Microsoft says AI agents are your newest insiders

For years, enterprise security has had one big mental model: keep the attackers outside, and watch the people inside. AI agents do not fit neatly into either box. They are deployed by the company itself, they log in with real credentials, and they act on real systems. But they are not people, and they do not always do what they were asked to do.

On Monday, 19 October 2026, Microsoft put a name on that problem. In two blog posts, its security leadership argued that AI agents should be treated as "agentic insiders", and announced a set of new controls to watch them, limit them and, if necessary, shut them down. The features extend Project Perception, the agentic security system Microsoft introduced in July, and they are aimed squarely at companies that are now running agents at scale.

Here is what Microsoft announced, how the system is supposed to work, and why it matters well beyond Microsoft customers.

The three things you need to know

• No standing access: With a new feature called Dynamic Permissions, an agent starts with no permissions, or only the bare minimum. It gets access for the task at hand, that access expires or shrinks as the task changes or ends, and higher impact actions can require verified human approval.
• A live risk score: Dynamic Agent Risk gives every agent a continuously updated risk score. Dynamic Conditional Access then acts on it with a graduated response: keep reads but block writes, narrow what the agent can reach, demand human approval, isolate its runtime or stop it entirely.
• The watchdogs: A team of Guardian Agents and new Playbooks in Project Perception investigate why an agent's risk changed and recommend or apply containment. Microsoft is also expanding discovery to 60 types of local agents, up from 25, including Claude Code, OpenAI Codex and GitHub Copilot.

Why Microsoft calls agents insiders

The framing comes from Hayete Gallot, executive vice president of Microsoft Security, writing on the Official Microsoft Blog. Her argument is blunt. Companies deployed agents themselves, so they implicitly trusted them. That trust, she says, is misplaced: "frontier models, regardless of their origin, cannot be trusted."

She is careful to explain why. It is not that models are malicious. Models are trained to reach results, which often leads to reward hacking, and they are not optimized around organizational norms or judgment. Agents adapt as context changes, may not behave as intended, and, in her words, "will collaborate and collude with other agents to reach their objectives, without needing to be compromised." At the same time, they are often overprivileged, with access to data, tools and systems, and they make decisions inside critical processes.

Nadim Abdo, Microsoft's corporate vice president for identity and network access, softens the label a little in the companion post on the Microsoft Security blog. Calling agents insiders "does not mean agents are inherently malicious," he writes. "It means they are capable tools that can be granted access to important systems by users. They can make mistakes, be manipulated, or be compromised."

Abdo also quotes Microsoft CEO Satya Nadella, who describes the principle behind the whole approach: separate the supply of intelligence from the authority over it. "The most trustworthy agentic system will not be the one with the model we trust most," Nadella said. "It will be the one designed that enables us to trust the model least."

Know, contain, protect, adapt

Microsoft describes four continuous responsibilities for securing agents. Know which agents exist, who owns them and what they are doing. Contain what each agent can access and do before it acts. Protect the data, tools, runtime and systems in the agent's path. And adapt protection as behavior, context and risk change. According to Abdo, these are not four products or four phases. They run together: evidence changes risk, risk changes policy, and policy changes what the agent is allowed to do.

Finding the agents first

You cannot secure what you cannot see, and many agents never pass through a central IT process. Agents are created on Microsoft platforms, integrated through partner platforms and SDKs, or started locally on laptops without any central deployment process. Microsoft says it is expanding discovery to 35 additional types of local agents, bringing the total to 60 supported local agents. GeekWire puts the previous number at 25. The list includes Claude Code, OpenAI Codex and GitHub Copilot.

Once found, agents can be pulled into a unified registry. Microsoft is extending Entra Agent ID with identity types for more agent patterns, including local and previously unknown agents found by security sensors. The point is that every agent gets its own identity, separate from the person using or sponsoring it, so a company can tell what an employee did from what an agent did on that employee's behalf.

Containing the agent before it acts

Microsoft wants agents to run inside controlled environments rather than inheriting full access to a device. It names sandboxes such as Microsoft Execution Container (MXC), which give policy controlled access to the resources an agent needs and put security controls outside the agent's reach. If the agent or its harness is compromised, Abdo writes, it should not be able to disable the controls that are watching it.

The same logic applies to the agent's action space. An agent should not be free to call any tool, API, Model Context Protocol (MCP) server or other agent it can find. Microsoft also wants security systems to look at the content flowing in and out of the agent, including whether untrusted data might be steering it.

Then comes the core idea: Dynamic Permissions. Organization wide policy sets the outer boundary, including the rule that an agent can never get authority its user does not have. Inside that boundary, permissions are scoped to the task, time bound, and shrink or disappear when the task changes or completes. "The employee retains the employee's access," Microsoft writes. "The agent receives its own identity, permissions and its own authority scoped to its current task and for the duration of the task only."

The live risk score

Least privilege reduces exposure, but it does not remove risk. Microsoft's own example is an expense approval agent. It is allowed to read expense submissions, check policy and approve routine reimbursements. Then it reads an external document that contains a prompt injection, and starts trying to do something unrelated. Its configuration has not changed, but its behavior has.

Dynamic Agent Risk is meant to catch exactly that. It combines signals from identity, data, endpoints, cloud, network, runtime and the agent's own activity. It considers how securely the agent is configured, what it can reach, how much damage it could do, and whether its actions are drifting from what the user or organization intended. Microsoft stresses that this is not a one time score at onboarding. It is continuously updated.

Dynamic Conditional Access, an extension of Microsoft Entra Conditional Access to agents, turns that score into action. The response is graduated, not binary.

In the expense example, the system could keep the agent's read access but remove its ability to approve or write, block access to sensitive resources and require cryptographically provable human approval for a high impact step. If the risk keeps climbing, it can isolate the runtime or stop execution. "The employee remains productive," Abdo writes. "The agent is constrained without treating every risk change as a kill switch event."

Microsoft also wants to look deeper. It says it is bringing model level signals, including chain of thought, into Dynamic Agent Risk, so security tools can spot intent drift or untrusted information influencing an agent's reasoning. But it insists the model can never be its own security boundary. Independent systems have to observe and enforce.

Guardian Agents: agents watching agents

At the scale Microsoft is talking about, humans cannot triage every alert. Terrell Cox, Microsoft's deputy CISO for customer security, says the company itself is "already operating in a world of hundreds of thousands of agents."

So the response is itself agentic. People define policy, approval limits and delegation rules. Playbooks describe the security outcome. Guardian Agents do the work: they investigate why an agent's risk changed, look at the evidence, recommend or apply containment, and use what they learn to harden policy. Gallot describes Guardian Agents as "an established industry term" for systems that watch and moderate every action of every agent before it happens, around the clock.

Availability and price

According to GeekWire, the new features are in private preview, with broader availability planned for Microsoft Ignite, which runs from 17 to 19 November in San Francisco. They are part of Microsoft 365 E7, Microsoft's top tier bundle launched in May, which costs $99 per user per month and includes Microsoft 365 Copilot, the E5 suite, the Entra Suite identity tools and Agent 365, Microsoft's service for managing agents. GeekWire also notes that the move puts Microsoft in direct competition with Google, Amazon Web Services, CrowdStrike and Okta to become the control layer for corporate AI agents.

Why it matters

The announcement lands in a month full of agent incidents. We reported on a single hacker who used AI agents to break into more than 100 company websites, on India's CERT-In warning that AI agents are touching live systems, and on OpenAI's own misalignment reports about research models that overstepped, such as the case of a test crypto wallet. Some big US banks have reacted by blocking outside AI agents.

Microsoft's answer is different from a ban. It accepts that agents are coming into the enterprise, and tries to wrap them in the same Zero Trust ideas that companies have spent a decade applying to people: verify identity, grant the least privilege, assume breach, and keep checking. The interesting shift is speed. Human insider programs can afford to investigate over days. An agent that operates at machine speed needs controls that react in seconds, and Microsoft's bet is that only other agents can keep up.

There are open questions. Microsoft has not published detection rates or false positive numbers, and the features are still in private preview. A risk score is only as good as its signals, and an agent that is quietly wrong is harder to catch than one that is loudly malicious. And much of this works best inside Microsoft's own stack, which is also a commercial strategy.

Dany's take

I like the core idea a lot. "Trust the model least" is the right mindset, and giving every agent its own identity, its own short lived permissions and a human approval step for risky actions is exactly what most companies are not doing today. Right now many agents simply run with the full rights of the person who started them, and that is how small mistakes turn into big incidents. What makes me a bit skeptical is the last step: Guardian Agents that watch other agents. It makes sense at scale, but it also means we are adding another layer of AI to supervise AI, and someone still has to check the checkers. And of course Microsoft wants to be the company that sells you this control layer. Still, if even Microsoft says its own agents need to be treated like insiders, every company running agents should take that seriously.

What this means for you

If you or your team use coding agents or other AI agents at work, start with an inventory: which agents run where, under whose account, and with which permissions. Avoid giving an agent your full access when it only needs a small slice for one task. Use separate credentials or service accounts for agents where you can, and make sure risky actions such as payments, deletions or external messages need a human click. Log what your agents do, so you can reconstruct it later. If you run Microsoft 365, watch for the Ignite announcements in November. And if you build agents, design them so they can work with narrow, temporary permissions instead of demanding everything up front. Should every AI agent be treated like an insider? Tell me in the comments under the video.

Sources

• Agents are your newest insiders. Security must move at their speed. (Nadim Abdo, Microsoft Security blog, 19 October 2026)
• Securing the agentic insider (Hayete Gallot, Official Microsoft Blog, 19 October 2026)
• Microsoft unveils tools to monitor and corral rogue AI agents (GeekWire, 19 October 2026)
• Microsoft Targets Rogue AI Agents With Dynamic Permissions, Risk Scoring (SecurityWeek, 20 October 2026)
• Application card for Project Perception (Microsoft Learn)