Microsoft calls AI agents insiders: start them at zero access

Microsoft just told its biggest customers to stop trusting their own AI agents. On October 19, Microsoft Security EVP Hayete Gallot published "Securing the agentic insider", arguing that AI agents inside a company should be treated as possible insider threats. A deployed agent is not a trusted agent. The new tools that back that up are Dynamic Permissions and Dynamic Agent Risk, and the idea behind them costs nothing to copy.

What actually happened

Per Microsoft's Security blog post by Nadim Abdo, CVP of Identity and Network Access:

• Dynamic Permissions. Org policy sets the outer limit. Inside it, agent access is task-scoped, time-bound and removed when the task ends. Higher-impact actions can require a verified human approval.
• Dynamic Agent Risk. A live risk score per agent, built from identity, data, endpoint, cloud, network, runtime and agent-activity signals. Microsoft also feeds in model signals such as chain-of-thought to catch "intent drift."
• Dynamic Conditional Access. Entra Conditional Access now applies to agents, with graduated responses: cut permissions, isolate the runtime, or stop the agent.
• Discovery. Microsoft added 35 local agent types, for 60 total, including Claude Code, OpenAI Codex and GitHub Copilot. Each can get its own Entra Agent ID.
• Guardian Agents. Inside Project Perception, these agents review other agents' actions and can investigate a risk change and suggest or apply limits.

The Next Web reports the tools tie into Microsoft 365 E7, but Microsoft did not say when they ship or whether they cost extra. Neither Microsoft post gives dates or license tiers. Treat this as direction, not a product you can buy today.

Why it matters for your business

You probably do not have an E7 license. You do have agents: a coding agent on a laptop, a Zapier flow with your CRM key, a support bot with order lookup. Most of them got broad access on day one and still have it.

Microsoft's design is the right one, and you can build the small-business version this week:

• Start at zero. A new agent gets no access. Add only the scopes its one job needs.
• Give it its own identity. A separate service account or API key per agent, never a person's login. When it misbehaves, you cut one identity.
• Make access expire. Short-lived tokens beat permanent keys. Re-grant on purpose.
• Gate the expensive actions. Refunds, deletes, outbound email and payments need a human click.
• Keep the brake outside the agent. Spend caps, rate limits and revocation live in your provider console, where the agent cannot touch them.

Sources: Official Microsoft Blog, Microsoft Security Blog, The Next Web.