Microsoft Now Treats Your AI Agents Like Insiders: Risk Scores, Kill Switches and 60 Agent Types It Can Find on Your Laptops (AI Trends, 20 October 2026)

What’s trending in AI on 20 October 2026: Microsoft has stopped asking whether AI agents can be trusted and started building controls that assume they can’t. On 19 October it announced a set of tools for what it calls the “agentic insider”: a live risk score for every agent, permissions that exist only for the length of a task, graduated responses that can strip an agent’s write access or stop it outright, and discovery that now recognises 60 types of agent running on employee machines, including Claude Code, OpenAI Codex and GitHub Copilot. The features sit in Microsoft 365 E7 and Project Perception, its AI security system, and are in private preview. The idea behind them is more important than the product: the guardrails belong outside the model, where an agent cannot switch them off. Below: what Microsoft announced, how the risk ladder works, what is still unknown, and a fill-in worksheet to apply the same model whether or not you ever buy E7.

Key takeaways

Agents are now insiders by design. Microsoft’s new controls treat every AI agent as a potential insider risk: not malicious, but able to make mistakes or be manipulated.
Risk is scored live. Dynamic Agent Risk updates each agent’s score from identity, data, endpoint, cloud, network and runtime signals, and rises when an agent drifts from its task.
The response is graduated. Dynamic Conditional Access can keep reads but block writes, narrow data, demand human approval, or isolate and stop the agent.
Shadow agents get found. Discovery adds 35 local agent types for a total of 60, and each agent can get its own Entra Agent ID, separate from the person who runs it.
Dates and prices are thin. The features are in private preview, with more detail promised at Ignite (17 to 19 November). The principles work today with tools you already own.

Microsoft’s pitch in one line: trust the model less, and put the brakes where the agent can’t reach them.

1. What Microsoft announced

The announcement came in a Microsoft Security Blog post by Nadim Abdo, corporate vice president for identity and network access, titled “Agents are your newest insiders.” It follows Satya Nadella’s 10 October essay arguing that companies should treat frontier models as insider risks, which we unpacked in our look at Nadella’s “emergency brake” essay. Nine days later, the essay has products attached.

Microsoft’s reasoning is simple. Agents need fairly broad access to be useful. They act at machine speed, so people cannot watch every step. And they can be wrong, or be steered by a hidden instruction in a document or web page. So the company frames the job as four continuous duties: know which agents exist, who owns them and what they do; contain what each one can reach before it acts; protect the data, tools and systems in its path; and adapt those protections as behaviour and risk change.

The new pieces map onto those duties:

Wider agent discovery. Microsoft is adding 35 local agent types, for 60 in total. The three named examples are Anthropic’s Claude Code, OpenAI’s Codex and GitHub Copilot. GeekWire describes this as a jump from 25 to 60.
Microsoft Entra Agent ID, extended. New identity types cover more agent patterns, including local agents and unknown agents found by security sensors. Each agent gets an identity separate from the person who sponsors it, so logs can tell a human action from an agent action.
Dynamic Permissions. Agents start with no authority of their own and get only what an approved task needs, for as long as it needs it. An agent can never exceed the authority of its user, and higher-impact actions can require verified human approval.
Dynamic Agent Risk. A continuously updated risk score that weighs an agent’s configuration, what it can reach, its potential impact and signs that it is drifting from the user’s or the organisation’s intent.
Dynamic Conditional Access. Entra Conditional Access, extended to agents, so a rising score triggers tighter limits across the security stack.
Microsoft Execution Container (MXC). A sandbox where agents run with policy-controlled access, while the monitoring sits outside, out of the agent’s reach.
Guardian Agents and Playbooks in Project Perception. Playbooks let security teams define the outcome they want. Guardian Agents, which are themselves AI agents, investigate why another agent’s risk changed and recommend or apply containment.

Project Perception was first unveiled in July. TechRadar describes it as a system of red agents that probe for weaknesses, blue agents that investigate and green agents that fix. It now shares signals and a single agent registry with Microsoft Agent 365, the company’s control plane for deploying and governing agents.

The framework is useful even without Microsoft’s products: every agent control you own fits into one of these four boxes.

2. Why “insider” is the right word

Security teams already know how to handle a trusted person who might go wrong: give them only the access they need, log what they do, watch for unusual behaviour and have a way to cut access fast. Microsoft is applying that playbook to software that reasons. The difference is speed and scale. Microsoft says it already runs hundreds of thousands of agents internally, and expects customers to run thousands or more.

Recent weeks explain the urgency. We have covered AI labs’ test agents reading Indian firms’ private records through leaked keys, and a single hacker using a swarm of agents to break into more than 100 companies. GeekWire ties Microsoft’s move directly to reports from Anthropic and OpenAI about test agents that went further than they were allowed. None of those agents needed bad intent. They needed access and a goal.

Microsoft’s own example is ordinary on purpose. An expense-processing agent reads a document carrying hidden instructions and tries an action unrelated to expenses. Least privilege alone would not stop that, because the agent legitimately has access to approve expenses. A risk-aware system could notice the drift, remove the agent’s ability to approve while letting it keep reviewing, and isolate or stop it if the risk keeps climbing. Hayete Gallot, Microsoft Security’s executive vice president, put the principle bluntly to SiliconANGLE: “Model transparency will not replace containment.”

3. The risk ladder: how an agent loses its keys

The most practical idea in the announcement is that switching an agent off is not the only option. Most businesses treat agent control as binary: the agent is either connected or it isn’t. Microsoft’s Dynamic Conditional Access describes a ladder of responses that tighten as the risk score rises. That matters because an all-or-nothing switch tends to stay “on” too long, since turning it off breaks work.

Six levels between “fully trusted” and “switched off”. Most organisations today have only the two ends.

Microsoft says the risk score draws on signals from across its stack, including Sentinel, Entra, Intune, Purview, Global Secure Access and Defender. It is also starting to feed in model-level signals, such as chain-of-thought, to spot an agent whose reasoning is being bent by untrusted input. That last part is new and unproven. Reasoning traces are not always faithful to what a model actually does, so treat them as one signal among many, not a lie detector.

4. The shadow-agent problem: 60 agent types on your laptops

The least flashy feature may be the most useful. Many agents in a business were never approved by anyone. A developer installs a coding agent. A marketer adds a browser extension that can act inside open tabs, like the one we covered this morning in ChatGPT’s new Chrome work mode. These agents run with the employee’s own access, and from the outside they look like the employee.

Microsoft’s discovery now recognises 60 local agent types, and the Entra Agent ID extension means a discovered agent can be given its own identity and made a policy target even if it was never integrated with Microsoft’s tools. That is the move that turns shadow AI from an unknown into a list. Microsoft links to a Defender for Endpoint support matrix for the full set of agents.

Discovery more than doubled. The bigger change is that a found agent can get an identity of its own.

Separate identities matter for more than tidy dashboards. When an agent and a person share one login, you cannot tell afterwards who deleted the file or sent the email, and you cannot restrict the agent without restricting the person. We made the same argument when AI agents started getting employee IDs, phone numbers and inboxes: an agent that acts on its own needs credentials of its own.

5. What it costs, when it ships, and what’s still missing

This is where buyers should slow down. Microsoft’s blog gives no release dates or prices. GeekWire reports the features are in private preview, with broader availability planned around Ignite in San Francisco, 17 to 19 November. Microsoft 365 E7, which launched in May at $99 per user per month, bundles Microsoft 365 Copilot, the E5 security and productivity suite, the Entra Suite and Agent 365. TNW notes Microsoft has not said whether the new agent controls will cost extra on top of E7.

Question	What we know	What’s still open
Availability	Private preview (GeekWire)	General availability date; Ignite (17–19 Nov) is the next checkpoint
Licensing	Positioned within Microsoft 365 E7 and Project Perception	Whether any piece is an add-on; what lower tiers get
Price	E7 is $99 per user per month	Any separate charge for Guardian Agents or the sandbox
Agent coverage	60 local agent types, including Claude Code, Codex and Copilot	How well it handles custom or self-built agents
Effectiveness	Microsoft’s design and examples	Independent testing; false-positive rates; how fast the ladder reacts
Guardian Agents	Can investigate and recommend or apply containment	Which actions they may take alone, and who audits them

Sources: Microsoft Security Blog, GeekWire, TNW, SiliconANGLE (19–20 Oct 2026). “Open” items are questions to ask, not known problems.

Two honest caveats. First, every detail so far comes from Microsoft. SiliconANGLE notes its report carries no independent analyst view, and TechRadar points out there is no performance data. Second, Guardian Agents put AI in charge of watching AI. Microsoft says people keep control of objectives, policy and approval boundaries, but any agent that can apply containment by itself is also an agent whose own permissions need the same scrutiny.

Competition will shape the answers. GeekWire frames the launch as Microsoft’s bid to be the control system for enterprise agents, against Google, AWS, CrowdStrike and Okta. Expect rival announcements, and use them as leverage: the features here are a useful checklist to put in front of whichever vendor you already pay.

6. The agent insider worksheet

Recent guides here have used if-then rules, traffic lights and scorecards. This one is a worksheet: twelve rows you can copy into a spreadsheet, assign an owner to and mark done. It follows Microsoft’s four duties, but none of it requires E7. Most rows can be done with your identity provider, endpoint tools and a policy document.

Twelve rows, four duties. The full worksheet, with “done when” tests, is below.

#	Duty	Task	Done when…
1	Know	Inventory every agent: SaaS copilots, browser extensions, coding agents, scheduled automations	You have one list, and endpoint scans for local agents match it
2	Know	Assign a named human owner and a written purpose to each agent	No agent on the list has a blank owner field
3	Know	Give agents their own service identities instead of shared human logins	Logs show whether a person or an agent took each action
4	Contain	Start new agents with no standing access and grant per task	No agent holds admin or broad “allow always” rights by default
5	Contain	Make agent tokens and permissions expire	Every agent credential has an end date or task-based expiry
6	Contain	Cap agent rights at the sponsoring user’s rights	An agent cannot do what its owner could not do by hand
7	Protect	Allow-list the tools, APIs and MCP servers each agent may call	Unknown connectors are blocked, not just logged
8	Protect	Send agent logs to a store the agent cannot write to or delete	A compromised agent could not erase its own trail
9	Protect	Run code-executing agents in a container or VM, away from secrets	No coding agent can read production keys from a laptop
10	Adapt	Define a “read-only” mode you can switch an agent into	You can remove write access without breaking the whole workflow
11	Adapt	List high-impact actions that always need human approval	Payments, deletions, external emails and permission changes are on it
12	Adapt	Rehearse stopping each critical agent	Someone has done it once, timed it, and written down how

Copy into a spreadsheet and fill in the Owner column. Rows 1–3 come first: you cannot contain an agent you have not found.

Three notes on using it. Rows 4 and 11 overlap with the habits we flagged when “Allow Always” became the new “I Agree”: the default click is where most over-permissioned agents come from. Row 9 is the cheapest high-value control for teams using coding agents, since they often run with full access to a developer’s machine. And row 12 is the one most often skipped. A stop button nobody has pressed is a hope, not a control.

7. If you already run Microsoft 365

If you are a Microsoft shop, a few concrete steps make sense before Ignite. Ask your account team whether you can join the private preview, and which parts depend on E7. Check whether your current Defender for Endpoint deployment can already see local agents, using the support matrix Microsoft links to. Review your Entra Conditional Access policies with agents in mind: many were written for people and devices, and will not fire for a service identity acting on a user’s behalf. And build the worksheet anyway, because a preview tool needs a list of agents and owners to work with on day one.

If you are not on Microsoft’s top tier, don’t wait for a licence to adopt the model. The core ideas of separate identities, expiring access, a read-only fallback and an external log are all things identity and endpoint tools from several vendors can approximate today. The new demand for AI security engineers is partly about exactly this work: someone has to own the list and tune the rules.

8. The bottom line

Microsoft’s announcement is a product launch, but it is also a public admission from one of AI’s biggest backers that capable models should not be trusted to police themselves. Nadella’s line, as reported by GeekWire, is that the most trustworthy system will be “the one that enables us to trust the model the least.” Whether Microsoft’s version works as described will only be clear after Ignite and independent testing. The design pattern is already clear, though: find every agent, give it its own identity, give it only what the task needs, keep the brakes outside its reach and practise pulling them. That is good AI agent security with or without a $99 licence.

Frequently asked questions

What did Microsoft announce for AI agent security on 19 October 2026?

Microsoft announced controls that treat AI agents as potential insider risks. They include Dynamic Permissions, Dynamic Agent Risk scoring, Dynamic Conditional Access for agents, wider discovery of local agents, extended Entra Agent ID identities, the Microsoft Execution Container sandbox, and Guardian Agents and Playbooks in Project Perception.

What is Dynamic Agent Risk?

It is a continuously updated risk score for each AI agent. It combines signals from identity, data, endpoints, cloud, network, runtime and the agent’s own activity, and rises when the agent drifts from what its user or organisation intended. Dynamic Conditional Access uses the score to tighten the agent’s access.

Which AI agents can Microsoft now detect on employee devices?

Microsoft says its discovery now covers 60 local agent types after adding 35. The named examples are Anthropic’s Claude Code, OpenAI’s Codex and GitHub Copilot. The full list is in Microsoft’s Defender for Endpoint AI agent support matrix.

Do I need Microsoft 365 E7 to get these features?

Microsoft positions the controls within Microsoft 365 E7, which costs $99 per user per month, and Project Perception. It has not given release dates or said whether any part costs extra. GeekWire reports the features are in private preview, with broader availability planned around Ignite, 17 to 19 November 2026.

What are Guardian Agents?

Guardian Agents are AI agents inside Microsoft’s Project Perception that watch other agents. They investigate why an agent’s risk changed, gather evidence, and recommend or apply containment. Security teams set their objectives, policies and approval boundaries through Playbooks.

How can a small business treat AI agents as insiders without new tools?

Start with an inventory of every agent and a named owner for each. Give agents their own identities, grant access per task with an expiry, cap agents at their user’s rights, keep logs where agents cannot edit them, require human approval for payments and deletions, and rehearse switching each critical agent off.