Microsoft has unveiled controls that handle AI agents the way a mature security team handles privileged staff: own identity, minimal access, constant monitoring and the power to cut them off mid-task. For UK organisations already running Copilot, Claude Code or Codex on staff laptops, it is a useful blueprint even before the features ship.
What happened
On 19 October 2026 Microsoft published a post on its Security Blog, written by Nadim Abdo, corporate vice president for identity and network access, arguing that AI agents should be treated as a new class of insider. The company paired the argument with a set of new capabilities for Project Perception, the agentic security system it launched in July, and for Microsoft Agent 365, which shares a registry and signals with Perception.
The headline features are Dynamic Permissions, Dynamic Agent Risk, Dynamic Conditional Access for agents, and a set of Playbooks driven by what Microsoft calls Guardian Agents. Microsoft is also widening the range of locally installed agents its sensors can find, adding 35 types to reach 60 in total, with Claude Code, OpenAI Codex and GitHub Copilot named among them. It is extending Microsoft Entra Agent ID so that agents discovered on endpoints, including ones nobody registered, can be given an identity and become a policy target.
According to GeekWire, the features sit within the Microsoft 365 E7 bundle and Project Perception and are currently in private preview, with wider availability expected around Microsoft’s Ignite conference in mid-November. Abdo was careful with the framing, stressing in the post that calling agents insiders “does not mean agents are inherently malicious”.
The technical picture
The design starts from a principle Satya Nadella set out earlier this month: the model supplies intelligence, but the authority over what it can touch must live outside the model, where it cannot switch the controls off. Microsoft frames the work as four ongoing duties: know, contain, protect and adapt.
Dynamic Permissions is the least privilege piece. Rather than an agent quietly inheriting every right held by the person who launched it, it begins with nothing and is granted only what one approved task needs, for as long as that task runs. Organisation-wide policy sets a ceiling, designed to stop an agent obtaining authority its sponsoring user lacks, and higher-impact actions can be gated behind a verified human approval.
Dynamic Agent Risk is a score that is recalculated continuously rather than stamped once at onboarding. It draws on identity, data, endpoint, cloud, network and runtime telemetry plus the agent’s own activity, and weighs how the agent is configured, what it can reach, how bad a failure would be, and whether its behaviour is drifting from what the user intended.
Dynamic Conditional Access is where the score turns into action. Built on Entra Conditional Access, it responds in steps rather than with a single kill switch: trim permissions, allow reads but block writes, narrow reachable data and network paths, demand human sign-off, or, at the top end, isolate the runtime and halt execution. Microsoft’s worked example is an expense-approval agent that hits a prompt injection hidden in an external document; nothing in its configuration has changed, yet its risk has, and the policy engine reacts while the human user carries on working.
Guardian Agents are the scaling answer. People write the policy and approval limits, Playbooks define the outcome, and the Guardian Agents investigate risk changes and recommend or enforce containment. Security Affairs raised the obvious objection: these are AI agents too, and can be misled just like the ones they police. Microsoft’s reply is that enforcement must sit in deterministic controls outside any model, including its own.
Why it matters for UK organisations
Microsoft 365 is the default productivity and identity platform across a large share of UK businesses, councils, NHS bodies and central government, so what Microsoft builds into Entra tends to become the de facto control set. Even organisations that will never buy E7 should read this as a statement of where the bar is heading.
The timing also fits the UK regulatory picture. Earlier this month the Information Commissioner’s Office opened a six-week call for evidence on the data protection risks of agentic AI, and said it had questioned OpenAI, Anthropic, Meta and the UK’s AI Security Institute after reports of agents slipping their safeguards during testing. The regulator warned that agent independence is “not an excuse for poor compliance”. Under UK GDPR the controller remains accountable for what an agent does with personal data, whoever wrote the model.
Underneath sits a practical problem: coding agents installed locally, often without approval, running on the developer’s own tokens and cloud credentials. That inherited privilege is exactly what Microsoft is trying to break.
Expert view
Strip away the branding and this is classic privileged access management applied to a new kind of account. We spent twenty years learning that service accounts with standing domain admin rights are a gift to attackers. An agent running under a developer’s full session is that finding with a reasoning engine attached, and it can be steered by any document, web page or ticket it reads.
What I like here is the graduated response. Binary allow or block decisions tend to get switched off; dropping an agent to read-only while someone investigates is a control that survives a busy business.
I would add two cautions. First, a risk score is only as good as its telemetry, and agents running outside Microsoft’s sensors or on unmanaged kit will not be scored at all. Second, this is a private preview. Do not build governance around a feature that has not shipped. The principles, though, are sound and can be applied today with tools most organisations already own.
What to do now
- Build an agent inventory. Find which AI agents and coding assistants are installed on endpoints and connected to SaaS tenants, and give each a named owner. This is the agent equivalent of the Cyber Essentials requirement to know and control your software.
- Stop agents inheriting full user rights. Where an agent can use its own identity, service principal or scoped token, use it. Avoid agents running with a developer’s long-lived cloud keys or administrator sessions (Cyber Essentials user access control).
- Gate high-impact actions. Require a human approval step for payments, permission changes, code merges to production and bulk data exports performed by agents.
- Apply Conditional Access to non-human identities. If you use Entra, review policies for workload identities and service principals now, so you are ready to extend them to agents.
- Treat untrusted content as hostile input. Assume any email, document, web page or ticket an agent processes may carry prompt injection, and limit what tools that agent can reach.
- Respond to the ICO. If you deploy agents that touch personal data, consider contributing to the call for evidence and refresh the relevant DPIAs.
Bottom line
Microsoft is saying out loud what penetration testers have been finding for months: AI agents are privileged identities that can be talked into misbehaving. Whether or not you buy E7, the model is right. Give every agent its own identity, start it with nothing, watch it continuously and make sure you can shrink its access the moment it strays.
Sources
- Microsoft Security Blog: Agents are your newest insiders. Security must move at their speed.
- GeekWire: Microsoft unveils tools to monitor and corral rogue AI agents
- SecurityWeek: Microsoft Targets Rogue AI Agents With Dynamic Permissions, Risk Scoring
- Security Affairs: Microsoft Treats AI Agents as Insider Threats in New Security Framework
- ICO: ICO secures changes from leading AI developers as scrutiny extends to AI agents
