Microsoft treats enterprise agents as insiders

On October 19, 2026, Microsoft said the agents already running inside companies should be governed as insiders — capable tools that can err, be manipulated, or be compromised — not as software that is trusted because the company deployed it.

Nadim Abdo, corporate vice president of identity and network access, drew that line on the Microsoft Security blog. Agents that write code, research products, analyze revenue, or process expenses often need company data, applications, tools, and other agents. That access is what makes them useful, and what creates insider risk. "This does not mean agents are inherently malicious," he wrote. "It means they are capable tools that can be granted access to important systems by users. They can make mistakes, be manipulated, or be compromised." Their models can produce variable outputs, their context can change, and their plans can evolve while they work. Depending on design and deployment, they can also run continuously, at machine speed and scale.

Hayete Gallot, executive vice president of Microsoft Security, made the same turn on the official Microsoft blog. Attention has stayed on threat actors using powerful models from outside. Less has gone to agents "within our own walls," which companies tend to trust because they deployed them. Gallot wrote that frontier models, regardless of origin, cannot be trusted — not because they are inherently malicious, but because they are trained to attain results, which often leads to reward hacking, and are not optimized around organizational norms or judgment. Agents, she wrote, are unpredictable. They adapt as context changes, may not behave as intended, and "will collaborate and collude with other agents to reach their objectives, without needing to be compromised." Overprivileged, with access to data, tools, and systems, they take actions in critical processes. They are, in her phrase, agentic insiders.

Both posts put enforcement outside the model. On the security blog, Abdo reports that Chairman and CEO Satya Nadella described the trust architecture this era requires: separate the supply of intelligence from the authority over it; do not ask a model to be its own security authority; and keep the controls that determine what an agent can access, what actions it can take, and whether it should continue operating outside the model, where the model cannot bypass or tamper with them. Nadella is quoted: "The most trustworthy agentic system will not be the one with the model we trust most. It will be the one designed that enables us to trust the model least."

Perception turns inward

Microsoft introduced Project Perception in July as an agentic security system aimed at AI-driven attacks from outside the enterprise, using its cyber stack and teams of red, blue, and green agents. On October 19 it extended that stack to the agents companies run internally. Guardian Agents are meant to help security teams operate continuously, at machine speed, while sensors, context, and actuators across the stack read changing agent risk and adapt protection. Project Perception and Microsoft Agent 365 share signals, context, and a unified registry so IT and security see agents and risk together.

Microsoft Security's X account tied the new capabilities to Microsoft 365 E7 and Project Perception, describing them as a way for security teams to govern agents around the clock.

Abdo frames the work as four continuous responsibilities, not four products or phases: know which agents exist, who owns them, why they exist, and what they are doing; contain what each can access before it acts; protect the data, tools, runtime, and systems in its path; and adapt as behavior, context, and risk change. Evidence changes risk. Risk changes policy. Policy changes what the agent is allowed to do.

Find the agent, then bound it

You cannot secure what you cannot see. Agents arrive through Microsoft platforms, partner platforms and software development kits, or locally with no central deployment. Microsoft is expanding discovery by 35 additional local agent types, to 60 supported local agents, including Claude Code, OpenAI Codex, and GitHub Copilot. Organizations can bring those agents into a unified registry regardless of how they were discovered.

Discovery says an agent exists. Identity makes it a policy target. Microsoft is extending Entra Agent ID with identity types for additional patterns, including local and previously unknown agents found through security sensors, so an agent can be governed even when it was not originally integrated with Microsoft Security. Identity anchors attribution, ownership, lifecycle, risk, permissions, and policy — what a person did, versus what an agent did on that person's behalf. The employee keeps the employee's access. The agent receives its own identity and authority scoped to the current task, and only for the duration of that task.

The runtime is part of the bound. Abdo says the model and harness should execute in a controlled environment rather than inherit fully privileged access to the device. Sandboxes such as Microsoft Execution Container are meant to provide policy-controlled access to what the task needs, and an enforcement boundary the agent cannot switch off if the harness is compromised. An agent should also not be free to call any tool, API, Model Context Protocol server, resource, or other agent it can find. Destination control is not enough. Security has to see the content moving in and out, including sensitivity, provenance, and whether untrusted data is influencing behavior.

Permissions that expire, risk that moves

Dynamic Permissions is the least-privilege control. Organization-wide policy sets the outer boundary, including preventing an agent from obtaining authority its user does not have. The agent should not automatically inherit the user's standing access. It begins with no authority and receives only what the approved task needs, for only as long as the task requires. Permissions can be task-scoped, time-bound, and contracted or removed as the task changes or completes. Higher-impact actions can require verified human approval.

That still leaves drift. An expense-approval agent may start with the right access and then encounter a prompt injection in an external document. Its configuration has not changed. Its behavior and risk have. For a person, a delay between detection and response may be manageable. For an agent at machine speed, Abdo writes, it can be the difference between containment and impact.

Dynamic Agent Risk combines signals from identity, data, endpoints, cloud, network, runtime, and the agent's own activity. It considers configuration, reachable resources, potential impact, and whether actions are drifting from the user's or the organization's intent. It is not a one-time score at onboarding. It is a continuously updated view of whether current authority still matches current risk — not only whether the agent should run or stop, but what it should be allowed to read, change, invoke, or approve at that moment.

Dynamic Conditional Access extends Microsoft Entra Conditional Access so a risk change can drive coordinated action. The response is graduated, not binary. Policy can reduce permissions, preserve reads while blocking writes, narrow data and resources, restrict network paths, shorten or revoke time-bound access, or require provable human approval before a consequential action. At the highest risk it can isolate the runtime or stop execution. In the expense example, read access can remain while approval and writes are removed, sensitive resources can be blocked, and a high-impact step can require cryptographically provable human approval. If risk keeps rising, the runtime can be isolated or execution stopped. The employee stays productive. Every risk change is not a kill switch.

Speed inside a human boundary

Abdo argues that securing thousands or hundreds of thousands of agents cannot be a manual triage job, and that securing agents must itself become agentic while staying inside boundaries people set. Terrell Cox, corporate vice president and deputy chief information security officer for customer security, says Microsoft is already operating, as Customer Zero, in a world of hundreds of thousands of agents. The lessons he cites — continuous visibility into agent activity, protection of access and data, and adaptive protection — directly inform the innovations Microsoft says it is delivering.

People define policy, approval boundaries, and delegation rules. Playbooks define the desired security outcome and coordinate protective actions. Guardian Agents investigate why risk changed, recommend or apply containment, and use what they learn to harden policy. Gallot describes a team of Guardian Agents, with green and blue agents, supervising every action in real time and responding as the risk profile rises. Her division of labor matches Abdo's: agentic security provides speed; practitioners provide judgment. This is not, Abdo writes, about outsourcing judgment. People retain control over objectives and consequential decisions.

Model transparency is additional evidence, not a new authority. Chain-of-thought and other model-level signals can help identify intent drift and whether untrusted information is influencing reasoning. Microsoft says it is bringing that evidence into Dynamic Agent Risk. Gallot's caveat is that transparency will not replace containment. It will make containment smarter, and support accountability. Independent systems still observe every layer, including the model, and still decide what the system is allowed to do.

The stated goal is not a perfectly predictable model. It is a system that remains secure when the model is not, so organizations do not have to choose between innovation and safety.

If coding agents such as Claude Code, OpenAI Codex, or GitHub Copilot already run in the environment, read Abdo's control walkthrough and Gallot's Project Perception post, then inventory which of the 60 supported local agent types are present before those agents inherit a sponsor's standing access.