Microsoft treats AI agents as insider risks in new governance tools

Key Points

1. Microsoft expanded Project Perception with tools governing enterprise AI agents as internal security risks.
2. Agents now start with zero permissions, get identities, and can be isolated or shut down.
3. Security teams gain a containment path for a compromised or drifting agent.

The latest:

AI agents inside companies will now be governed like insiders rather than software, under an expansion of Microsoft’s Project Perception platform announced October 19, 2026. The package gives every agent its own identity, strips default permissions, and lets security teams throttle or shut an agent down mid-task. Microsoft did not announce availability dates or pricing.

Details:

• The core principle: Microsoft said the expansion rests on treating AI agents as internal risk, the same category applied to employees with system access. The company framed the shift around speed, arguing containment must operate at machine pace rather than human review cycles.
• Dynamic Permissions: According to Microsoft, an agent now starts with no privileges and receives only what a single task requires, for the duration of that task alone. The tool also caps an agent at the permission ceiling of the user who invoked it, blocking privilege escalation beyond its human operator.
• Dynamic Agent Risk: Microsoft described a continuous risk score built from identity, data, device, cloud and network signals plus the agent’s own activity. Two flagged behaviors are task drift, where an agent strays from its assignment, and reasoning influenced by untrusted content fed into it.
• The containment ladder: Dynamic Conditional Access extends Entra controls to agents in graduated steps, per Microsoft: preserve read access while blocking writes, narrow the resources in scope, require human approval, then isolate the runtime and halt it entirely.
• Shadow agent detection: Microsoft said local agent monitoring grew by 35 new types to reach 60 total, covering Claude Code, OpenAI Codex and GitHub Copilot — tools developers often deploy without security team visibility.
• Identity layer: Each agent is assigned a credential through Microsoft Entra Agent ID, making its actions attributable to a named non-human account rather than to the human whose session it borrowed.
• Supporting pieces: The release adds Playbooks and a Guardian Agents team, with isolation handled through Microsoft Execution Container. The blog post was written by Nadim Abdo, corporate vice president for identity and network access.
• The scale claim: Terrell Cox, deputy chief information security officer, said enterprises are already operating in a world of hundreds of thousands of agents. Microsoft did not publish a figure for agents running inside its own environment.

Background:

Project Perception is Microsoft’s security platform for monitoring activity across identity, devices, cloud and network. The October 19 release extends that model to autonomous AI agents, which until now largely inherited the credentials of the humans who launched them.

Between the lines:

The permission ceiling rule and the identity requirement point to the same underlying problem: an agent acting with a borrowed human login leaves security teams unable to tell operator from automation. Expanding detection to 60 agent types, including third-party coding tools, suggests the governance gap Microsoft is addressing sits largely outside its own product line.

What’s next

Microsoft’s Ignite conference runs November 17-20, 2026, where availability timing and pricing for the governance tools remain unannounced.