Microsoft on Monday announced new controls to monitor and restrict potentially rogue AI agents in enterprise environments, arguing that organizations should treat these agents as insiders rather than trusted software.
The capabilities extend Project Perception, the agentic security system Microsoft launched in July. Perception was initially pitched as a defense against AI-driven attacks from outside, but it is now being applied to the agents companies run internally.
Hayete Gallot, executive vice president of Microsoft Security, said companies tend to trust the agents they deploy by default. She warned that frontier models are trained to get results and aren’t built around organizational norms or judgment. “These agents are frequently overprivileged, have access to data, tools and systems and can take actions and make decisions in critical processes,” Gallot wrote.
Nadim Abdo, Microsoft’s corporate vice president of identity and network access, clarified the insider label. “This does not mean agents are inherently malicious. It means they are capable tools that can be granted access to important systems by users. They can make mistakes, be manipulated, or be compromised,” he explained.
One of the new features, Dynamic Permissions, gives agents no permissions, or the bare minimum, at the outset. Access is then granted per task and expires or shrinks as the task changes or ends, while high-impact actions require human review.
Dynamic Agent Risk gives each agent a risk score that is continuously updated, drawing on the agent’s activity as well as identity, data, endpoint, cloud, network and runtime signals. The score factors in the agent’s security configuration, the resources within its reach, how much damage it could do if something goes wrong, and whether it is straying from what the user or organization intended.
Dynamic Conditional Access, which brings Entra Conditional Access to agents, acts on those risk changes. Rather than simply allowing or blocking an agent, it can scale back its permissions, let it read but not write, limit the data and network resources it can reach, or require a person to approve consequential actions. If the risk climbs high enough, the agent’s runtime can be isolated or its execution halted.
To make this work at scale, Microsoft is introducing Playbooks and a team of Guardian Agents in Project Perception. Humans establish the rules and approval limits, Playbooks specify what the security response should achieve, and Guardian Agents execute it, looking into why an agent’s risk shifted and suggesting or enforcing containment.
Microsoft is also expanding discovery to 35 more types of local agents, bringing the supported total to 60, including Claude Code, OpenAI Codex and GitHub Copilot.
Related: Small AI Models Could Soon Self-Replicate on IoT Devices, Anthropic Warns
Related: AI Agents Navigate Unfamiliar OT Systems and Move Equipment in Minutes, Booz Allen Finds
Related: AI Turns Familiar Cyberattacks Into a Race Against Time
