Microsoft has announced a set of new security tools aimed at treating AI agents as a new kind of insider risk, with controls designed to limit what each agent can access and to tighten those limits automatically if its behaviour changes. It extends Project Perception, Microsoft’s agentic security system introduced earlier this year, to cover the agents that companies are deploying across their operations. The announcement was made in a blog post by Nadim Abdo, corporate vice president of identity and network access at Microsoft.
Microsoft is adding 35 types of local agents, bringing the total supported to 60, including Claude Code, OpenAI Codex and GitHub Copilot.
Abdo said agents are quickly becoming part of how work gets done, from writing code and analysing revenue to processing expenses. They can make mistakes, be manipulated or be compromised, he said, and an agent that behaves as intended at the start of a task can act differently as its context changes. “The most trustworthy agentic system will not be the one with the model we trust most,” Nadella said.
To be useful, they often need access to company data, applications and tools, and that access creates insider risk. He stressed that this doesn’t mean agents are inherently malicious. They can also run continuously at machine speed and scale. Abdo cited remarks by Microsoft chairman and CEO Satya Nadella, who has argued that security controls must sit outside the AI model, where it can’t bypass or tamper with them. “It will be the one designed that enables us to trust the model least. The company framed its approach around four tasks: know which agents exist, contain what they can do, protect the data and systems in their path, and adapt protection as risk changes. The main new features include: * Wider agent discovery. Companies can bring them into one registry to see who owns them and what they are doing. * Agent identities. This is meant to let companies tell what a person did apart from what an agent did on that person’s behalf.
Microsoft Entra Agent ID will add identity types for more agent patterns, including local and previously unknown agents found by security sensors.
A continuously updated risk assessment combining signals from identity, data, endpoints, cloud, network, runtime and the agent’s own activity.
It said security decisions must remain independent of the model. * Sandboxed runtime. Terrell Cox, Microsoft’s corporate vice president and deputy chief information security officer for customer security, said the company is already operating with hundreds of thousands of agents. “Agents will only be adopted at scale if they can be trusted at scale,” he said, adding that Microsoft’s experience as “Customer Zero” informs the new tools. “You should not have to choose between innovation and safety,” he said.
- Dynamic Permissions. Agents would start with no authority and receive only what an approved task needs, for only as long as it takes. Organisation-wide policy sets the outer limit, and higher-impact actions can require verified human approval. * Dynamic Agent Risk. It considers whether an agent’s actions are drifting from the intent of its user or organisation. * Dynamic Conditional Access. An extension of Entra Conditional Access for agents. When risk rises, policy can respond in steps: reduce permissions, allow reads but block writes, narrow the resources an agent can reach, require human approval, or isolate the agent and stop it. * Guardian Agents and Playbooks. A team of agents inside Project Perception that investigates why risk changed and recommends or applies containment. People set policy, approval limits and delegation rules. * Model-level evidence. Microsoft plans to feed signals such as chain-of-thought into its risk scoring to spot when an agent’s plans diverge from its task. Sandboxes such as Microsoft Execution Container give agents policy-controlled access to resources, so a compromised agent cannot switch off the controls watching it. Abdo illustrated the approach with an expense-approval agent that can read submissions, check policy and approve routine reimbursements, but does not inherit all of its sponsoring employee’s access. If it hits a prompt injection in an outside document or attempts an unrelated action, its risk score rises. Policy could then keep read access, remove the ability to approve or write, block sensitive resources and require provable human approval. If the risk keeps climbing, the system could isolate or stop the agent. Abdo wrote that the goal is not to make every model perfectly predictable but to build systems that remain secure even when the model is not. You use AI every day. Now get your AI Quotient. Take the AIQ test.