Microsoft Treats AI Agents as Insider Threats With New Security Stack

Quick Facts

• Microsoft introduced Guardian Agents and Dynamic Permissions on Oct. 19 to supervise AI agents operating inside enterprise environments in real time.
• CEO Satya Nadella framed the shift in an Oct. 10 essay arguing that AI model controls must sit outside the model itself, drawing 8.9 million views within a day.
• The full security stack is bundled into Microsoft 365 E7 at $99 per user per month.

Microsoft announced a set of new AI security controls on Oct. 19 that treat enterprise AI agents as potential insider threats, applying continuous supervision, real-time risk scoring, and dynamic permissions to every agent running inside an organization.

The announcement centered on what Hayete Gallot, Executive Vice President of Microsoft Security, called the "agentic insider." Agents, she wrote, "are frequently overprivileged, have access to data, tools and systems and can take actions and make decisions in critical processes. They are agentic insiders."

Gallot did not frame the risk as one of deliberate sabotage. "Unfortunately, frontier models, regardless of their origin, cannot be trusted," she wrote. "This is not because models are necessarily malicious. Models have been trained to attain results, which often leads to reward hacking, and models are not optimized around organizational norms or judgment."

Nadella's Case for Distrust

The product release followed an essay Nadella published on Oct. 10 titled "Models as Insider Risks in the Super Intelligence Era." Nadella argued that companies must "separate the supply of intelligence from the authority over it" and that controls governing what a model can access must sit outside the model itself. The most trustworthy system, he wrote, will be "the one that enables us to trust the model the least."

His essay listed seven design principles. Among them: every meaningful action must leave a tamper-proof record a person can read, no single model should control both a system's behavior and the evidence used to judge it, and organizations must be able to pause or stop a model mid-task like an emergency brake.

What Microsoft Announced

The security tools span discovery, identity, risk scoring, access control, and containment.

Microsoft Defender can now detect 60 types of local agents running on employee machines, up from 25 after 35 new types were added. The list includes Anthropic's Claude Code, OpenAI's Codex, and GitHub Copilot, the coding assistant from Microsoft's own GitHub subsidiary.

Each detected agent receives a persistent identity through Microsoft Entra Agent ID, which reached general availability in April 2026. The identity applies even to agents that were never integrated with Microsoft Security tools, meaning previously unknown agents can become policy targets once discovered by security sensors.

Dynamic Agent Risk assigns each agent a continuously updated score. The score draws on signals from identity, endpoint, cloud, network, and runtime tools, and rises when an agent's behavior drifts from its intended purpose. The system includes chain-of-thought analysis to detect intent drift.

Dynamic Permissions operates on a least-privilege model. An agent starts with no standing access and receives only what it needs for a single task, for as long as that task runs. Dynamic Conditional Access then ties access levels to the risk score. A climbing score can trigger graduated responses: preserving read access while blocking writes, narrowing data scope, requiring human approval for a high-stakes action, or isolating the agent's runtime entirely.

Guardian Agents and Project Perception

Guardian Agents sit inside Project Perception and supervise every action of every monitored agent in real time. As an agent's risk profile rises, Guardian Agents investigate why and can suggest or apply restrictions automatically. Agents can also run in sandboxed Microsoft Execution Containers, physically separating them from the security controls that govern them.

Project Perception launched on July 27, 2026, with a public preview beginning Aug. 3. Its original scope covered AI-driven attacks from outside the enterprise. The October update extends it inward, to agents that already carry authority, data access, and business context inside an organization.

Pricing and Packaging

The entire stack ships inside Microsoft 365 E7, priced at $99 per user per month. That tier packages Microsoft 365 E5, Copilot, Entra Suite, and the new Agent 365. Dynamic Conditional Access for agents requires the E7 plan, making the full security capability available only to customers at that license level.