Microsoft wants AI agents treated as insiders. Its answer is permission that changes while they work

An agent starts a task with read access to a project folder. Halfway through, it opens a document that tells it to send the folder to an outside address. Nothing about its identity has changed. Its credentials are still valid. Its role assignment, reviewed last quarter, still says it may read and write that folder. Every control built for employees and service accounts would let the next step through.

That is the problem Microsoft put at the center of an October 19 announcement from its identity and network access organization: the agentic insider. The phrase is deliberate. Insider risk programs exist because trusted people sometimes act against the organization, by mistake or on purpose. Microsoft’s argument is that agents now belong in the same category, with one difference that breaks the usual tooling: an agent’s behavior can change within a single task, as its context changes.

Four mechanisms, one idea

Microsoft is extending Project Perception, the security system it introduced in July, with a set of mechanisms that all rest on the same idea: authorization should be recalculated while the agent works, not granted once at onboarding.

• Dynamic Permissions. Agents start with no permissions. Organization policy sets the outer boundary, and within it permissions are scoped to the task, limited in time and removed when the task ends. An agent cannot exceed the authority of the user it works for, and higher-impact actions can require verified human approval.
• Dynamic Agent Risk. A risk score that is updated continuously from identity, data, endpoint, cloud, network, runtime and agent activity signals, rather than assigned once.
• Dynamic Conditional Access. Microsoft Entra Conditional Access, extended to agents, with graduated responses: reduce permissions, then isolate the runtime, then stop execution.
• Guardian Agents. A team of agents inside Project Perception that carry out protective work defined in Playbooks, with people setting the objectives and keeping the consequential decisions.

Around these, discovery grows by 35 local agent types to 60 supported, including Claude Code, OpenAI Codex and GitHub Copilot, and Entra Agent ID adds identity types for local agents and for unknown agents found by sensors. Project Perception and Microsoft Agent 365 share signals, context and one agent registry.

A graduated response instead of a kill switch

Normal operationExecution stopped

1. Task-scoped grantStarts from zero, expires with the task
2. Risk risesNew signal from data, endpoint or runtime
3. Permissions reducedAgent keeps working with less
4. Runtime isolatedContained, evidence preserved
5. StoppedLast resort

Where the design is right

The strongest line in the announcement is not about a feature. Microsoft says enforcement stays independent of the model, and that the model cannot be its own security boundary. That is the same principle behind Microsoft Execution Containers, and it is the correct one. A guardrail inside the prompt is advice. A permission withdrawn by Entra is a fact.

Task-scoped, expiring permissions also fix a problem most agent programs have quietly accepted: standing access. Today many agents run under a service principal with whatever rights the builder needed during development, kept forever because nobody owns the review. Weak IAM fails faster with agents, and “starts with zero, ends with the task” is the cleanest answer to standing privilege so far.

The graduated response matters more than it looks. An agent stopped in the middle of a multistep job can leave work half done, which is its own incident. Reducing scope first, then isolating, gives operations teams a way to contain an agent without creating a second problem.

What to confirm before planning around it

Availability. The announcement uses “introducing” and “expanding” throughout and gives no general availability, preview status, licensing or pricing for any of the four mechanisms. Microsoft Ignite runs November 17 to 20. Until product pages say otherwise, treat this as direction, not a capability you can put in a control matrix.

What a risk score sees. Dynamic Agent Risk is only as good as the signals that reach it. An agent that runs outside the 60 supported types, or calls tools that do not report into Microsoft’s telemetry, is scored on less. A continuously updated score is a detection mechanism, and no detection mechanism catches every unsafe action.

Chain of thought as evidence. Microsoft plans to feed model-level signals, including chain-of-thought monitoring, into the risk score to detect intent drift. Useful, but a model’s visible reasoning is not a complete account of why it acted. It belongs in the evidence, not in the verdict.

Observation versus control. Seeing an agent is not the same as stopping it before it acts. The decisive question for each agent is whether the enforcement point sits before the tool call or only after it. AWS’s temporal authorization in Strands Box answers it per action; Microsoft’s architecture needs to show the same for each integration.

The practical step does not depend on any of this shipping: inventory which of your agents hold standing permissions today, and for each one, write down what task those permissions are for. That list is the input every dynamic system will need.