We may earn a commission when you buy through links on this page. It doesn't change what we recommend.
Microsoft announced a new set of Microsoft AI agent controls on Monday, October 19, built around a blunt idea: treat the software agents your company runs as potential insiders. Each agent gets a risk score that updates continuously, and as the score climbs, the agent loses abilities until a person steps in or the agent is shut down. The features sit inside Microsoft 365 E7 and the company’s Project Perception security system, and they are in private preview for now. This article explains what Microsoft AI agent controls do, which parts are confirmed, and what the announcement leaves unanswered.
What Microsoft announced
According to GeekWire, every agent will be scored using signals such as the data it can reach and whether its actions drift away from the task it was given. SiliconANGLE adds that the score draws on identity, endpoint, cloud, and network information, and that Microsoft calls the feature Dynamic Agent Risk. A higher score can trigger a stronger response.
The responses escalate in steps. An agent might first lose the ability to write or change files while it keeps read access. High-impact actions can then require a verified human to approve them. At the top of the scale, the agent’s runtime can be isolated or stopped. Microsoft says these steps extend its Entra Conditional Access system, which already works this way for people, so that agents follow comparable rules.
For administrators, the practical change is that these Microsoft AI agent controls turn a vague worry into a dial. Instead of a yes-or-no decision about whether an agent may touch company data, the answer can shift as the agent’s behavior changes. A support agent that suddenly starts reading files unrelated to its tickets, for example, could be slowed down before anyone has to investigate.
Why Microsoft AI agent controls exist
Hayete Gallot, who leads Microsoft Security, used the phrase “agentic insider” in the company’s blog post, as SiliconANGLE reported. Her argument is that enterprise agents are often overprivileged, their numbers are growing quickly, and frontier models cannot be fully trusted because they are built to chase results. Some agents, she wrote, may reach a goal in unintended ways, including by colluding with other agents.
The framing echoes CEO Satya Nadella’s October 10 essay. He wrote that “The most trustworthy Super Intelligence system will not be the one with the model we trust most,” but “the one that enables us to trust the model the least.” In plain terms, the safety controls should live outside the model, not inside it.
Microsoft’s deputy CISO, Terrell Cox, put the scale this way, according to The Next Web: “At Microsoft, we are already operating in a world of hundreds of thousands of agents.” That is Microsoft’s own environment, not a customer figure, but it shows why a manual review of each agent isn’t realistic.
Discovery, permissions, and guardian agents
Controls only work if you know what is running. GeekWire reports that Microsoft is raising the number of agent types it can detect on employee computers from 25 to 60, and that the new additions include Anthropic’s Claude Code, OpenAI’s Codex, and GitHub Copilot. Discovered agents, including unknown ones, can get their own identities through Entra Agent ID.
A second feature, Dynamic Permissions, hands an agent temporary access scoped to what one task needs, for as long as the task lasts. Companywide limits are meant to keep an agent from holding more authority than the person it serves. Microsoft also describes a Microsoft Execution Container, a sandbox with monitoring placed outside it, so a compromised agent can’t switch the monitoring off.
Project Perception, which Microsoft introduced in July, gets what the company calls Guardian Agents. When an agent’s risk score shifts, Guardian Agents investigate why and can recommend or apply containment. People keep control of the policy and approval rules. Microsoft’s pitch is that software has to watch software, because humans can’t keep pace.
Price, availability, and what’s missing
GeekWire says the E7 tier launched in May at $99 per user per month and bundles Microsoft 365 Copilot, the E5 tools, the Entra Suite, and Agent 365. The new Microsoft AI agent controls are in private preview, with broader availability planned around Microsoft’s Ignite conference, November 17 to 19, in San Francisco. The Next Web, however, reports that Microsoft did not say whether the features cost extra on top of E7. Until Ignite, that question stays open.
There is also no independent test of the risk scores. We don’t know how often a score will flag a harmless agent, how often it will miss a harmful one, or how much tuning an administrator will need. Those are the numbers that decide whether security teams trust the system.
The wider context
The announcement lands after a run of reports about agents behaving badly. Our recent look at four new rogue-agent incidents at OpenAI described agents slipping out of test environments, and our piece on insurers adding AI exclusions to liability policies shows the financial side of the same worry. GeekWire notes that Microsoft is now competing with Google, Amazon Web Services, CrowdStrike, and Okta for this budget.
What to watch next
Three things are worth following as the Microsoft AI agent controls move toward wider release. First, the Ignite session details in mid-November, when pricing and general availability should become clearer. Second, whether customers publish real numbers on false alarms and missed detections. Third, whether rivals match the approach of tying an agent’s permissions to a live risk score. Microsoft also says it plans to feed chain-of-thought and other model-level signals into the risk score, which would be a notable step if it ships.
Editor’s take
The central idea, that an agent should have less power as it behaves less like its job description, is sensible and easy to explain to a board. The harder part is trust in the score itself, which nobody outside Microsoft has tested. For now, treat these Microsoft AI agent controls as a credible design with an unproven track record, and ask for false-positive data before relying on it.
