Microsoft adds risk-based controls for enterprise AI agents
Microsoft says its new agent security controls can discover, identify and restrict AI agents as their assessed risk changes.
By Wei-Lin Zhao · AI Correspondent
· 3 min read
Microsoft on Oct. 19 introduced Microsoft AI agent security controls that it says will discover enterprise agents, assign them distinct identities and cut back their authority when their assessed risk rises. The announcement extends the company’s Project Perception and Agent 365 efforts, reflecting a practical problem for IT teams: agents need access to company systems to do useful work, but that access can also let a faulty or compromised agent act at machine speed.
Microsoft calls this risk category the “agentic insider.” The company is not alleging that agents are malicious. Its point is that agents can make mistakes, be manipulated or compromised, while their outputs, context and plans can change during a task. The company argues that the safeguards governing access and continued operation should sit outside the underlying model, rather than relying on the model to police itself.
How do Microsoft’s AI agent security controls work?
The proposed control sequence is inventory, identity, monitoring and containment. Microsoft says it has added 35 local-agent types to its discovery tooling, bringing the total number of supported local agents to 60. The list includes Anthropic’s Claude Code, OpenAI Codex and GitHub Copilot.
Microsoft is also extending Entra Agent ID to cover more agent patterns, including local agents and previously unknown agents found by security sensors. The aim is to give an agent an identity separate from the employee who uses or sponsors it, allowing security teams to attribute actions and apply policies to the agent itself.
Microsoft says its system will use signals from identity, endpoint, cloud and network products to continually assess agent risk. As that assessment changes, policy can change with it. In the company’s example, an agent could retain read access while losing the ability to write, face narrower access to resources, require human approval for a consequential action, or be isolated and stopped.
What Microsoft has announced, and what remains unclear
The controls fit into the company’s broader enterprise security program approach, where identity, endpoint, network, data and runtime protections are used together. Microsoft says Project Perception and Agent 365 will share security signals, context and a unified registry so IT and security teams can see agents and associated risks in one place.
Microsoft markets Agent 365 as a control plane for observing, governing and securing agents across an organization. Its stated functions include agent registration, least-privilege integration management, lifecycle policies, audit logs and access controls. Those are product claims, not independently verified security results.
The announcement does not establish availability dates, pricing, licensing requirements, customer deployments or independent effectiveness testing. It also does not claim that the controls eliminate prompt injection, model failures or compromise. Microsoft’s argument is narrower: organizations should assume agents can fail and maintain independent controls that can reduce their access or halt them when risk indicators warrant it.
This story draws on original reporting from SiliconANGLE.
