Microsoft treats AI agents as insider risks with Perception controls

Microsoft said on October 19, 2026 that it is extending Project Perception to treat AI agents as insider risks. In a Microsoft Security blog post, the company wrote: "Today, we are extending Perception to secure the agentic insider." The company is introducing Dynamic Permissions, Dynamic Agent Risk and Dynamic Conditional Access for agents, plus Guardian Agents and wider discovery of local coding agents.

#What changed?

Microsoft frames agents that have access to company systems as a new form of insider risk. "With that capability can come insider risk," the Security blog post says. A companion post on the Official Microsoft Blog by Hayete Gallot puts it more bluntly: "They are agentic insiders." Project Perception itself was announced in July, Gallot wrote.

Microsoft listed four new control areas:

1. Dynamic Permissions. "Organization-wide policy sets the outer boundary, including preventing an agent from obtaining authority its user does not have. Permissions can then be scoped to the task, made time-bound, and contracted or removed as the task changes or completes. Higher-impact actions can require verified human approval."
2. Dynamic Agent Risk. Microsoft says it "combines signals from identity, data, endpoints, cloud, network, runtime, and the agent’s own activity," and that the result "is a continuously updated understanding of the agent’s current risk."
3. Dynamic Conditional Access. Microsoft says this "extends Microsoft Entra Conditional Access for agents so a change in risk can drive coordinated action across multiple enforcement points." "The response is graduated, not binary." "At the highest levels of risk, it can isolate the runtime or stop execution entirely."
4. Guardian Agents. "we are introducing new Playbooks and a team of Guardian Agents in Project Perception." Microsoft says Guardian Agents "can help teams understand why risk changed, investigate the relevant evidence, recommend or apply containment, and use what they learn to harden policy."

Microsoft is also expanding what it can find on employee machines. It said it is expanding discovery to 35 additional types of local agents, bringing the total to 60 supported local agents, including Claude Code, OpenAI Codex and GitHub Copilot. It is extending Microsoft Entra Agent ID "with identity types for additional agent patterns, including local and previously unknown agents discovered through security sensors."

For runtimes, Microsoft points to sandboxes such as Microsoft Execution Container (MXC), which "provide policy-controlled access to resources the agent needs to complete its task." It is also bringing chain-of-thought and other model-level signals into Dynamic Agent Risk. "We are bringing this deeper evidence into Dynamic Agent Risk," the Security blog post says.

#Who said what?

Microsoft quotes Satya Nadella, its chairman and chief executive officer, on the trust model it wants: “The most trustworthy agentic system will not be the one with the model we trust most. It will be the one designed that enables us to trust the model least.”

Terrell Cox, Corporate Vice President and Deputy Chief Information Security Officer for Customer Security at Microsoft, said: "At Microsoft, we are already operating in a world of hundreds of thousands of agents."

#Who can use it and when?

Microsoft's announcement posts do not give availability dates or prices. GeekWire reported that "The company’s new features are in private preview, with broader availability planned for Microsoft’s Ignite conference," and that the features "are part of Microsoft 365 E7." GeekWire also reported that Microsoft 365 E7, which launched in May, costs $99 per user per month.

GeekWire named Google, Amazon Web Services, CrowdStrike and Okta as companies also working in this area.

#How does it compare?

The announcement sits next to Microsoft's earlier Agent 365 work. Our coverage of specialist OpenAI Dots for Microsoft Agent 365 describes that management layer; this update adds discovery, identity, permissions and risk response for agents, including coding tools on employee machines. Local coding agents that call out of a machine remain a separate risk, covered in our guide to controlling what AI coding agents can reach on a Mac and in our report on the OpenCode Console provider-key breach. More coverage is in the Privacy & Security hub.

#What is still unclear?

• General availability. Microsoft does not state when the features leave private preview. This article does not give an Ignite date because the sources disagree.
• What sits in E7 versus Project Perception. Microsoft's posts do not itemise which controls require which license.
• Pricing from Microsoft. The $99 E7 figure comes from GeekWire, not from Microsoft's posts.