The AI Economy's Ken Yeung interviewed Yina Arenas, Microsoft's chief product officer for identity and network access. She said she left the summit seeing an industry split into two camps. One camp locks agents down and gives up innovation. The other lets agents run and hopes nothing breaks. Both camps want agents that help the business without leaving them blind, and both are accountable for what their agents do. Arenas said the tools to get speed and control together are still missing.
She also said no single product fixes this. She called it an "end-by-end problem" and said a fail-proof fix belongs to the world of "magic wand, rainbows, and ponies." That is unusually frank for a vendor executive, and it's a good place to start.
The premise: assume the agent will go wrong
Microsoft's security model starts from distrust. Nadim Abdo, corporate vice president for identity and network access, set it out in a Microsoft Security Blog post titled "Agents are your newest insiders." His argument is that agents are not malicious, but they are capable tools. They can make mistakes, be manipulated or be compromised, and their behavior can change as their context changes during a task.
Abdo calls the approach "continuous containment." You assume an agent can fail. You watch it all the time, give it as little authority as possible before it acts, and adjust that authority as risk changes. Responses can range from narrowing access to requiring human approval, isolating the agent or stopping it. The blog says this protection has to cover identity, permissions, data, endpoints, network, cloud and runtime, not identity alone.
The post also quotes Satya Nadella on keeping security controls outside the model itself:
A note on dates: The AI Economy says the capabilities debuted on October 20. Microsoft's blog URL and most trade coverage put the announcement on October 19, 2026. eWeek reported that on Oct. 19, Microsoft expanded Project Perception with three capabilities: Dynamic Permissions, Dynamic Agent Risk and Dynamic Conditional Access. This article treats October 19 as the date of Microsoft's primary announcement.
Section summary: Microsoft's agent security model treats agents as insiders that may fail or be compromised, rather than as trusted software.
The six capabilities
The AI Economy groups the announcement into six capabilities. Microsoft's own blog gives more detail on each.
| Capability | What Microsoft says it does | The familiar IT equivalent |
|---|---|---|
| Broader agent discovery | Detects 60 types of local agents, 35 more than before | Finding unauthorized accounts and shadow IT |
| Agent identities | Extends Entra Agent ID to local and previously unknown agents | An employee badge |
| Dynamic Permissions | Starts agents with no access and grants task-scoped, time-limited access | Just-in-time privileged access |
| Dynamic Agent Risk | Updates an agent's risk assessment continuously | User risk in Identity Protection |
| Dynamic Conditional Access | Responds to rising risk step by step, up to stopping the agent | Conditional Access for people |
| Guardian Agents | Supervisory agents in Project Perception that investigate and contain within limits people set | A SOC analyst working from a runbook |
Discovery and identity
Microsoft can now also find 35 more types of agents that run on staff devices, for a total of 60. These include Anthropic's Claude Code, OpenAI's Codex, and GitHub Copilot. According to Microsoft's blog, discovered agents can go into one registry that shows ownership, activity and risk, however they were found.
This matters for developer workstations. Coding agents installed locally by engineers are the classic agent that never went through central deployment. Discovery doesn't mean every agent will be found, though. It only covers what Microsoft's sensors and connectors can see.
Identity is the anchor. Entra Agent ID, which gives each agent its own identity separate from its user, will cover these and other unknown agents as well. Arenas told The AI Economy this step is "super important" because it separates the person using a tool from the process running it. Once an agent has its own identity, it becomes something policy can target.
The dynamic trio
Abdo's blog says Dynamic Permissions start agents with no authority. Organization-wide policy sets the outer limit, including stopping an agent from getting authority its user doesn't have. Inside that limit, permissions are scoped to the task, expire, and shrink or disappear as the task changes or ends. Higher-impact actions can require verified human approval.
The key point is that an agent should not inherit everything its human sponsor can access.
Dynamic Agent Risk pulls signals from identity, data, endpoints, cloud, network, runtime and the agent's own activity. It is meant to be an ongoing assessment, not a score handed out once at onboarding. Microsoft also says it is feeding model-level signals such as chain-of-thought into this assessment. The goal is to spot "intent drift," where an agent's planned actions move away from the task it was given.
Dynamic Conditional Access acts on those risk changes. When risk rises, the response comes in steps. An agent can lose the right to change files but keep read access, lose access to some data, need a human to approve a step, or be stopped.
Microsoft's example is an expense-approval agent that hits a prompt injection and tries an unrelated action. The policy keeps its read access, removes its ability to approve, and requires human sign-off for high-impact steps. If risk keeps rising, it isolates the agent. The employee keeps working. Not every risk change has to trigger a kill switch.
Guardian Agents
Humans establish the rules and approval limits, Playbooks specify what the security response should achieve, and Guardian Agents execute it, looking into why an agent's risk shifted and suggesting or enforcing containment. Microsoft says people keep control of objectives and consequential decisions. The Guardian Agents handle the round-the-clock work that manual operations can't keep up with.
Section summary: Discovery and identity tell you which agents exist and who owns them. The three dynamic controls decide what each agent can do from moment to moment. Guardian Agents run that oversight at machine scale.
"This is not new," and that's the point
Most of this will look familiar to anyone who has run identity at a large organization. Finding unregistered agents is like hunting for rogue accounts. An Agent ID works like a badge. Dynamic Conditional Access is Conditional Access with a new kind of subject. Abdo says so directly, writing that Microsoft has "spent decades applying Zero Trust and least privilege to people."
The AI Economy asked Arenas whether Microsoft has a kill switch like the one Okta offers for ServiceNow. She pointed instead to Entra's existing lifecycle tools, which cover provisioning, suspension and decommissioning, now extended to agents that must have a human sponsor. "This is not new," she said. "We're just bringing in those capabilities to the agent world."
The badge comparison does have limits. Microsoft Learn describes an agent identity as a special service principal created from an agent identity blueprint, not as a user account. Agent identities have no credentials of their own. The blueprint holds the federated credentials, certificates or secrets and gets tokens on the agent's behalf. Autonomous agents use app tokens issued to the agent identity. Interactive agents get user tokens where the user is the subject and the agent identity is the actor.
That user-token case matters. An agent with its own identity can still be working inside a user's context, so admins should not assume every agent action runs only on the agent's own privileges.
Blueprints are what make this manageable at scale. Microsoft's documentation uses a "Sales Assistant Agent" deployed across several regional teams as its example. Because every instance comes from the same blueprint, an admin can apply one Conditional Access policy to all of them, disable all of them, or revoke a permission grant from all of them at once. Agent identities are also single-tenant, although a blueprint can be published to more than one tenant.
What admins can configure today: agent lifecycle policies
Scale is the main reason Microsoft gives for automation. Arenas told The AI Economy that many customers have hundreds of thousands of agents and some have millions. Those are her interview claims, not an independent industry figure. Either way, checking agents one at a time doesn't work.
The lifecycle side has documented steps. Microsoft Learn lists Entra Agent ID lifecycle policies as a preview feature. Preview features come without a service-level agreement and Microsoft doesn't recommend them for production workloads.
Prerequisites, per Microsoft Learn:
- License: Microsoft 365 E7, which includes Agent 365 and Microsoft Entra Suite, or a Microsoft Agent 365 license paired with at least Microsoft Entra P1 or Microsoft 365 E3.
- Role: Lifecycle Workflows Administrator or AI Administrator.
Steps to create a policy:
- Sign in to the Microsoft Entra admin center with one of the roles above.
- Go to ID Governance > Lifecycle Workflows > Lifecycle Policies > Agent ID (Preview).
- Select New policy, then enter a name and description.
- Enable the policy and choose which agent identities it covers.
- Configure one or more rules:
- Periodic reconfirmation: a sponsor or owner must confirm the agent is still needed, every 30 to 730 days.
- Minimum sponsor requirement: the agent must have at least a set number of sponsors.
- Inactivity monitoring: the policy triggers if no tokens are issued to the agent for a set period.
- Choose an action: Disable, Delete (a soft delete), or Disable and delete after a grace period you set.
- Review notifications. You can add fallback recipients for agents with no sponsor or owner.
- Save. If you have more than one policy, set their priority. The highest-priority matching policy applies.
What success looks like: Microsoft evaluates the agents in scope periodically. When an agent breaks a rule, its sponsors, owners or fallback recipients get a notification. They can extend, reconfirm, update sponsors or disable the agent in the Manage Agents experience. If nobody fixes the violation in time, Lifecycle Workflows carries out the action you chose.
Common pitfalls:
- Scope too broad, too soon. Microsoft recommends starting with Specific agents as the scope, using a small set of test agents and the minimum 30-day reconfirmation period. Check that notifications arrive before you widen the scope.
- Orphaned agents. Without fallback recipients, an agent with no sponsor has nobody to receive the warning before it is disabled.
- Overlapping policies. Check priority order whenever scopes overlap. Otherwise the policy that applies may not be the one you expect.
The skeptic's corner
These are vendor claims about a strategy and a product direction, not independent proof that the controls work. Microsoft has not published independent performance results for Guardian Agents, including false-positive rates, containment speed or the number of third-party environments where enforcement works end to end.
Availability is also limited. Microsoft's product page labels Project Perception as preview. One outlet, Articles About AI, says Microsoft's documentation describes it as being in Limited Public Preview for a small, invitation-only group of customers. Coverage of the bigger feature set also ties it to Project Perception and Microsoft 365 E7, which includes Agent 365 and Microsoft Entra Suite. That suggests the full set of controls will sit in premium licensing tiers.
Some questions to raise with your Microsoft account team:
- What about agents outside Microsoft's sensors? Sixty supported local agent types is broad coverage, but it isn't everything.
- Who watches the Guardian Agents? Supervisory agents are agents too, so ask how they hold up against adversarial manipulation.
- What does lock-in look like? Microsoft says Agent ID supports agents built on other platforms through its SDK and workload identity federation. Each new control plane still deepens your dependence on Entra.
The bottom line
Microsoft isn't offering a magic wand, and Arenas said as much. The approach is to give every agent an identity and an accountable human, start it with no permissions, keep reassessing its risk, and contain it step by step instead of choosing between running and killing it.
For Windows and Entra admins, the practical starting points are already here. Take inventory of the coding agents on developer machines. Make sure every agent identity has a sponsor. Pilot lifecycle policies on a small test scope. The rest of the playbook, including Dynamic Permissions, Dynamic Conditional Access and Guardian Agents, is still in preview and tied to Project Perception and premium licensing. Hold off on rolling it out widely until you can see it working in your own tenant.
The approach doesn't make the old choice between locking agents down and letting them run disappear. It does give admins more options in between.