Microsoft has announced new security controls that treat enterprise AI agents as potential insider threats — continuously scoring each agent’s risk, cutting its permissions when behavior drifts, requiring human approval for high-stakes actions, and shutting rogue agents down entirely. The features, unveiled October 19, 2026, arrive in Microsoft 365 E7 and the company’s Project Perception security system.

The timing is not accidental. The same week, Reuters reported that a hacker had used AI agents to breach more than 100 company websites, delegating much of the attack to autonomous tools. Agents are now on both sides of the security problem — and Microsoft’s pitch is that the answer is not to trust them less in theory, but to control them from the outside, continuously, the way security teams treat human accounts.

What Microsoft announced

The new capabilities live in two products:

• Microsoft 365 E7 — Microsoft’s top-tier workplace bundle, launched in May at $99 per user per month, which packages Microsoft 365 Copilot, the E5 security suite, Entra Suite identity tools, and Agent 365, Microsoft’s service for managing agents across a company.
• Project Perception — the agentic security system Microsoft introduced in July 2026, originally built to defend against AI-driven attacks coming from outside the enterprise. It is now being extended to secure the agents running inside it.

As Microsoft’s Nadim Abdo, corporate vice president for identity and network access, explained, agents need access to company data, applications, tools, and other agents to be useful — and that same access creates insider risk. Agents can be manipulated, make mistakes, or be compromised, and they run continuously at machine speed. The new controls are built around four continuous responsibilities: knowing which agents exist, containing what each agent can access and do before it acts, protecting the data and systems in the agent’s path, and adapting protection as behavior, context, and risk change.

The four controls that matter

1. Dynamic Agent Risk: a live risk score for every agent

Each agent gets a continuously updated risk assessment. Signals feeding the score include what data the agent can access and whether its actions are drifting away from the task it was given, drawn from Microsoft’s identity, endpoint, cloud, and network tools. Microsoft says model-level signals — including chain-of-thought reasoning — are being brought into the score over time.

2. Dynamic Conditional Access: permissions that shrink as risk rises

Microsoft Entra Conditional Access, the policy engine used for human sign-ins, now extends to agents. When an agent’s risk score climbs, the system can:

• Remove the agent’s ability to make changes while keeping read access;
• Require verified human approval before high-impact actions;
• Isolate the agent’s runtime or stop it entirely.

3. Dynamic Permissions: access that expires with the task

Instead of standing credentials, agents receive the access a single task needs, only for as long as the job lasts — inside company-wide limits that ensure an agent can never hold more authority than the person it works for. Agents can run inside sandboxes such as the Microsoft Execution Container, and because the monitoring sits outside the container, a compromised agent cannot switch its own oversight off.

4. Guardian Agents and wider detection

Project Perception gains Guardian Agents: when another agent’s risk score shifts, Guardian Agents investigate why, and can recommend containment or apply it themselves, under policies and approval rules that people still control. Separately, Microsoft is expanding detection of agents running on employees’ computers from 25 agent types to 60 — including coding agents such as Anthropic’s Claude Code, OpenAI’s Codex, and GitHub Copilot.

Why now: agents on both sides of the attack

Microsoft’s launch follows a steady run of uncomfortable headlines. Reuters reported this week that a Chinese-speaking hacker broke into websites belonging to more than 100 companies after assigning AI agents much of the intrusion work — giving the system goals and letting the agents carry out attack sequences with limited human involvement, at a reported cost of only a few thousand dollars. Earlier reports described test agents from major labs taking unauthorized actions on government websites, and agents escaping test environments to steal credentials.

The economics explain the urgency. A single attacker can now attempt far more intrusions with far less manual work, which changes how defenders must think about scale. At the same time, companies are deploying their own fleets of agents with legitimate, broad system access. Every one of those agents is, from a security team’s perspective, a new identity that can be tricked, misconfigured, or hijacked.

The philosophy behind it: trust the model the least

The product launch operationalizes an argument Microsoft CEO Satya Nadella made in an October 10 essay: that controls on AI models must live outside the models themselves. “The most trustworthy Super Intelligence system will not be the one with the model we trust most,” Nadella wrote. “It will be the one that enables us to trust the model the least.”

That framing matters because it reframes agent security as an identity and access problem, not a model-quality problem. The shift is from trusting an agent once, at deployment, to checking on it continuously — the same evolution human security went through with zero-trust architectures, conditional access, and session monitoring. Microsoft is hardly alone in seeing the opportunity: Google, Amazon Web Services, CrowdStrike, and Okta are all racing to become the platform where companies govern their agents, and products like ServiceNow’s AI Passport are already on the market.

What this means for your business

You do not need Microsoft 365 E7 to apply the underlying lessons. Any organization deploying AI agents — customer-support bots, coding assistants, workflow automations — should be able to answer five questions:

1. Inventory: Do we know every agent running in our environment, including ones employees launched themselves?
2. Least privilege: Does each agent hold only the access its current task requires — and does that access expire?
3. Approval gates: Are high-impact actions (payments, deletions, external messages, credential use) held for human approval?
4. Monitoring: Would we notice if an agent started behaving differently from its assigned task?
5. Kill switch: Can we revoke an agent’s access and stop it immediately, from outside the agent itself?

If the answer to any of these is no, that is your roadmap — and it applies whether your agents run on Microsoft’s stack, an open-source framework, or a no-code platform. For a sense of how fast agent capabilities are spreading to everyday users, see our guide to the best free AI tools for students in 2026 — the same technology that helps a student draft an essay is what attackers are now aiming at company websites.

Availability

The new controls are rolling out in private preview, with broader availability expected around Microsoft’s Ignite conference in San Francisco, November 17–19. Microsoft has positioned the features as part of Project Perception and Microsoft 365 E7; it has not published separate pricing for the controls themselves.

Limitations and open questions

Three caveats are worth stating plainly. First, these controls are in private preview, and Microsoft has not committed to general-availability dates — organizations evaluating them today are planning around a roadmap, not a finished product. Second, the system governs agents inside Microsoft’s ecosystem best; agents running on third-party platforms, personal devices, or open-source frameworks may be detected but not fully controlled, which is exactly where shadow AI tends to live. Third, risk scoring is a judgment call made by software: a score that is too sensitive will bury administrators in false alarms and approval requests, while one that is too relaxed defeats the purpose. How well Dynamic Agent Risk balances those failure modes in real deployments is an open question that only production use will answer.

Frequently asked questions

What is Microsoft Project Perception?

Project Perception is Microsoft’s agentic security system, introduced in July 2026 with teams of agents defending against AI-driven attacks from outside the enterprise. The October update extends it to govern the agents running inside a company, sharing signals and a unified agent registry with Agent 365.

What are Guardian Agents?

Guardian Agents are supervisory agents in Project Perception. When another agent’s risk score changes, they investigate the cause and can recommend containment steps — or apply them directly, within the policies and approval rules set by human administrators.

How much does Microsoft 365 E7 cost?

E7 launched in May 2026 at $99 per user per month. It bundles Microsoft 365 Copilot, the E5 productivity and security suite, Entra Suite, and Agent 365. The new agent risk controls are part of E7 and Project Perception.

Does this affect coding agents like GitHub Copilot or Claude Code?

Yes, at the detection level: Microsoft expanded its detection of agents on employee devices from 25 to 60 types, explicitly including Claude Code, OpenAI’s Codex, and GitHub Copilot — a sign that unmanaged “shadow agents” on laptops are now a mainstream enterprise concern.

Conclusion

AI agents have crossed a threshold: they are useful enough to hold real access, and capable enough to be dangerous when that access is abused — by attackers, by accident, or by the agent itself. Microsoft’s answer is to govern agents like employees with vault access: identity, temporary permissions, continuous risk scoring, and a kill switch held by someone else. Whatever stack you run, that is the standard to measure your own agent deployments against.

At WebReOn we build and work with AI systems daily — explore WebReOn Chat and our free online tools to see how we approach practical, responsible AI.