Microsoft on Monday, October 19, 2026, announced new security features that treat AI agents as potential insider threats. The tools continuously assess each agent’s risk and can restrict what it is allowed to do when that risk rises.
The features are part of Microsoft 365 E7 and the company’s Project Perception security system. GeekWire reported that they include a continuously updated risk assessment for each agent, based on signals such as what data it can reach and whether its actions are starting to drift from the task it was given. When risk rises, the system can take away an agent’s ability to make changes while still letting it read data, require a person to approve a high-stakes step, or shut the agent down.
The approach puts the controls outside the AI model. In an October 10 blog post, Microsoft CEO Satya Nadella argued that the controls on AI models need to come from outside the models themselves. “The most trustworthy Super Intelligence system will not be the one with the model we trust most,” Nadella wrote. “It will be the one that enables us to trust the model the least.”
Project Perception turns inward
Microsoft introduced Project Perception in July as a way to defend against AI-driven attacks from outside the enterprise. In a company blog post on Monday, Hayete Gallot, executive vice president for Microsoft Security, said the same system can now be used to contain what she called “agentic insiders.” “These agents are frequently overprivileged, have access to data, tools and systems and can take actions and make decisions in critical processes,” she wrote.
Gallot said companies will need Guardian Agents, which she called “an established industry term,” to watch and moderate every action of every agent before it happens, around the clock. Under her description, Project Perception pulls signals from identity, data, cloud, endpoint, network and runtime sensors to discover agents and assign each one an identity, a container and a set of policies and permissions. It then computes each agent’s risk dynamically, and Guardian Agents, working with Perception’s green and blue agents, respond in real time as that risk climbs.
Microsoft is also expanding its discovery of AI agents running on employees’ computers. It can now detect 60 types of local agents, up from 25, including Anthropic’s Claude Code, OpenAI’s Codex and GitHub Copilot. Guardian Agents can investigate why another agent’s risk changed and recommend or take steps to contain it.
Dynamic permissions and risk scoring
The detailed features are laid out in a separate post by Nadim Abdo, corporate vice president for identity and network access. Dynamic Permissions starts an agent with no authority, or least privilege, and grants access per task for only as long as the task lasts. Dynamic Agent Risk keeps a running assessment of each agent, and Dynamic Conditional Access extends Microsoft Entra Conditional Access so a change in risk can trigger graduated responses, up to isolating the agent’s runtime or stopping it, SecurityWeek reported.
Abdo described the design as surrounding “non-deterministic intelligence with deterministic controls, independent evidence, and containment boundaries.” Sandboxes such as Microsoft Execution Container create an enforcement boundary outside the agent’s reach, so a compromised agent shouldn’t be able to disable the controls watching it. Every agent also gets its own identity, separate from the person using or sponsoring it, through an expansion of Microsoft Entra Agent ID.
New Playbooks in Project Perception let people set policy, approval boundaries and delegation rules, while Guardian Agents carry out the work at machine speed. Project Perception and Agent 365, Microsoft’s service for managing AI agents, share signals, context and a single registry so IT and security teams see the same view of agents and their risk.
E7, which launched in May, costs $99 per user per month and bundles Microsoft 365 Copilot, the E5 suite of productivity and security tools, the Entra Suite identity tools and Agent 365. GeekWire reported that the new agent-security features are in private preview, with broader availability planned for Microsoft’s Ignite conference, Nov. 17-19 in San Francisco.
Microsoft Unveils Tools to Monitor AI Agents as Insider Threats first appeared on Web and IT News.