Microsoft wants to treat AI agents as insider threats, and watch them accordingly

Key points

• Microsoft is extending its Project Perception security framework to cover AI agents as a new class of insider risk, with a companion product called Agent 365 acting as the control plane for agent discovery, identity management and policy enforcement.
• The company is adding discovery for 35 more types of locally installed agents, bringing supported local agents to 60, including Claude Code and GitHub Copilot.
• Every agent gets a first-class identity through Microsoft Entra Agent ID, separate from the human who sponsors it, so permissions can be scoped and revoked independently.
• The guiding principle, per CEO Satya Nadella, is to "separate the supply of intelligence from the authority over it" so the model is never its own security authority.
• Enforcement is split across Microsoft Defender, Entra, Purview and Microsoft 365 admin roles, meaning existing admin teams absorb agent oversight rather than a new one being spun up.

Microsoft has decided its AI agents are the next insider threat problem, and it is building the plumbing to treat them that way.

The company this week extended Project Perception, the security framework it introduced earlier this year, to cover what it calls the "agentic insider." An agent is a piece of AI software that can take actions on its own: reading your inbox, filing an expense report, pushing code. To do useful work it needs access to company systems. That access is also what makes it dangerous. Three weeks ago we reported on US agencies publishing their own playbook for moments when experimental agents do things they were never told to do; Microsoft's announcement lands in that same conversation.

What is Microsoft actually shipping?

Two things meant to work as one. Project Perception is the sensing and response layer. Agent 365, documented in Microsoft's own product page, is the administrative control plane: a single inventory of every agent in an organisation, who owns it, what it can touch, and what it has been doing.

Any agent published through Microsoft 365 channels and registered with an Entra Agent ID (Entra is Microsoft's identity service, formerly Azure Active Directory) shows up automatically. Agents built outside that pipeline need to be onboarded by hand.

Responsibility is split four ways. Defender admins handle threat protection. Entra admins handle agent identity and access. Purview admins handle data governance. Microsoft 365 admins hold the master view and the onboarding workflow.

Why treat an agent like an insider?

Because it behaves like one and can be manipulated like one. An agent that starts a task behaving correctly can drift as its inputs change. Prompt injection is the specific manipulation to watch: a hostile instruction smuggled inside a document or webpage the agent reads, silently redirecting what it does next. Agents can also inherit far more permission than the task requires if nobody scopes them down at deployment.

Microsoft's example is an expense-approval agent. It needs to read submissions and approve routine reimbursements. The employee who deployed it may carry permissions across dozens of other systems; the agent should not inherit any of those. If it later tries to write somewhere outside its brief, the system is meant to block those writes, narrow its accessible resources, demand human sign-off on consequential steps, or stop it outright.

That is the design goal. Whether it holds against a determined attacker is a separate question.

What's new on discovery?

The expansion to 60 supported local agents is the most concrete deliverable here. Local agents, meaning ones installed on a developer's machine rather than deployed through a central platform, are the blind spot in most environments. A developer runs Claude Code against a private repo and nobody in security knows it is there.

The honest read

Surrounding non-deterministic software with deterministic controls is the right principle. It's also what every serious person working on agent security has been arguing for the better part of a year. What matters now is whether enforcement actually bites when an agent misbehaves, and whether non-Microsoft agents get the same rigour as Microsoft's own.

The Microsoft Security Response Center framing leans hard on the word "continuous." Defenders should read that as a warning: this will generate a great deal of telemetry. The teams already struggling to triage Defender alerts are the same teams about to inherit agent oversight. Budget for that before the agents arrive.