Microsoft Security Unveils Agentic Insider Controls

Introduction

AI agents are quickly moving from experimentation to real business workflows, with access to data, apps, and automation tools. Microsoft’s latest security guidance matters because these agents can act at machine speed, making traditional user-centric controls insufficient when an agent is misused, manipulated, or compromised.

What’s new

Microsoft is extending its security architecture to address what it calls the agentic insider—an AI agent with legitimate enterprise access that still introduces insider-style risk.

Key announcements include:

• Project Perception expansion to secure agents, not just defend with them.
• Unified agent registry shared across Project Perception and Microsoft Agent 365 for visibility into ownership, activity, and risk.
• Broader local agent discovery, adding support for 35 more local agent types, for a total of 60 supported local agents including Claude Code, OpenAI Codex, and GitHub Copilot.
• Microsoft Entra Agent ID enhancements to assign first-class identities to more agent types, including local or previously unknown agents discovered by security sensors.
• Dynamic Permissions, a new model that gives agents task-scoped, time-bound access instead of inheriting all user permissions.
• Runtime containment through controlled environments such as Microsoft Execution Container (MXC).

Microsoft’s security model for agents

Microsoft’s message is clear: do not let the model govern itself. Security controls must sit outside the AI model and continuously enforce policy.

The company describes four continuous responsibilities:

• Know which agents exist, who owns them, and what they are doing.
• Contain what each agent can access before it acts.
• Protect the data, tools, runtime, and systems in the agent’s path.
• Adapt controls as behavior, context, and risk change.

This aligns with Zero Trust principles, but applies them more aggressively to non-deterministic AI systems.

Why this matters for IT and security teams

For administrators, the biggest shift is operational: agents should be treated as separate identities with their own lifecycle, permissions, and audit trail. That helps distinguish actions taken by a human from those performed by an agent on the user’s behalf.

The introduction of Dynamic Permissions is especially important for organizations deploying Copilot-style or custom agents. Instead of broad standing access, admins can move toward least-privilege, task-based authorization with human approval required for higher-risk actions.

Next steps

IT and security teams should start preparing now:

• Inventory existing AI agents across Microsoft and third-party platforms.
• Review whether agents are inheriting excessive user permissions.
• Plan for agent-specific identity and policy using Entra-based controls.
• Evaluate runtime isolation, monitoring, and approval workflows for sensitive actions.
• Update governance models to include continuous risk assessment for AI agents.

As AI agents become embedded in daily operations, Microsoft is signaling that visibility, containment, and adaptive control will be foundational to securing enterprise AI.