Microsoft has moved to treat enterprise AI agents as “agentic insiders” that security teams must continuously identify, restrict and contain.

Agents are increasingly holding access to corporate data, applications, tools, and other agents that make them powerful but potentially risky participants in business processes.

An agent may behave correctly when a task begins, then change course as context, inputs or untrusted content change.

“Agents have been unleashed in the enterprise, at scale, and their numbers are growing rapidly. They are agentic insiders,” wrote Hayete Gallot, Executive Vice President of Microsoft Security in a blogpost.

Trust the model least

Microsoft’s argument is not that AI agents are inherently malicious. Instead, it says their non-deterministic behaviour, broad permissions and machine-speed operation create a new class of insider risk. And this risk is one that can make mistakes, be manipulated or be compromised.

“The most trustworthy agentic system will not be the one with the model we trust most. It will be the one designed that enables us to trust the model least,” said Satya Nadella, Chairman and CEO of Microsoft.

Enteprises should assume an agent can fail or be compromised, observe it continuously, minimise its authority before it acts, and adapt that authority as risk changes.

Agentic security on watch

Microsoft is extending its Project Perception agentic security system to secure AI agents operating inside enterprises.

New Guardian Agents will monitor and moderate agent actions continuously, while sensors, context and actuators across Microsoft’s cyber stack assess changing risk and adjust protections in real time.

Project Perception will share signals, context and a unified agent registry with Microsoft Agent 365 to give IT and security teams a common view of agents and their risk.

The system follows four continuous responsibilities: know which agents exist and what they are doing; contain what each can access and do; protect the data, tools and systems in their path; and adapt protection as behaviour and risk change.

“Agentic security provides speed. Practitioners provide judgment,” wrote Gallot.

Agents get own identity

A central change is that every agent should receive a first-class identity separate from the employee who uses or sponsors it.

Microsoft is extending Entra Agent ID to cover additional agent patterns, including local and previously unknown agents discovered through security sensors.

That identity will anchor attribution, ownership, lifecycle, risk, permissions, authorisation, and policy that allow enterprises to distinguish what a person did from what an agent did on their behalf.

Microsoft is also expanding agent discovery to 35 additional types of local agents, bringing total support to 60, including Claude Code, OpenAI Codex and GitHub Copilot.

Dynamic control

Microsoft is introducing Dynamic Permissions, which will prevent agents from automatically inheriting all of a user’s access.

Agents should begin with no authority and receive only task-specific, time-bound permissions, with high-impact actions potentially requiring verified human approval.

The employee retains the employee’s access. The agent receives its own identity, permissions and its own authority scoped to its current task and for the duration of the task only.

Dynamic Agent Risk will combine signals from identity, data, endpoints, cloud, network, runtime, and agent activity to continuously reassess whether an agent’s current authority still matches its risk.

Dynamic Conditional Access will then respond proportionately. For instance, preserving read access while blocking writes, narrowing resources, requiring human approval, isolating the runtime or stopping execution.

Model transparency

Microsoft also called for greater visibility into model reasoning, including chain-of-thought signals, to detect intent drift and determine whether untrusted information is influencing an agent’s behaviour.

“Model transparency will not replace containment. It will make containment smarter and stronger,” wrote Gallot.

Enterprises should not have to choose between innovation and safety. The goal is to have an agentic world where security can observe, govern and contain AI systems at the same speed they operate.