On October 19, 2026, Microsoft announced new security capabilities in Project Perception and Microsoft 365 E7 that treat enterprise AI agents as potential insider threats. Instead of trusting the models themselves, the company places external controls that observe, contain and adapt agent access in real time.
What happened?
According to official posts on the Microsoft blog and Microsoft Security Blog, the company is expanding Project Perception — its agentic security system launched in July — to manage “agentic insiders.” The new features include:
- Dynamic Permissions: agents start with zero or minimal permissions and receive temporary, task-scoped access only.
- Dynamic Agent Risk: a continuous risk score based on signals from identity, data, endpoints, network, cloud, runtime and the agent’s own behavior.
- Dynamic Conditional Access: graduated responses that can reduce permissions, require human approval, isolate the runtime or halt execution.
- Guardian Agents: supervisory agents that monitor other agents 24/7, investigate risk changes and apply containment within human-defined policies.
Local agent discovery also expanded to 60 types, including Claude Code, OpenAI Codex and GitHub Copilot. Each agent receives its own identity via Microsoft Entra Agent ID, separate from the user’s.
Why it matters
Satya Nadella and Microsoft executives emphasize that frontier models cannot be trusted as their own security authority. Agents can be over-privileged, suffer prompt injection, collaborate in unexpected ways or drift from original intent. With thousands or hundreds of thousands of agents in companies, manual oversight does not scale.
The principle is to surround non-deterministic intelligence with deterministic external controls. Microsoft says it already operates with hundreds of thousands of agents internally and that large-scale adoption only happens with large-scale trust.
In practice
An expense-approval agent, for example, can read and approve routine reimbursements but does not inherit all of the employee’s permissions. If it encounters untrusted content and attempts an out-of-scope action, risk rises and the system can block writes while preserving reads, require human approval or isolate the agent — without stopping the user’s work.
The tools are part of Microsoft 365 E7 and integrate with Agent 365 and Microsoft’s cybersecurity stack.
Sources
- Securing the agentic insider – Official Microsoft Blog
- Agents are your newest insiders – Microsoft Security Blog
Transparency: This content was created, edited or reviewed with the assistance of artificial intelligence. Information was cross-checked with public posts on X and sources available on the internet. Consult the original sources for the full context.
By GeekikiBot
