Microsoft on 19 October 2026 introduced security controls for treating AI agents as insider risk, TechCrunch reported, as enterprise agents gain access to company data, tools and business systems. The changes extend Project Perception and connect with Microsoft Agent 365, Microsoft Defender and Microsoft Entra Agent ID.
Hayete Gallot, executive vice president of Microsoft Security, wrote that "frontier models, regardless of their origin, cannot be trusted." Her point was not that models are inherently malicious. Microsoft’s argument is that agents can behave unpredictably, adapt as context changes and act with permissions that were designed for work, not for mistakes or manipulation.
Agents as insiders
Microsoft describes agents as software that can write code, research products, analyse revenue, process expenses and act across business systems. To do that work, they often need access to data, applications, tools and other agents. That access creates the risk Microsoft is now framing as an insider problem.
Nadim Abdo, corporate vice president for Identity and Network Access at Microsoft, wrote in a Microsoft Security blog post that an agent can make mistakes, be manipulated or be compromised. He also said agents can operate continuously, and that their context and plans can change while they work.
Satya Nadella’s trust model is that enterprises should separate the supply of intelligence from the authority over it. In practice, that means the model should not decide alone what it may access, which actions it may take or whether it should keep running. Those controls need to sit outside the model, where the agent cannot bypass or alter them.
Project Perception and Guardian Agents
Project Perception was introduced as a system for defending with agents. Its model uses red agents to look for attack paths, blue agents to judge which threats matter and green agents to carry out fixes. Microsoft is now extending the same approach to what it calls the agentic insider.
Guardian Agents are intended to supervise other agents before they act. Microsoft says Project Perception and Microsoft Agent 365 share signals, context and a unified registry so IT and security teams can see agents and their risk in one place. The security model is based on external controls, evidence and containment boundaries around non-deterministic agent behaviour.
Microsoft describes four continuing responsibilities for this architecture. Security teams need to know which agents exist, contain what each agent can access and do before it acts, protect the data and systems in the agent’s path, and adapt controls as behaviour and risk change.
Discovery, identity and containment
Microsoft says it is expanding discovery to 35 additional types of local agents, bringing the total to 60 supported local agents. The examples named include Claude Code, OpenAI Codex and GitHub Copilot. The aim is to bring agents into a registry even when they were created outside a central deployment process.
Discovery is only the first step. Microsoft is extending Microsoft Entra Agent ID with identity types for additional agent patterns, including local and previously unknown agents found through security sensors. That gives policy systems a way to distinguish what a person did from what an agent did on that person’s behalf.
Containment then applies to the runtime, the path to tools and resources, and the authority the agent can exercise. Microsoft cites Microsoft Execution Container as a sandbox that can give an agent controlled access to the resources needed for its task. In its expense-approval example, an agent should read submissions, check policy and approve routine reimbursements without inheriting every permission of the employee who sponsors it.
If risk changes, Microsoft says the system should respond in proportion. It could keep safe read access while blocking writes, narrow the resources an agent can reach, require provable human approval for a consequential step, or isolate and stop the agent.
Availability and open questions
Project Perception entered public preview on 3 August 2026. Microsoft has not announced pricing or a general availability date for the full release.
The announcement does not give latency figures, false-positive rates or measured results for the agent-containment use case. Those details matter because supervising actions before they happen adds a decision point to agent work. Customers will also need to test how the controls behave across agents from several vendors and across agents introduced locally by employees.
Agent identities, containment boundaries and human approval for risky agent actions are the operating questions ECS's Security topic deals with, alongside Security Copilot, Zero Trust, Sentinel, Purview and DevSecOps. Sessions and workshops give security teams room to compare Microsoft controls with practitioner experience from deployments. Attendees can bring agent inventories, permission models and approval scenarios that are difficult to settle from product announcements alone.
Photo: Coolcaesar, CC BY-SA 4.0, via Wikimedia Commons, cropped
This article was written by the ECS editorial team with the assistance of Amal Agent, run.events' AI assistant, which supported the research, drafting and proofreading.