Microsoft: AI agents as insider threats, dynamic permissions

Microsoft has introduced a set of controls to monitor and restrict the AI agents that companies run internally. The underlying idea, reported by Help Net Security, Security Affairs and SecurityWeek, is to treat agents as potential insider threats rather than as software that is trusted by default. According to SecurityWeek, the announcement came on Monday, 19 October 2026.

The new features extend Project Perception, the “agentic” security system that, according to SecurityWeek, Microsoft launched in July against AI-driven attacks from outside and is now also applying to internal agents.

Why “insider threat”

Microsoft stresses that the label does not mean agents are malicious. Nadim Abdo, corporate vice president of identity and network access, explains that they are capable tools that users grant access to important systems, and that they can make mistakes, be manipulated or be compromised. Hayete Gallot, executive vice president of Microsoft Security, adds that agents are frequently overprivileged and make decisions inside critical processes.

The technical point, highlighted by Security Affairs, is that an agent that starts with the right permissions can become dangerous while it runs: an instruction hidden in an external document (prompt injection), untrusted data that shifts its reasoning, a task that evolves in an unexpected direction. None of this requires a compromise in the traditional sense, and at machine speed the window between drift and damage is very short. Microsoft therefore proposes surrounding a non-deterministic system with deterministic controls that sit outside the model and cannot be changed by it, across identity, permissions, data, endpoints, network, cloud and runtime environments.

Agent inventory and identity

• Discovery: Microsoft Security now recognises 35 more types of local agents, 60 in total, including Claude Code, OpenAI Codex and GitHub Copilot. Discovered agents can be brought into a unified registry, shared with Microsoft Agent 365, the control plane for deploying and governing agents, with owner, activity and risk.
• Identity: Microsoft Entra Agent ID is being extended to more agent types, including local agents and unknown agents found by security sensors. Each agent gets an identity separate from the person using or sponsoring it, so that a user’s actions can be told apart from those an agent takes on their behalf. According to Help Net Security, an agent can become a policy target even if it was never integrated with Microsoft’s security products.

Help Net Security also notes the need to control agents’ connections to tools, APIs, MCP (Model Context Protocol) servers, data and other agents, inspecting both destinations and the content exchanged: sensitive data and untrusted instructions.

Dynamic permissions and continuous risk

• Dynamic Permissions: the agent starts with no permissions, or the bare minimum, and receives only the authority needed for the approved task and for as long as it lasts. Permissions shrink or expire as the task changes or ends, the agent cannot obtain more authority than its user has, and high-impact actions can require verified human approval. The employee keeps their own access.
• Dynamic Agent Risk: a continuously updated score combining identity, data, endpoint, cloud, network, runtime and agent-activity signals. It takes into account configuration, reachable resources, potential damage and signs of drift from the user’s or organisation’s intent.
• Dynamic Conditional Access: brings Entra Conditional Access to agents. The response scales with risk: reads allowed and writes blocked, fewer reachable data and resources, restricted network connections, time-bound access shortened or revoked, human approval. At the highest levels, the runtime is isolated or execution is stopped.

Microsoft’s example: an expense-processing agent encounters suspicious instructions and attempts an action unrelated to its task. The system removes its permission to approve expenses but keeps its ability to review them; if risk rises further, it isolates or stops the agent.

Guardian Agents and Playbooks

To handle the volumes involved (Microsoft says it already runs hundreds of thousands of agents internally), the company is adding Playbooks, which define the security outcome to achieve, and Guardian Agents, security agents that investigate why an agent’s risk changed, recommend or apply containment and use what they learn to strengthen policies. People set the goals, rules and approval thresholds.

Security Affairs points out the obvious limit: Guardian Agents are AI agents too, and can fail or be manipulated just like the agents they control. Microsoft’s answer is that controls must stay outside the model; how well that holds in practice remains to be seen in real deployments. The sources do not give availability dates, licensing, or the status (preview or general availability) of the individual features.

Impact for European and Italian organisations

This is not a vulnerability but a control model, and it applies even to organisations that do not use Microsoft products. An agent holding corporate credentials is effectively a privileged account: if manipulated, it acts with legitimate access, the same valid-accounts pattern (MITRE ATT&CK T1078) that makes many intrusions hard to detect. For NIS2 entities, agents fall under the Article 21 measures on asset management, access control and supply chain security; in healthcare, where agents may touch clinical data, separating reads from writes and requiring human approval for irreversible actions matters even more.

What to do now

1. Inventory your agents, including local ones on developer workstations (coding agents such as those mentioned above), together with the credentials and tokens they use.
2. Give each agent its own identity instead of letting it use the user’s session or tokens, with minimal, short-lived permissions.
3. Separate reads from writes and require human approval for deletions, payments, production releases and account changes.
4. Restrict connections: allowed MCP servers, APIs and network destinations; treat any external content the agent reads as untrusted.
5. Log agent actions to a central store, set alerts for behaviour outside the assigned task and keep a way to stop agents immediately.
6. If you use Entra and Microsoft 365, check availability and licensing of Entra Agent ID, Agent 365 and the new features with Microsoft before planning adoption.

How ARXDOME helps

The ARX Sentry agent, on Windows, Linux and macOS, collects software, process and port inventory and the security logs of each machine: it helps you find out which AI agents are actually running on workstations. The SOC identity pages show privileged access, bursts of attempts and account changes. If a machine behaves suspiciously, ARX Shield lets you isolate it from the network with one click and release it in a controlled way.

Last updated: 20 October 2026