Microsoft Adds Controls to Limit or Stop Risky AI Agents at Work

What Microsoft announced

According to SecurityWeek, Microsoft said on Monday that it is extending Project Perception, its agentic security system, with dynamic permissions, continuous risk scoring and Guardian Agents. Hayete Gallot, executive vice president of Microsoft Security, wrote that companies tend to trust the AI agents they deploy by default, and that those agents are often overprivileged. Microsoft's position is that agents should be treated as insiders, not as trusted software. Nadim Abdo, Microsoft's corporate vice president for identity and network access, added that the label does not mean agents are malicious. He said they are capable tools that users can give access to important systems, and that they can make mistakes, be manipulated or be compromised.

The announcement has three parts. Dynamic Permissions sets the upper limit of what an agent may do through company policy and the rights of the person who sponsors it. Within that limit, each task gets only the access it needs, for as long as the task lasts. Dynamic Agent Risk combines signals from identity, data, endpoints, cloud, network, runtime and the agent's own activity. According to SiliconANGLE, the score rises when an agent's behavior drifts from what its user or organization intended. Dynamic Conditional Access, which extends Microsoft Entra Conditional Access to agents, uses that score to decide what happens next.

Why it matters for businesses that automate work

Most businesses that automate routine work give software bots, copilots or agents the same access as the staff member who set them up. That is the pattern Microsoft is pushing against. An agent that reconciles invoices or sends follow-ups may hold far more reach than its job needs, and a single unsafe instruction hidden in a document could push it into the wrong action. Microsoft's own examples describe an expense-processing agent that meets a prompt injection inside an outside document. In that case, the agent could lose approval rights while keeping the ability to read.

The point for owners is simple. Automation is no longer only a question of what a tool can do. It is also a question of what it is allowed to touch, and for how long.

What changes in practice

Microsoft describes its responses as graduated rather than all-or-nothing. As risk rises, the system can move through steps. The table below sets out the responses that Microsoft and reporting on the announcement describe.

For a business, the practical steps are mostly about planning. Someone needs to list every agent in use, including tools staff run on their own machines. Microsoft says its discovery tools can now identify 60 types of local agents after adding 35, according to SiliconANGLE. Microsoft's documentation also makes a distinction that matters here. Finding an agent does not mean runtime enforcement supports or protects it, according to Cyberpress. Each agent then needs its own identity, a task-level permission set, and a named person who approves high-impact actions such as payments, deletions or outgoing messages to customers.

Smaller firms may not have an IT security team. For them, the same steps still apply, but the owner or the finance lead usually makes the decisions. A five-person firm might only need to decide which agents can post entries and which ones can only read. A large group will need those rules written into policy and reviewed by security staff.

Limits and open questions

The controls are Microsoft's own, and they are described in terms of Microsoft 365 E7 and Project Perception. The reporting reviewed for this article does not show how the tools would work with agents built by other vendors, so businesses running mixed systems should not assume full coverage. Automated containment also has a cost. An agent that is blocked or stopped mid-task can leave a process half finished, so someone still has to check the work and restart it. Automation does not remove the need for an operations owner who knows the process.

What to watch next

Three things will show how much this matters in practice. The first is availability. The sources reviewed describe the controls but do not give a clear general release date for each part. The second is how many agent types the enforcement layer covers, as opposed to the number it can merely discover. The third is whether other large software vendors publish matching controls. Businesses should check Microsoft's documentation for current availability before planning changes to their agent setup.