the audit logs you have turned on for them
Identity	Microsoft Entra ID, Okta	The AI apps and agents registered in your directory, who is assigned to them, and the permissions your directory grants them

Copilot Studio and Power Platform

The connection reads every agent, environment, app and flow; the owner and connectors of each agent, app and flow; each agent’s authentication and sharing; and the tenant’s admin settings and DLP policies, and records posture findings from them. It connects through Power Platform’s inventory and admin APIs, with an app registration you create (with a client secret and public client flows on) and a dedicated service account that signs in once with a device code. See Data Quint reads. Its findings appear on its own panel in Integrations, apart from the agents the sensor records.

With and without the sensor

	Quint sensor	Agentless
AI agents and MCP servers in use	Yes	Yes; MCP servers where the platform reports them, such as Defender for Endpoint
What each agent’s processes did on the machine	Yes, from the operating system’s security events, at full or tool-call depth	In part, from your endpoint security platform’s events, once connected
Prompts, replies and tool calls	Yes, at the depth each agent is recorded. See Supported agents	In part, from Microsoft 365 Copilot, ChatGPT Enterprise and Claude Enterprise, once connected
What the agent said it would do, against what it did	Yes, for agents recorded in full	No
Rules that ask for approval or refuse an action before it runs	Yes, for Claude Code, Codex and Cursor, once enforcement is armed	No. Agentless sources raise findings and alerts
How SaaS agents are configured and shared	No	Yes

Investigations

In development: two additions to Quint’s investigation tools, across the sensor and agentless sources:

One timeline per agent. The sensor’s record and each connected platform’s view of the same agent, with each event’s source.
Evidence you can hand on. An investigation’s events and sources, with collection times, exported as one package for your case records.

Permissions and data

Quint only reads. Every call a connection makes is a read, and Quint never changes a setting in a connected platform.
A connection can hold more rights than Quint uses. For Power Platform, your admin registers the app you create for Quint as a Power Platform management app, which gives it Power Platform administrator rights. Quint uses them only to read tenant settings and DLP policies.
An admin in your organization approves each connection, as the platform requires: an app registration, API key, service account or IAM role. For Power Platform, an app registration with admin consent and a dedicated service account.
Quint stores each connection’s credentials encrypted, with a key for your workspace alone, and uses them only to read the data listed above.
For CrowdStrike Falcon, running a search needs the NGSIEM write scope, which also allows uploading lookup files. Quint uses it only to run searches.
To revoke a connection, delete it in Quint, which deletes its stored credentials, then revoke the access you granted in the platform. For Power Platform, remove the app registration and service account in Microsoft Entra ID.

Availability

Platforms	Status
Microsoft Copilot Studio and Power Platform	Preview. In Integrations, choose Data Quint reads, open Microsoft Power Platform (Copilot Studio) and select Connect (Admin or Owner role in Quint)
Claude Enterprise	In testing
Every other platform on this page	Set up with you during a pilot
One timeline per agent and evidence export	In development

To set up any other connection, contact hello@quintai.dev.

Get Started

Install the Endpoint

Use the Dashboard

Policies

Integrations

Settings

Troubleshooting

Reference

Agentless coverage

Sources

Copilot Studio and Power Platform

With and without the sensor

Investigations

Permissions and data

Availability

Next

​Sources

​Copilot Studio and Power Platform

​With and without the sensor

​Investigations

​Permissions and data

​Availability

​Next

Sources

Copilot Studio and Power Platform

With and without the sensor

Investigations

Permissions and data

Availability

Next