Microsoft announces risk-based access controls for AI agents

Microsoft has announced security features for Microsoft 365 E7 and Project Perception designed to restrict AI agents’ access and adjust those restrictions as risk changes. The company said the tools would monitor agents and allow controls ranging from reduced permissions to stopping an agent.

Under Dynamic Permissions, agents begin without their own access rights, Microsoft said. Permissions are granted according to the needs of an individual task and last only for its duration. Dynamic Agent Risk continuously assesses agents using signals from their behavior alongside identity, device, data, network and cloud information.

Dynamic Conditional Access applies Entra controls to agents. As risk increases, an agent could be restricted to reading rather than changing files, blocked from certain data, required to obtain human approval or halted.

Microsoft said it can now detect 35 additional agent types on employee devices, bringing coverage to 60. Examples include Anthropic’s Claude Code, OpenAI’s Codex and GitHub Copilot. Entra Agent ID will assign identities distinct from those of users to these agents and others that are unknown.

For Project Perception, Microsoft is adding Playbooks and Guardian Agents to investigate changes in risk and recommend or impose restrictions. Agents can also operate in sandboxes such as Microsoft Execution Container, which the company said places monitoring controls beyond an agent’s reach even if it is compromised.

Hayete Gallot, executive vice president of Microsoft Security, argued that organizations should regard agents as insiders because of their access and potentially unexpected behavior. Microsoft did not provide an availability timetable or say whether the features would cost extra.