Microsoft announces tighter access controls for AI agents

Microsoft has announced new controls that are meant to treat AI agents as insiders within the enterprise. According to the company, agents will get their own identity, access limited to a single task and fewer rights as their risk rises. The controls are tied to Project Perception and Microsoft 365 E7. Monday's two announcements do not state pricing, status or EU availability for the new capabilities. Organizations therefore cannot budget for or plan a rollout on the basis of the announcements alone.

What Microsoft describes

Nadim Abdo, Corporate Vice President for Identity and Network Access at Microsoft, describes the capabilities in a post on the Microsoft Security Blog on October 19. Hayete Gallot, Executive Vice President for Microsoft Security, sets out the rationale the same day on The Official Microsoft Blog. She writes that agents are frequently overprivileged, with access to data, tools and systems, and calls them "agentic insiders". Satya Nadella and the @msftsecurity account shared the announcement on X.

Abdo writes that Microsoft plans to expand discovery of local agents by 35 types, to 60 in total. He names Claude Code, OpenAI Codex and GitHub Copilot. Organizations are to be able to bring these agents into a registry that Project Perception shares with Microsoft Agent 365. Microsoft Entra Agent ID is to gain identity types for local and previously unknown agents as well.

The core is what Microsoft calls Dynamic Permissions. According to Abdo, an agent should not inherit the user's standing access. Instead, it is to receive rights for one task and for a limited time. High-impact actions can be set to require human approval. Microsoft also describes Dynamic Agent Risk, a continuously updated risk assessment per agent, and Dynamic Conditional Access, which is meant to respond in steps: removing write access, narrowing resources, requiring approval or stopping the agent. Guardian Agents in Project Perception are to investigate risk changes and recommend or apply containment within rules that people set.

Abdo uses an expense agent as an example. If the agent meets a prompt injection in an external document, the system is meant to remove its right to approve expenses while letting it keep reading.

What the announcements leave out

Neither Abdo's nor Gallot's post states pricing, availability status, dates or regional availability for the new capabilities. The summary of Abdo's post and the @msftsecurity post refer to "new capabilities in Microsoft 365 E7 and Project Perception". The posts do not say which capability belongs to which product, or whether E7 is required.

Some facts appear in Microsoft's existing documentation. They apply to today's products, not to the new capabilities. Microsoft's licensing FAQ lists Microsoft 365 E7 at USD 99 per user per month and Agent 365 on its own at USD 15 per user per month. The same FAQ says E7, including Agent 365, is designed to align with Microsoft's EU Data Boundary commitments. Microsoft Learn states that today's Conditional Access for agents requires E7, or Agent 365 paired with at least Entra P1 or Microsoft 365 E3. According to Learn, today's discovery of local agents is activity-based: Defender lists an agent only after it has been observed in use. Discovery on macOS and runtime protection on Windows are labeled as preview.

Assessment

The announcements describe an architecture, not a product with known terms. The principles are familiar: least privilege and distinct identities, now applied to agents. What is new is that Microsoft plans to wire them into Entra, Defender and Agent 365 and let access change while the agent works.

The model also ties governance closely to Microsoft's own products. Registry, identity, risk scoring and access control sit with one vendor, including for agents from Anthropic, OpenAI and others. For organizations already on Microsoft 365, that may simplify operations. It also increases vendor dependency, and the licensing picture for the new capabilities is unclear.

Dynamic Permissions also shifts work to the customer. If agents are not to inherit the user's access, the organization itself must define what each task requires.

What leaders can do now

Leaders should ask for an inventory of the agents already in use and the access they hold. Before the next license renewal, they should get written clarification from Microsoft or their partner on which of the announced capabilities require E7 or Agent 365, and where the data is processed. Agents with access to finance, HR or customer data should have a named owner.

Sources and media

• Primary source: Microsoft Security Blog, "Agents are your newest insiders. Security must move at their speed.", by Nadim Abdo. Published October 19, 2026, 15:00 Oslo time (13:00 UTC). https://www.microsoft.com/en-us/security/blog/2026/10/19/agents-are-your-newest-insiders-security-must-move-at-their-speed/
• The Official Microsoft Blog, "Securing the agentic insider", by Hayete Gallot. Published October 19, 2026, 15:00 Oslo time. https://blogs.microsoft.com/blog/2026/10/19/securing-the-agentic-insider/
• X post by @msftsecurity (Microsoft Security, verified business account), October 19, 2026, 15:15 Oslo time: https://x.com/msftsecurity/status/2112170857070010797
• X post by @satyanadella (Satya Nadella, verified account), October 19, 2026, 15:05 Oslo time: https://x.com/satyanadella/status/2112168320946634932
• Microsoft Learn, Defender for Endpoint AI agent support matrix: https://learn.microsoft.com/en-us/defender-endpoint/ai-agent-support-matrix
• Microsoft Learn, What is Microsoft Entra Agent ID: https://learn.microsoft.com/en-us/entra/agent-id/what-is-microsoft-entra-agent-id
• Microsoft Learn, Conditional Access for Agents in Microsoft Entra: https://learn.microsoft.com/en-us/entra/identity/conditional-access/agent-id
• Microsoft Licensing, Agent 365 FAQ: https://www.microsoft.com/licensing/faqs/122
• Sources checked October 19, 2026, between 16:20 and 16:23 Oslo time. The primary source was rechecked at 16:42 with no text changes.
• Illustration: AI-generated with Grok Bot / hogby.ai