On Monday, October 19, 2026, Microsoft announced a new set of controls in Microsoft 365 E7 and its Project Perception security system that treat AI agents as insiders rather than trusted software. The package includes Dynamic Permissions, which start an agent with no access and grant it only what a single task needs; Dynamic Agent Risk, a continuously updated risk score for every agent; Dynamic Conditional Access, which extends Microsoft Entra Conditional Access to agents; and a team of Guardian Agents that investigate and contain risky behavior. Microsoft also expanded discovery of locally running agents to 60 types, up from 25, including Claude Code, OpenAI Codex, and GitHub Copilot. For anyone who manages Microsoft 365 tenants, this is a preview of how agent governance is about to land on the admin’s desk. Here’s what Microsoft announced and why it matters.
What Microsoft Announced
The announcement came in two companion posts: one on the Official Microsoft Blog from Hayete Gallot, executive vice president of Microsoft Security, and a detailed technical post on the Microsoft Security Blog from Nadim Abdo, corporate vice president of identity and network access. Both build on CEO Satya Nadella’s argument earlier this month that the controls on AI models must sit outside the models themselves, where an agent cannot bypass or tamper with them.
Gallot’s case is blunt. As she wrote, “These agents are frequently overprivileged, have access to data, tools and systems and can take actions and make decisions in critical processes.” Abdo was careful to explain what the insider label does and does not mean: “This does not mean agents are inherently malicious. It means they are capable tools that can be granted access to important systems by users. They can make mistakes, be manipulated, or be compromised.”
Microsoft frames the approach as one principle: surround non-deterministic intelligence with deterministic controls, independent evidence, and containment boundaries. The system has four ongoing jobs:
- Know: Identify which agents exist, who owns them, why they exist, and what they are doing.
- Contain: Limit what each agent can access and do before it acts.
- Protect: Safeguard the data, tools, runtime, and systems in the agent’s path.
- Adapt: Adjust protection continuously as behavior, context, and risk change.
Dynamic Permissions: Least Privilege, Built for Agents
Techs have spent years applying Zero Trust and least privilege to people. Microsoft’s point is that agents need it even more, because an agent that simply inherits its user’s standing access can do everything that user can do, at machine speed. Under Dynamic Permissions, an agent starts with no authority of its own (or the bare minimum) and receives only what the approved task requires, for only as long as the task lasts.
- Outer boundary: Organization-wide policy caps what any agent can get, including preventing an agent from obtaining authority its user does not have.
- Task-scoped and time-bound: Permissions shrink or expire as the task changes or completes.
- Human checkpoints: Higher-impact actions can require verified human approval.
- Separate identity: Microsoft is extending Entra Agent ID to cover local and previously unknown agents, so what a person did can be distinguished from what an agent did on that person’s behalf.
Risk Scores and Graduated Conditional Access
Least privilege shrinks the blast radius but does not eliminate risk. Microsoft’s running example is an expense-approval agent that starts its task with exactly the right access, then hits a prompt injection hidden in an external document. Its configuration hasn’t changed, but its behavior and risk have.
Dynamic Agent Risk is built for that moment. It blends signals from identity, data, endpoints, cloud, network, runtime, and the agent’s own activity, and weighs how securely the agent is configured, what it can reach, how much damage it could do, and whether its actions are drifting from what the user or organization intended. Dynamic Conditional Access then acts on changes in that score, and the response is graduated rather than a simple on/off switch:
- Read but not write: Preserve safe reads while blocking changes or approvals.
- Narrow the reach: Limit the data, resources, and network paths the agent can touch.
- Shorten access: Cut back or revoke time-bound permissions.
- Require a human: Demand provable approval before a consequential step.
- Isolate or stop: At the highest risk levels, isolate the runtime or halt execution entirely.
Guardian Agents and Shadow Agent Discovery
Microsoft acknowledges that nobody can manually triage alerts for thousands of agents, so it is fighting agents with agents. New Playbooks define the security outcome a team wants, and Guardian Agents in Project Perception carry out the work: investigating why an agent’s risk changed, recommending or applying containment, and using what they learn to harden policy. People still set the rules, approval limits, and delegation boundaries.
The scale problem is real inside Microsoft itself. As Terrell Cox, Microsoft’s deputy chief information security officer, put it, “At Microsoft, we are already operating in a world of hundreds of thousands of agents.” The expanded discovery of 35 additional local agent types matters just as much for smaller shops, because coding assistants and desktop agents are exactly the tools employees install without a ticket.
Why It Matters for IT Pros and MSPs
Agent sprawl is quickly becoming the new shadow IT, and this announcement signals where Microsoft expects the governance burden to live: in Entra, Conditional Access, and the security stack that admins already run. A few practical takeaways:
- Start the inventory now: Find out which agents and AI coding tools are already running on endpoints and connected to tenants, and who owns each one.
- Stop inheriting user rights: Treat any agent that runs with a user’s full standing access as a privileged account waiting to be abused.
- Plan for prompt injection: Assume an agent will eventually read hostile content, and decide in advance which actions should always need a human.
- Watch the licensing: The features are tied to Microsoft 365 E7, Microsoft’s top-tier bundle, which will put pressure on clients weighing whether agent security justifies the upgrade.
Looking Ahead
According to GeekWire, the new capabilities are in private preview, with broader availability planned around Microsoft Ignite in San Francisco this November, while The Next Web noted that Microsoft has not said whether they will cost extra on top of an E7 license. Microsoft also signaled its next step: feeding chain-of-thought and other model-level signals into Dynamic Agent Risk so security tools can ask not just what an agent is doing, but why.
The bigger shift is philosophical. Microsoft is telling customers to build systems that stay secure even when the model does not behave, and that idea is likely to shape how security vendors pitch agent protection in the months ahead. For techs, the message is clear: AI agents are joining the org chart, and they will need identities, least-privilege access, and Conditional Access policies just like everyone else.
Sources:
- Microsoft Security Blog, October 19, 2026
- The Official Microsoft Blog, October 19, 2026
- GeekWire, October 19, 2026
- The Next Web, October 19, 2026
- SecurityWeek, October 20, 2026
- Help Net Security, October 20, 2026
