Artificial Intelligence

Microsoft Introduces New Security Controls for AI Agents

Microsoft has unveiled new enterprise security capabilities designed to monitor and restrict potentially rogue AI agents by treating them as insiders rather than standard trusted software.

Radwan AbdulhadiEditor and technology writer

Published: October 20, 2026 · Updated: October 20, 2026 · 4 min read

Microsoft Introduces New Security Controls for AI Agents — Image: SecurityWeek

Treating Enterprise AI Agents as Insiders

Microsoft announced a new suite of security controls aimed at monitoring and restricting potentially rogue AI agents within enterprise environments. According to the company, organizations should actively treat deployed AI agents as insiders rather than assuming they act as traditional trusted software. The new capabilities directly extend <a href="https://www.securityweek.com/microsoft-targets-rogue-ai-agents-with-dynamic-permissions-risk-scoring/">Project Perception</a>, an agentic security system that Microsoft originally launched back in July.

While Project Perception was initially pitched as a defense against external AI-driven attacks, it is now being applied directly to the internal agents that companies run. Hayete Gallot, executive vice president of Microsoft Security, <a href="https://blogs.microsoft.com/blog/2026/10/19/securing-the-agentic-insider/">said</a> that organizations tend to trust the AI agents they deploy by default. She warned that modern frontier models are optimized strictly to achieve results and are not inherently built around human organizational norms or practical judgment.

Gallot emphasized that these agents are frequently overprivileged, maintaining direct access to sensitive data, internal tools, and critical systems. Because of this access, they can independently take high-level actions and make decisions during critical business processes. Nadim Abdo, Microsoft’s corporate vice president of identity and network access, further <a href="https://www.microsoft.com/en-us/security/blog/2026/10/19/agents-are-your-newest-insiders-security-must-move-at-their-speed/">clarified</a> what the insider label signifies for enterprise networks.

Abdo noted that labeling agents as insiders does not mean they are inherently malicious. Instead, it recognizes them as capable tools that users grant access to important systems, meaning they can still make critical mistakes, be manipulated by outside actors, or be compromised during standard runtime operations.

Dynamic Permissions and Per-Task Access

To address these risks, Microsoft has introduced a feature called Dynamic Permissions. Under this system, agents start out with either zero permissions or the absolute bare minimum required to function. Access is subsequently granted strictly on a per-task basis.

As a task changes or comes to an end, the granted access automatically shrinks or expires. Furthermore, any high-impact actions attempted by an agent require mandatory human review before execution can proceed, preventing unmonitored changes to critical business environments.

Continuous Risk Scoring and Conditional Access

Alongside granular permissions, Microsoft is rolling out Dynamic Agent Risk. This mechanism assigns each agent a continuously updated risk score by drawing on telemetry from identity signals, data access points, endpoints, cloud environments, network flows, and runtime metrics.

The risk score factors in an agent's individual security configuration, the specific enterprise resources within its reach, the potential scale of damage if an error occurs, and whether the agent appears to be straying from the original intentions set by the user or the organization.

To act upon these changing risk metrics, Microsoft brings Entra Conditional Access to agents via Dynamic Conditional Access. Rather than relying on a binary allow-or-block approach, the system can scale back an agent's permissions, restrict it to read-only operations, narrow the data and network resources it can reach, or require manual approval for consequential tasks.

If an agent's risk score climbs to an unacceptable level, the security controls can automatically isolate its runtime environment or halt execution altogether to prevent further exposure.

Guardian Agents and Scalable Playbooks

To ensure these security measures function smoothly at scale, Microsoft is introducing automated Playbooks and a specialized team of Guardian Agents within Project Perception. In this operational model, human administrators establish the fundamental rules and approval limits.

Playbooks explicitly define what a given security response should achieve, while the Guardian Agents execute those responses. Guardian Agents investigate the underlying causes behind an agent's risk score shifts and subsequently suggest or directly enforce appropriate containment measures.

Expanding Discovery for Local Agents

In addition to core security governance features, Microsoft is significantly expanding the discovery scope within Project Perception. The security platform now supports discovery for 35 additional types of local agents.

This expansion brings the total number of supported local agent types to 60. The newly covered tools include widely used developer utilities such as Claude Code, OpenAI Codex, and GitHub Copilot, giving enterprise security teams deeper visibility into local AI usage.