Microsoft is strengthening safeguards around enterprise AI agents with new tools designed to restrict what automated systems can access, detect suspicious behaviour, and adjust privileges as threats emerge.
The announcement introduces three capabilities: Dynamic Permissions, Dynamic Agent Risk and Dynamic Conditional Access. Together, they are intended to help organisations prevent AI agents from exceeding their assigned responsibilities without unnecessarily disrupting the employees who use them.
The move addresses a growing security concern as businesses deploy agents to handle tasks such as software development, expense processing, research and data analysis. These systems often need access to sensitive company resources, but their behaviour can change when they encounter unexpected information or malicious instructions.
AI agents will receive only task-specific permissions
Microsoft’s new Dynamic Permissions capability is built around the principle that an AI agent should not automatically inherit all the access rights of the employee who authorises it.
Instead, agents should begin without standing permissions and receive only the privileges required for an approved task. Those permissions can be limited to a specific period and withdrawn or adjusted when the task changes or ends.
Organisational policies will establish the maximum authority an agent can receive. An agent will not be permitted to obtain privileges beyond those held by its sponsoring employee, while sensitive operations can require verified human approval.
This separation is designed to ensure that an employee retains their normal access even when the security system restricts the agent operating on their behalf.
New tools will monitor changing security risks
The second capability, Dynamic Agent Risk, continuously evaluates an agent’s potential exposure to threats. It combines information from identity systems, endpoints, networks, cloud resources, data environments and the agent’s own activities.
Rather than assigning a fixed risk score when an agent is deployed, the system reassesses whether its behaviour and access remain appropriate as circumstances change.
For example, an expense-processing agent might initially have permission to review submissions, check company policies and approve routine reimbursements. If it encounters malicious instructions hidden in a document and attempts to perform an unrelated action, its risk assessment could increase.
Dynamic Conditional Access is designed to respond to those changes by adjusting what the agent can do.
Depending on the risk, the system could preserve read access while blocking changes to data, restrict access to sensitive resources, require human approval for consequential actions or isolate the agent entirely. Microsoft says this approach allows security teams to respond proportionately rather than treating every threat as a reason to shut down an agent.
The capability extends Microsoft Entra Conditional Access, the company’s existing framework for enforcing identity- and risk-based access policies.
Microsoft expands AI agent discovery
Microsoft is also expanding its ability to identify locally running AI agents across enterprise environments.
The company plans to support 35 additional types of local agents, bringing the total to 60. The supported examples include Claude Code, OpenAI Codex and GitHub Copilot.
The expansion is intended to help organisations identify agents operating on their systems, including those introduced outside central deployment processes.
Microsoft is extending Entra Agent ID to cover additional agent types, including previously unknown agents discovered through security sensors. This would allow administrators to establish identities for those agents and apply relevant governance and access policies.
The identity distinction is important because security teams need to determine whether an action was performed directly by an employee or by an AI agent acting on that person’s behalf.
Project Perception expands to agent security
The new controls form part of Microsoft’s wider Project Perception initiative, introduced in July 2026 to help security teams investigate and respond to cyber threats using AI agents.
Microsoft is expanding the initiative with Playbooks and Guardian Agents designed to help security teams investigate changing risks, coordinate protective actions and adapt policies. People will continue to define security objectives, approval requirements and the limits of delegated authority.
The company also plans to incorporate additional model-level signals into risk assessments to help identify when an agent’s intended actions diverge from its assigned task. However, Microsoft emphasises that security decisions must remain enforced by independent controls rather than relying on the AI model to regulate itself.
Microsoft has not announced a general availability date for the newly introduced capabilities.
As businesses increasingly rely on autonomous systems, the initiative reflects a broader shift in enterprise security: controlling not only who can access company resources, but also what AI agents are permitted to do, how their behaviour is monitored and how quickly their privileges can change when risks emerge.
Source: Microsoft