Microsoft has announced new tools to control AI agents in Microsoft 365 E7 and its Project Perception platform. The tools limit what each agent can reach and tighten those limits when its risk increases.
Hayete Gallot, executive vice president of Microsoft Security, set out the approach in a post on Monday. She wrote that companies should treat AI agents as insiders. Agents can reach data, tools, and systems, are often given too much access, and can behave in unexpected ways.
Gallot said every agent should be watched by Guardian Agents, which check its actions before they happen. She also called for security tools that show a model’s reasoning, not just its inputs and outputs.
The features themselves are set out in a separate post by Nadim Abdo, corporate vice president for identity and network access. Both posts build on an essay by Satya Nadella earlier this month, in which the chief executive said companies should treat models as insider risks.
The main addition is Dynamic Permissions. Under it, an agent starts with no access of its own and gets only what it needs for one task, for as long as the task lasts, the company said. It can never get access it does not have.
Microsoft is also adding Dynamic Agent Risk, which rates each agent continuously. It uses signals from identity, data, devices, cloud, network, and the agent’s own actions.
A second feature, Dynamic Conditional Access, extends Entra controls to agents. When risk rises, the response comes in steps. An agent can lose the right to change files but keep read access, lose access to some data, need a human to approve a step, or be stopped.
Microsoft can now also find 35 more types of agents that run on staff devices, for a total of 60.
These include Anthropic’s Claude Code, OpenAI’s Codex, and GitHub Copilot. Entra Agent ID, which gives each agent its own identity separate from its user, will cover these and other unknown agents as well.
Meanwhile, Microsoft is adding Playbooks and a team of Guardian Agents to Project Perception. These look into why an agent’s risk changed and can suggest or apply limits.
“At Microsoft, we are already operating in a world of hundreds of thousands of agents,” Terrell Cox, Microsoft’s deputy chief information security officer, said in the post.
In addition, agents can run inside sandboxes such as Microsoft Execution Container. The company said this keeps the security controls that watch an agent out of that agent’s reach, even if it is hacked.
They did not say when the new features will be available, or whether they will cost extra on top of a Microsoft 365 E7 licence.