Microsoft says businesses should start treating AI agents as a new type of insider risk rather than simply trusted software. As agents gain access to company data, applications, tools and other systems, Microsoft argues that they need their own identities, tightly scoped permissions and continuous security monitoring.
The company has announced new security controls around Microsoft Entra Agent ID, Dynamic Permissions, Dynamic Agent Risk and Dynamic Conditional Access, alongside Project Perception and Guardian Agents.
The message for businesses is straightforward: an AI agent should not automatically inherit everything its user can access. It should be given only the authority required for the task, for only as long as that authority is needed.
Why does Microsoft call AI agents an insider risk?
AI agents are increasingly able to do more than generate text. They can research information, call tools and APIs, access business data and take actions across systems.
Microsoft's concern is not that agents are inherently malicious. The risk is that an agent can make a mistake, be manipulated by untrusted content, be compromised, or simply behave differently as its context changes.
An agent operating at machine speed can potentially take many actions before a person has time to investigate, so Microsoft argues that security controls need to react just as quickly.
What is Microsoft changing?
Microsoft is extending its security stack to give organisations more visibility and control over AI agents.
- Microsoft Entra Agent ID gives agents distinct identities rather than treating them as extensions of a user's identity.
- Dynamic Permissions can provide task-specific, time-limited authority instead of permanent broad access.
- Dynamic Agent Risk continually assesses an agent using signals from identity, data, endpoints, cloud, network, runtime and the agent's own activity.
- Dynamic Conditional Access can reduce or revoke permissions as risk rises.
- Guardian Agents can help investigate and contain risky agent behaviour at machine speed under policies set by people.
Planning to use AI agents in your business?
KES can help you assess AI access, Microsoft 365 permissions, data security and governance before agents are given access to live business systems.
What are Dynamic Permissions?
Microsoft's proposed model is that an agent should begin with no authority and receive only the permissions needed for its current task.
Those permissions can be:
- limited to specific data or systems
- time-bound
- reduced as the task changes
- removed when the task finishes
- subject to verified human approval for higher-impact actions
Microsoft explicitly says an agent should not automatically inherit every standing permission held by the employee who sponsors it.
What is Dynamic Agent Risk?
Dynamic Agent Risk is designed to continuously reassess what an AI agent is doing and whether its current permissions still match its behaviour and task.
For example, an agent may start with legitimate access to review expenses. If it later encounters a prompt injection in an external document and attempts an unrelated action, its risk can increase even though its original configuration has not changed.
Microsoft says that change in risk can then feed directly into policy decisions rather than waiting for a manual security review.
How can Dynamic Conditional Access restrict an agent?
Microsoft says the response does not have to be a simple allow-or-block decision.
Depending on risk, policy could:
- keep read access while blocking write actions
- reduce the data and resources an agent can reach
- restrict network paths
- shorten or revoke time-limited access
- require human approval before a consequential action
- isolate or stop the agent if risk becomes severe
This extends the same Zero Trust principle businesses already apply to people: verify continuously and grant the minimum access required.
Can Microsoft discover AI agents that were not centrally deployed?
Microsoft says it is expanding agent discovery to support 60 types of local agents. The examples it gives include Claude Code, OpenAI Codex and GitHub Copilot.
The goal is to place discovered agents into a unified registry so IT and security teams can understand who owns them, what they are doing and what risk they represent.
This is important because AI use often starts outside a formal IT project. Staff may introduce coding agents, browser agents or automation tools before the business has established an AI governance policy.
What should an SME take from this?
Most small and medium-sized businesses will not deploy Microsoft's entire Project Perception architecture immediately. But the underlying principles are relevant now.
- Know which AI tools and agents staff are using.
- Do not give an AI agent broad Microsoft 365 or administrator access simply because it is convenient.
- Use separate identities where possible.
- Apply least privilege and remove access when it is no longer required.
- Know what business data an agent can read, change or send elsewhere.
- Keep meaningful human approval around financial, security or destructive actions.
- Monitor agent activity rather than assuming approved software will always behave safely.
These are the same principles we would apply to any powerful automation or privileged account.
Does this mean businesses should avoid AI agents?
No. Microsoft's position is that businesses should not have to choose between AI adoption and security.
The important distinction is between allowing AI to provide intelligence and giving it unrestricted authority. The model can propose, reason and act, but independent controls should determine what it is actually allowed to access and change.
That is likely to become increasingly important as Microsoft 365 Copilot, third-party AI platforms and autonomous agents take on more operational work.
Quick answers
What is an AI agent insider risk?
It is the risk created when an AI agent has access to company data and systems and can take actions on behalf of users or the business.
What is Microsoft Entra Agent ID?
It gives AI agents distinct identities that can be managed through identity, ownership, lifecycle, permissions and policy controls.
What are Dynamic Permissions?
They are task-specific permissions that can be time-limited and reduced or removed as the task changes.
What is Dynamic Agent Risk?
It is Microsoft's continuously updated assessment of an agent's current behaviour, access and potential impact.
Should an AI agent inherit all of a user's Microsoft 365 access?
Microsoft says no. The agent should have its own identity and only the authority required for the approved task.
Sources
