Microsoft Expands agent discovery from 25 to 60 types, bundles $99 plan

This is a new development in a story we reported earlier: Microsoft treats AI agents as insider threats in new security guidance.

Microsoft expanded its AI agent security framework to detect 60 types of agents, more than doubling the catalog from 25, and bundled the entire stack into a $99-per-user-per-month Microsoft 365 E7 package, the company announced on Oct. 19, 2026. The expansion includes Claude Code, OpenAI Codex, and GitHub Copilot, and the bundle adds Project Perception and Agent 365 to the existing enterprise offering. Microsoft published detailed blog posts on October 19 and 20 describing autonomous AI agents as agentic insiders. Microsoft said the new features are not yet generally available, with no confirmed release date.

Central to the new framework are Guardian Agents, which continuously monitor AI agent activity, investigate risk changes, and recommend or apply containment measures to prevent unauthorized actions; these agents operate within predefined human-set boundaries, ensuring humans retain control over consequential decisions. Microsoft introduced the Guardian Agents and Playbooks as part of Project Perception, an agentic security framework designed to adapt to changing risks. Project Perception was originally designed to defend against external AI-driven attacks but now focuses on managing internal AI agents as insider risks.

Satya Nadella, Microsoft’s CEO, stated that organizations should treat AI agents as insider risks due to their unpredictable behavior, and in a personal blog post earlier in October 2026 wrote that it is time to stop trusting AI model providers. “We need to separate the supply of intelligence from the authority over it,” Nadella said, arguing that organizations cannot outsource responsibility for what intelligence does on their behalf, and that the most trustworthy agentic system will be the one designed to enable trusting the model least, with every meaningful model action leaving tamper-proof human-readable evidence.

Microsoft’s approach separates the supply of AI intelligence from the authority over it, ensuring organizations retain control over agent actions. Dynamic Permissions restricts AI agents to task-specific access, ensuring they cannot obtain permissions their users lack, and permissions expire when tasks end; under this system, an agent starts with no permissions of its own and receives only the access needed for its approved task for the duration of that task only.

Dynamic Agent Risk continuously assesses AI agent behavior using signals from identity, data, endpoints, cloud, network, and runtime environments to detect drift from intended tasks, and is not a one-time score but a continuously updated understanding of the agent’s current risk. Dynamic Conditional Access dynamically adjusts AI agent permissions based on risk levels, preserving read access while blocking writes or requiring human approval for high-impact actions.

Microsoft Entra Agent ID assigns distinct identities to AI agents, separate from their users, to enforce ownership, lifecycle, risk, permissions, and policy controls; the identity system reached general availability in April 2026 and has since been extended with identity types for local and previously unknown agents. Agents can run inside sandboxes such as the Microsoft Execution Container, which keeps security controls out of the agent’s reach even if hacked. Nadim Abdo, CVP of Identity and Network Access at Microsoft, explained that an agent can become a policy target even when not originally integrated with Microsoft Security.

Microsoft’s agentic security system has four ongoing responsibilities: know, contain, protect, and adapt; organizations need to control and monitor agents’ connections to tools, APIs, Model Context Protocol servers, data, and other agents; Project Perception shares signals, context, and a unified registry with Microsoft Agent 365, giving IT and security teams a consistent view of agents and risks.

Microsoft’s proposed answer is continuous containment rather than upfront trust: define what the agent is allowed to do before it acts, monitor what it actually does while it runs, and adjust permissions in real time as behavior or risk changes. An agent that starts a task correctly can still become dangerous if its context changes mid-run, such as through a prompt injection, and Microsoft’s dynamic approach tightens controls only when risk rises, avoiding an all-or-nothing choice. Shadow AI adds another layer of complexity: a May 2026 Cloud Security Alliance analysis found that 80% of workers use unapproved AI tools, with those tools remaining active for a median of 403 days before detection, and VentureBeat Intelligence found that the average enterprise ran 3.1 agent orchestration platforms simultaneously as of July 2026.

ServiceNow has built its own AI governance suite, with AI Control Tower detecting shadow AI tools and AI Passport providing cryptographically signed credentials to define agent identities, permissions, and accountability at runtime; ServiceNow’s ToolSmith environment is trained on more than 75,000 APIs, NTT Data is using AI Control Tower to address shadow IT, and EmployeeWorks is built on technology from ServiceNow’s $2.85 billion acquisition of Moveworks in December 2025. In November 2025, AppOmni researchers reported that default configurations in ServiceNow’s Now Assist could be exploited, and ServiceNow patched the critical vulnerability CVE-2025-12420, rated CVSS 9.3, in October 2025. AI Passport and shadow AI detection are expected later in Q4 2026. Microsoft’s approach contrasts with competitors like ServiceNow and Salesforce, which also offer AI governance solutions but with different architectural approaches; Microsoft’s solution integrates with its existing identity and cloud infrastructure.

Microsoft aims to serve as the neutral arbiter of AI agent security across the enterprise ecosystem, even as its security stack competes with offerings from OpenAI and Anthropic, which Microsoft is close to through investment and cloud customer relationships, while steering enterprises toward purchasing its agent security products rather than those from the model providers themselves, with a particular focus on agents that employees deploy on systems beyond the reach of the major AI labs. Microsoft also joined Nvidia’s Open Agent Safety Platform, which isolates agents in secure environments and monitors behavior through hardware-based controls.

The $99 per user per month price tag for Microsoft 365 E7 raises a practical question about who gets access to this kind of containment. Microsoft is already operating as Customer Zero in a world of hundreds of thousands of agents, and Terrell Cox, Microsoft’s Deputy CISO, noted that securing AI agents requires continuous visibility, proactive protection, and adaptive measures. Guardian Agents are themselves AI agents, which raises the concern that they too could fail or be manipulated, creating potential blind spots. Microsoft’s security controls are designed to operate independently of AI models, ensuring reliability even if the monitoring agents themselves fail, yet Dynamic Agent Risk can stop an agent from doing damage and narrow permissions in real time, but it cannot yet tell whether the agent is actually doing its job correctly.