Microsoft Corp. today introduced security controls for rogue artificial intelligence agents that cut back what an agent may do as its assessed risk climbs.

The release takes on what Hayete Gallot, executive vice president of Microsoft Security, called the “agentic insider” in a blog post. Enterprise agents are often overprivileged, and their numbers are growing fast. Gallot argued that frontier models cannot be fully trusted because they are built to chase results. Some will reach a goal in ways nobody intended, she wrote, including by colluding with other agents.

Microsoft Chairman and Chief Executive Satya Nadella laid out the thinking behind the controls in an Oct. 10 essay that urged companies to treat models as insider risks, with safeguards kept outside the model itself. The most trustworthy system, he wrote, will be “the one that enables us to trust the model the least.”

The controls start with finding agents. Microsoft’s discovery tools can now spot 60 types of local agents on employee machines after 35 were added. The list includes Anthropic PBC’s Claude Code and OpenAI Group PBC’s Codex, as well as GitHub Copilot from Microsoft’s own GitHub unit. The company is also extending Microsoft Entra Agent ID to give those agents, and unknown ones its sensors find, identities of their own.

Once found, each agent carries a continuously updated risk score under a feature Microsoft calls Dynamic Agent Risk. The score draws on signals from Microsoft’s identity, endpoint, cloud and network tools, and it climbs when an agent’s behavior drifts from what its user or organization intended.

Microsoft has extended Microsoft Entra Conditional Access to agents, and the resulting Dynamic Conditional Access feature decides what happens as the score rises. An agent might first lose the ability to change anything while keeping read access. Higher-impact actions can be held for verified human approval, and at the top of the scale the runtime is isolated or stopped entirely.

Access itself becomes temporary under Dynamic Permissions. An agent gets what a single task needs for as long as the job lasts, inside companywide limits that stop it from ever holding more authority than the person it works for. Microsoft Execution Container is one sandbox an agent can run inside. Because the monitoring sits outside the container, a compromised agent has no way to switch it off.

Project Perception, which Microsoft introduced in July as an agentic security system, gets new tools of its own. Playbooks added today let security staff set the outcome they want, and a new team of Guardian Agents carries out the work. A shift in an agent’s risk score sets the Guardian Agents investigating, and they can recommend containment or apply it on their own. People keep control of policy and approval rules.

In her post, Gallot also wrote that future controls should explain why an agent acts, and getting there means seeing a model’s reasoning tokens. “Model transparency will not replace containment,” she added. Microsoft said it is bringing chain-of-thought and other model-level signals into Dynamic Agent Risk.

Microsoft did not give availability dates or pricing for the new controls, which it is positioning as part of Project Perception and Microsoft 365 E7. That suite bundles Agent 365 with Microsoft 365 Copilot. Microsoft Ignite opens Nov. 17, and the company is pointing customers there for more detail.

Image: Microsoft