{"slug": "microsoft-treats-ai-agents-as-insiders-and-the-containment-layer-just-arrived", "title": "Microsoft Treats AI Agents as Insiders — and the Containment Layer Just Arrived", "summary": "Microsoft on October 19 announced an expansion of Project Perception that treats internal AI agents as insiders requiring continuous supervision and adaptive containment, with components including Guardian Agents, Dynamic Agent Risk, Dynamic Conditional Access and Dynamic Permissions, bundled into Microsoft 365 E7 at $99 per user per month. Microsoft expanded agent discovery to 60 supported local types, up from 25, including Claude Code, OpenAI Codex and GitHub Copilot, and extended Entra Agent ID, which reached general availability in April 2026. The launch follows Okta's Agent SSO on September 22 and ServiceNow's AI Passport on October 15, while the Okta AI Agents at Work 2026 survey found 96% of executives confident in identity and access management for non-human identities but only 34% applying the same controls used for human employees, and the Saviynt CISO AI Risk Report 2026 found 92% of CISOs lack full visibility into AI agent identities.", "body_md": "Microsoft just moved the goalposts on what it means to secure an AI agent. On October 19, the company announced an expansion of [Project Perception](https://www.microsoft.com/en-us/security/blog/2026/10/19/agents-are-your-newest-insiders-security-must-move-at-their-speed/) that treats internal AI agents not as external visitors to be authenticated at the door, but as insiders who need continuous supervision and adaptive containment. It is the first major enterprise vendor to build this layer.\n\nThe original Project Perception, [previewed in August](https://forkast.news/microsofts-agentic-security-pivot-a-preview-of-the-project-perception-launch/), was designed to defend against external threats using red, blue, and green agent teams. The October update turns that architecture inward. The new framing: agents are capable tools that can be granted access to important systems, and that access creates insider risk — not because agents are malicious, but because they can make mistakes, be manipulated, or drift from their assigned task as context changes.\n\nThe product details are specific. Guardian Agents provide continuous, machine-speed supervision of every agent action, investigating risk changes and recommending or applying containment. Dynamic Agent Risk calculates a continuously updated risk score by combining signals from identity, data, endpoints, cloud, network, runtime, and the agent’s own activity — including chain-of-thought analysis for intent drift. Dynamic Conditional Access extends Microsoft Entra so that a risk change triggers graduated responses: the system might preserve read access while blocking writes, narrow the data an agent can reach, require provable human approval for a consequential step, or isolate the runtime entirely. And Dynamic Permissions ensures agents start with zero authority and receive only task-scoped, time-bound access.\n\nSatya Nadella framed the principle plainly: “The most trustworthy agentic system will not be the one with the model we trust most. It will be the one designed that enables us to trust the model least.”\n\nMicrosoft has expanded agent discovery to 60 supported local types — up from 25 — including Claude Code, OpenAI Codex, and GitHub Copilot. Entra Agent ID, which reached general availability in April 2026, has been extended with identity types for local and previously unknown agents discovered through security sensors. The whole stack is bundled into [Microsoft 365 E7 at $99 per user per month](https://www.microsoft.com/en-us/microsoft-365/enterprise/microsoft-365-plans-and-pricing), which packages E5, Copilot, Entra Suite, and Agent 365.\n\nThis follows a 27-day sprint in which three major vendors shipped agent security products. Okta launched Agent SSO on September 22. ServiceNow introduced AI Passport on October 15. Microsoft followed on October 19. The identity perimeter that [began forming in late September](https://forkast.news/the-agent-identity-stack-is-forming-and-enterprises-are-choosing-the-perimeter-before-the-measurement-layer-exists/) now has a containment layer sitting on top of it.\n\nBut the measurement gap has not closed. The Okta AI Agents at Work 2026 survey found 96% of executives confident in their identity and access management for non-human identities, yet only 34% actually apply the same controls they use for human employees. The Saviynt CISO AI Risk Report 2026 found 92% of CISOs lack full visibility into AI agent identities. And the NIST AI Risk Management Framework MEASURE function — the part that would tell you whether an agent’s actions align with its intended purpose — scored 0.6 out of 5.0, rated critical.\n\nTerrell Cox, Microsoft’s Corporate Vice President and Deputy CISO, offered the candid version: “As Customer Zero, we have learned that securing agents requires continuous visibility into agent activity, proactive protection of access and data, and adaptive protection that keeps pace with evolving threats.”\n\nThe question is not whether containment matters — it does, and Microsoft is first to build it at enterprise scale. The question is what containment cannot tell you. Dynamic Agent Risk can stop an agent from doing damage. It can narrow permissions in real time, require human approval, or kill the runtime. What it cannot yet tell you is whether the agent is actually doing its job correctly — whether the expense it approved was the right call, whether the code it wrote matches the spec, whether the research it produced is accurate. That is the measurement layer, and it still does not exist.\n\nThe $99 per user per month price tag also raises a practical question about who gets access to this kind of containment. If agent security becomes a premium bundle feature, smaller enterprises and budget-constrained teams will be making do with less — at exactly the moment when agents are proliferating fastest.", "url": "https://wpnews.pro/news/microsoft-treats-ai-agents-as-insiders-and-the-containment-layer-just-arrived", "canonical_source": "https://forkast.news/microsoft-treats-ai-agents-as-insiders-and-the-containment-layer-just-arrived/", "published_at": "2026-10-19 18:35:43+00:00", "updated_at": "2026-10-19 18:45:51.088546+00:00", "lang": "en", "topics": ["ai-agents", "ai-safety", "ai-policy", "ai-products"], "entities": ["Microsoft", "Project Perception", "Satya Nadella", "Terrell Cox", "Microsoft Entra", "Microsoft 365 E7", "Okta", "ServiceNow"], "also_reported_by": [], "alternates": {"html": "https://wpnews.pro/news/microsoft-treats-ai-agents-as-insiders-and-the-containment-layer-just-arrived", "markdown": "https://wpnews.pro/news/microsoft-treats-ai-agents-as-insiders-and-the-containment-layer-just-arrived.md", "text": "https://wpnews.pro/news/microsoft-treats-ai-agents-as-insiders-and-the-containment-layer-just-arrived.txt", "jsonld": "https://wpnews.pro/news/microsoft-treats-ai-agents-as-insiders-and-the-containment-layer-just-arrived.jsonld"}}