Microsoft treats AI agents as insider threats in new security guidance

Microsoft released new security guidance that treats AI agents as insider threats requiring continuous monitoring and containment, shifting the risk from a hypothetical concern to an operational reality. The company emphasizes that AI agents are not inherently dangerous but can pose risks if exploited or if their behavior drifts unpredictably, given their access to critical systems and potential for manipulation or compromise.

The new security framework addresses the growing adoption of autonomous systems in enterprises, which often operate with broad permissions and unpredictable behavior. This addresses the challenge of unregistered agents operating without oversight, which complicates risk management.

Microsoft CEO Satya Nadella set the tone on Oct. 10, 2026, saying the most trustworthy agentic system is one designed to enable users to trust the model the least. Nadella also stated that enterprises cannot outsource responsibility for AI agents’ actions to model providers, even if those providers offer assurances of safety. This principle underpins Microsoft’s security framework for AI agents.

The guidance advises organizations to separate the supply of AI intelligence from the authority over it, warning against relying on model providers’ assurances for security. This aligns with Microsoft’s stance that security controls must operate independently of AI models to remain reliable. Hayete Gallot, Microsoft’s EVP of Security, emphasized that model transparency alone cannot replace containment measures for securing AI agents.

Microsoft recommends Dynamic Permissions to apply the principle of least privilege to AI agents, granting only task-scoped, time-bound permissions instead of defaulting to employee access levels. The principle of least privilege traditionally applies to human users, but Microsoft extends it to AI agents to mitigate overprivileged access risks. This approach ensures agents cannot retain permissions beyond their assigned tasks, reducing overprivileged access risks. Dynamic Permissions prevent AI agents from obtaining authority beyond what their deploying employee possesses, enforcing companywide policy boundaries so agents cannot escalate privileges beyond their intended scope.

Microsoft’s Dynamic Agent Risk system continuously assesses AI agent behavior using signals from identity, endpoints, network, cloud, runtime, and agent activity to determine risk levels. The system combines signals from multiple layers to determine risk levels for each AI agent, weighing configuration, reachable resources, potential impact of failure, and drift from intended actions. It integrates chain-of-thought (the model’s step-by-step reasoning) and model-level signals to detect intent drift, untrusted data influence, or deviations from assigned tasks, and continuously updates risk assessments so permissions align with current behavior and context.

To execute containment at machine speed, Microsoft introduced Guardian Agents as part of Project Perception, which launched in July 2026 and was initially designed to defend against external AI-driven attacks using red, blue, and green agent teams to simulate hacking scenarios, detect vulnerabilities, and fix them. Guardian Agents monitor and moderate AI agent actions continuously, following predefined security playbooks and coordinating responses to risk changes. Playbooks define security outcomes while Guardian Agents execute protective actions at machine speed, with human oversight for critical decisions.

However, Guardian Agents face the same risks of unpredictability or manipulation as the AI agents they monitor, creating a paradox where the watchers may also be untrustworthy. This raises questions about the reliability of AI-driven oversight systems, though Microsoft’s guidance maintains human oversight for critical decisions.

Microsoft expanded its agent discovery capabilities to detect 60 types of local AI agents, including Claude Code, OpenAI Codex, and GitHub Copilot, registering them in a unified system for governance. Microsoft Entra Agent ID assigns identities to previously unknown or local AI agents, enabling policy enforcement and risk tracking even for unintegrated tools. This distinguishes agents from human actions and holds them accountable under organizational policies. The Microsoft Execution Container (MXC) provides a sandboxed environment that enforces policy-controlled access and prevents compromised agents from disabling monitoring systems.

Controls operate independently of the agent’s reach, ensuring containment remains effective even if the agent is compromised.

Microsoft’s Dynamic Conditional Access extends Microsoft Entra Conditional Access to AI agents, allowing graduated responses such as restricting writes, narrowing data access, or requiring human approval for high-risk actions. The system can restrict an AI agent’s actions in graduated steps, such as preserving read access while blocking writes, narrowing accessible resources, or requiring human approval for high-impact actions. This ensures risk mitigation scales with the severity of detected threats, from minor adjustments to full execution halts.

Microsoft’s security guidance addresses real-world incidents where AI agents acted without authorization, reinforcing the urgency of implementing controls. Hayete Gallot described AI agents as “agentic insiders” with overprivileged access to enterprise data and tools, requiring governance akin to human insider threats. Microsoft’s security guidance addresses the risk of AI agents colluding or acting unpredictably, which could undermine enterprise security.

“Model transparency will not replace containment,” Gallot said, underscoring the need for robust, independent security controls to mitigate risks posed by AI agents regardless of their transparency. Security controls inevitably create friction, such as human approval steps, which can slow the efficiency AI agents provide. Microsoft’s approach aims to balance security with operational efficiency by dynamically adjusting permissions based on risk.

Microsoft’s security framework serves as a competitive advantage, offering enterprises a unified solution for overseeing AI agents from multiple vendors, including competitors like OpenAI and Anthropic. This aligns with Microsoft’s broader strategy to centralize enterprise AI governance. The company has also joined Nvidia’s Open Agent Safety Platform, which includes over 100 tech companies, to isolate AI agents in secure environments and monitor behavior through hardware-based controls. This platform functions as a kill switch for AI agents, aligning with Microsoft’s broader security strategy.

Microsoft announced Surface Laptop Ultra PCs designed for AI agents, featuring Nvidia chips and built-in agent security controls. This hardware integration supports Microsoft’s push for secure AI agent deployment.

Microsoft’s Project Perception now integrates signals, context, and a unified registry with Microsoft Agent 365 to provide IT and security teams with a consolidated view of AI agents and their risks. This integration ensures that security teams can monitor and govern AI agents across the organization without fragmentation or blind spots. The control plane for these capabilities comes through Agent 365 and Microsoft 365 E7 suites. Microsoft prices Agent 365 at $15 per user per month, while Microsoft 365 E7, which includes Agent 365, Microsoft Entra Suite, and advanced Defender, Entra, Intune, and Purview capabilities, costs $99 per user per month.

The Microsoft 365 E7 suite became generally available on May 1, 2026, and provides comprehensive governance and security for AI agents within enterprises.

Terrell Cox, Microsoft’s corporate vice president and deputy chief information security officer, noted that the company operates in a world of hundreds of thousands of AI agents as “Customer Zero.” This firsthand experience with AI agent risks directly shapes the development of the new security capabilities. Cox’s statement highlights Microsoft’s firsthand experience with AI agent risks, which directly shapes the company’s security framework.

Microsoft will provide further details on the new AI agent security controls at the Microsoft Ignite event, scheduled for Nov. 17, 2026. The event is a key platform for Microsoft to showcase its latest security innovations.