On October 19, 2026, Microsoft called AI agents “agentic insiders”: trusted software that works inside your organization, often with more access than it needs, and that can make mistakes, be manipulated or be compromised. Its answer is a security model with four parts: know every agent, contain what it can do, protect what it touches and adapt as risk changes. Most of the first steps can start this week with tools that are already generally available.
This article explains what Microsoft announced, what is available today and a 30-day plan our experts use to move from “we think we know our agents” to agents that are known, owned and contained.
Why Microsoft calls agents insiders
For years, security teams have focused on attackers outside the network. Agents change that. In Microsoft’s announcement, Hayete Gallot, Executive Vice President of Microsoft Security, argues that agents running inside a company are implicitly trusted, even though the models behind them are not tuned to its rules or judgment. They are trained to reach a result, and that can lead them to take shortcuts nobody intended.
The risk is not that agents are malicious. It is that they are:
- Overprivileged. Many agents inherit the access of the person who built them, or get broad permissions “to make it work”.
- Fast and always on. An agent can act thousands of times before a person notices a pattern.
- Hard to see. Agents live in Copilot Studio, Microsoft Foundry, other clouds and, more and more, on employees’ own devices. Our guide to shadow AI agents shows where they hide.
That is the same profile security teams already manage for privileged users, which is why the insider framing fits.
Know, contain, protect, adapt
In a companion post, Nadim Abdo, Corporate Vice President of Identity and Network Access, describes four responsibilities that run at the same time, not as phases:
| Responsibility | The question it answers |
|---|---|
| Know | Which agents exist, who owns them, why they exist and what they do |
| Contain | What each agent can access and do, before it acts |
| Protect | The data, tools, runtime and systems in the agent’s path |
| Adapt | How protection changes as behavior, context and risk change |
The key principle: controls must sit outside the model, where the agent cannot bypass or change them. In practice, that means identity, permissions and monitoring that the agent itself does not control, which is why each agent needs its own identity and why Microsoft Agent 365 puts every agent in one registry.
What Microsoft announced, and what you can use today
The October 19 posts introduce several capabilities but do not give a release date or license for each one. Microsoft names Microsoft 365 E7 as the home for the new capabilities. This is what we could verify:
| Capability | What it does | Status we could verify |
|---|---|---|
| Project Perception | Microsoft’s agentic security system, now extended to agents inside the organization, with Guardian Agents that supervise agent actions and new Playbooks | Public preview since August 3, 2026 for the original system; no date for the extension |
| Local agent discovery | Finds AI agents running on employees’ devices, such as Claude Code, OpenAI Codex and GitHub Copilot | 60 agents listed for Windows; macOS discovery and runtime protection are in preview |
| Microsoft Entra Agent ID | Gives each agent its own identity, separate from its user or sponsor, now extended to more agent types | Generally available since April 2026; no date for the new identity types |
| Microsoft Execution Container | Runs the agent in a sandbox, with an enforcement boundary the agent cannot reach | No status in the October 19 posts |
| Dynamic Permissions, Dynamic Agent Risk and Dynamic Conditional Access | Task-scoped, time-bound access; a continuous risk score per agent; graduated responses, from blocking writes to stopping the agent | Announced; no release date yet |
Our advice: plan with what is generally available now and treat the rest as the roadmap. The foundations, an inventory, an identity per agent and least privilege, are the same either way.
A 30-day plan to start
| Week | Focus | Key actions | Done when |
|---|---|---|---|
| 1 | Know | Review the Agent 365 registry, turn on Defender local agent discovery and check shadow AI discovery in Global Secure Access | You have one list of agents, including the ones on devices |
| 2 | Own | Assign an accountable person to every agent and retire the ones nobody claims | No agent without an owner |
| 3 | Contain | Give agents their own identity with Entra Agent ID, remove application permissions where delegated permissions are enough, as Microsoft’s best practices recommend, and review Conditional Access for agents | Every high-impact agent has least privilege |
| 4 | Watch | Turn on risky agent detections, route agent alerts to your SOC and agree who can stop an agent | Your SOC knows what an agent incident looks like and who acts |
Two rules our experts apply from day one: no agent goes to production without a named owner, and any action that moves money, data or access requires a human approval step.
How our experts help, step by step
The four responsibilities match the way Synergy Advisors already works on agents. Each one has an Agent 365 E-xperience scenario and a free webinar in our Agent 365 series:
| Responsibility | Agent 365 E-xperiences scenario | Free webinar |
|---|---|---|
| Know | Observe agents and prevent sprawl | Agent Visibility, December 1 |
| Contain | Onboard with least privilege and govern agent tools | Agent Identity, December 3 |
| Protect | Protect against oversharing | Agents & Data, December 8 |
| Adapt | Defend against AI threats | Protect the Agentic Enterprise, December 10 |
With Agent 365 E-xperiences, our experts take organizations through these steps in their own tenant: an inventory of the agents they really have, an identity and owner for each one and the first containment policies. For the “adapt” side, the Micro-Vigilant SecOps Agent, one of our E-gents, shows SOC teams how Microsoft Defender XDR incidents are being handled, so new agent-related alerts do not get lost in the queue.
Frequently asked questions
What is an agentic insider?
It is Microsoft’s term for an AI agent that works inside your organization with trusted access to data, tools and systems. Like a human insider, it can cause harm through mistakes, manipulation or compromise, so it needs identity, least privilege and continuous monitoring.
Is Project Perception available?
Microsoft put Project Perception in public preview on August 3, 2026. The October 19 extension to internal agents, including Guardian Agents and Playbooks, does not have a published release date yet.
Do we need Microsoft 365 E7?
Microsoft says the new capabilities will be part of E7, but it has not published the details. Agent 365, Entra Agent ID and Defender local agent discovery are available today, so you can start without waiting.
What should we do this week?
Build one list of your agents, including the ones on employees’ devices, and give each one an owner. Everything else depends on that list.
Next step
Our experts can run this plan with you, in your own tenant. Explore Agent 365 E-xperiences, start with the Beyond the Agent webinar on November 10, or watch the Agent 365 101 episodes, ten short videos on the essentials.
Sources
- Securing the agentic insider (Oct 19, 2026) Microsoft
- Agents are your newest insiders (Oct 19, 2026) Microsoft Security Blog
- Rethinking security for the age of AI: Project Perception (Jul 27, 2026) Microsoft
- AI agent support matrix Microsoft Learn
- What is Microsoft Entra Agent ID Microsoft Learn
- Agent registry Microsoft Learn
- Local AI agent discovery with Defender for Endpoint Microsoft Learn
- Shadow AI discovery in Global Secure Access Microsoft Learn
- Agent ID best practices Microsoft Learn
- Conditional Access for Agent ID Microsoft Learn
- Risky agents in ID Protection Microsoft Learn
