Microsoft proposes monitoring company AI agents as an insider risk
IA en un minuto newsroom · Editor: Jon Elgezabal
In 30 seconds
Microsoft argues that companies should treat the AI agents they deploy as possible insider threats, since they often hold more access than they need. Project Perception would give them identity and permissions, measure their risk with signals from across the network and put Guardian Agents in charge of checking each step. The new tools, such as Dynamic Permissions, still have no release date.
Microsoft wants companies to keep watch over the AI agents they themselves have deployed, treating them as an insider risk. Hayete Gallot, executive vice president of Microsoft Security, made the case on Monday on the company's official blog.
According to Gallot, these agents already operate at scale inside companies, their numbers keep rising and they often hold more privileges than they need: they can reach data, tools and systems, and they can make decisions in critical processes. She maintains that the most advanced models cannot be relied on, whatever their origin, not because they mean harm but because they are trained to achieve results and can act in unexpected ways.
Her proposal is to use Project Perception, the agent-based security system Microsoft announced in July, to find those agents and bring them under control, giving each one its own identity, a container, and policies and permissions. Drawing on signals from identity, data, cloud, devices, network and runtime, the system continuously recalculates the risk of what each agent is trying to do. A team of Guardian Agents (agents that supervise other agents) checks every action in real time and reacts when that risk goes up.
The specific tools are described in a separate post on Microsoft's security blog, signed by Nadim Abdo, corporate vice president for identity and network access. With Dynamic Permissions, an agent begins with no permissions and gets just the access its approved task requires, only while that task lasts, and it can never obtain more authority than the person using it. With Dynamic Conditional Access, which brings Microsoft Entra access controls to agents, the response to risk comes in stages: it can take away write access while keeping read access, block access to sensitive data, require a person's approval before an important step or, at worst, isolate or stop the agent.
Microsoft is also expanding detection to 35 more types of local agents (those that run on staff computers), for a total of 60, among them Claude Code, OpenAI Codex and GitHub Copilot. According to The Next Web, the new features are coming to Microsoft 365 E7 and Project Perception, they follow an essay in which Satya Nadella urged earlier this month that models be treated as an insider risk, and Microsoft has not said when they will be available or whether they will cost anything beyond the E7 license.
Gallot also calls for more transparency into the models, including their chain of thought, as the next step: that way it would be possible to know not only what an agent does but why it does it. In her view, that transparency will not replace containing agents, but it will make containment more effective.
Why it matters · analysis and opinion
Until now, company security has mostly looked outward: attacks, stolen passwords, phishing emails. Microsoft's approach turns that idea around and places the threat inside, in tools the company itself has installed and given access to its email, documents or accounts. Coming from Microsoft, that carries weight, because many teams already use coding assistants like the ones it now wants to detect, or agents connected to their data, without anyone keeping track. The announced tools have no date or price, and it remains to be seen whether they will reach beyond the enterprise license Microsoft bundles them with: that will decide how many small companies can use them or will have to find another way to watch over their agents.
Official source: Microsoft · Written with the help of AI: how we make the news
What does it mean for your business? · analysis and opinion
This mainly affects small businesses and freelancers in Spain and Latin America that have already connected AI agents to their email, documents, invoicing software or coding tools. Those who only use a chatbot to draft text, without giving it access to their systems, are much less affected. The underlying idea Microsoft puts forward is that an agent should not be trusted by default: it can build up more privileges than it needs and behave differently than expected even if nobody has attacked it.
Our advice is to start with a simple inventory: which agents are running in the company, who set them up and which data and applications they can reach. After that, it is worth cutting every permission down to the minimum the task requires, giving agents their own accounts instead of using a person's account, and requiring human approval before payments, outgoing emails or deletions. Checking the activity log from time to time helps spot whether an agent is doing things it should not be doing.
The source gives no pricing or terms for Project Perception, so the prudent approach is not to wait for a tool like this before applying these measures, which cost little more than time. The risk of not doing so is that an agent with broad access touches customer data or makes decisions that nobody has authorized.
