Microsoft is extending Project Perception to discover, contain, and supervise the AI agents already running inside the enterprise, with agent identities, task-scoped permissions, and Guardian Agents. The principle is sound, and the harder test is authorization across agents that work for a person, come with an application, or are built in-house.
What Is Covered in This Article:
- The announcement: Microsoft extends Project Perception from outside attackers to “agentic insiders,” adding agent discovery, agent identity, task-scoped permissions, dynamic risk, and Guardian Agents.
- What it gets right: Separate agent identities, zero standing authority, and graduated responses rather than a kill switch.
- Three families, uneven reach: Coverage is strongest for agents on the endpoint and agents built in-house, and harder for agents that come with someone else’s application.
- Authorization is still the gap: Mapping intent to permissions relocates the hardest question rather than answering it, and Guardian Agents need supervising too.
- The competitive picture: Microsoft’s enterprise presence is an edge against platform, identity, network, and startup rivals, though not an automatic one.
The News: On October 19, Microsoft announced new capabilities in Microsoft 365 E7 (including Agent 365 and Entra Suite) and Project Perception aimed at what it calls “agentic insiders,” the AI agents already operating inside the enterprise. The update extends Perception, introduced in July to defend against AI-driven attacks from outside, to discover, contain, and supervise those internal agents.
Discovery expands to 35 additional local agent types, 60 in total, including Claude Code, OpenAI Codex, and GitHub Copilot, and Microsoft Entra Agent ID adds identity types for local and previously unknown agents. Microsoft Execution Container (MXC) sandboxes agent runtimes, while new Dynamic Permissions start agents with no authority and grant task-scoped, time-bound access capped at what their user holds.
Dynamic Agent Risk scores each agent continuously across identity, data, endpoint, network, cloud, and runtime signals, and Dynamic Conditional Access acts on that score, from blocking writes to stopping execution. New Playbooks and a team of Guardian Agents in Perception recommend and carry out protective actions, and Microsoft says it is adding chain-of-thought signals to the risk model.
Microsoft Points Project Perception at the Agents Already Inside
Analyst Take: Most of the AI security conversation in 2026 has looked outward, at attackers using frontier models to find flaws and run campaigns faster than defenders can respond. Microsoft’s move here is to point the same lens inward, at the agents organizations deployed themselves and, in many cases, implicitly trusted. We feel that is the right direction, and the timing is defensible: agent counts appear to be growing faster than most teams’ ability to inventory them, let alone govern them.
The principle underneath the announcement is the part we would call out first. Microsoft argues for deterministic controls around non-deterministic intelligence, with the model never acting as its own security boundary. That matches where our own agent containment research has landed, and it is a healthier starting point than the “trust the model, add guardrails later” posture still common in parts of the market.
Identity First, Then Authority
Several design choices deserve credit. Giving each agent an identity distinct from the person it works for, so the enterprise can tell what a person did from what an agent did on their behalf, is foundational for attribution and accountability. Starting agents with no standing authority and granting task-scoped, time-bound permissions is least privilege applied where it matters most.
We also like the graduated response. Preserving reads while blocking writes, narrowing reach, or requiring human approval for a consequential step is more usable than treating every risk change as a kill-switch event, which tends to push teams toward turning protections off.
Many Kinds of Agent, Uneven Reach
We also appreciate that Microsoft recognizes how many kinds of agent are already in the enterprise: local coding assistants, Copilot and other embedded agents, unmanaged agents found by sensors, and agents built on its own platforms. In our research, we sort agents into three families by who decides what the agent is for: the person, the application vendor, or the organization. That lens helps show where this announcement is strongest, and where it will have a harder time.
Agents that work for a person, such as Claude Code or Codex on a developer’s laptop, are where Microsoft’s endpoint presence shows. Discovery across 60 local agent types and a sandbox for agent runtimes are real progress. Two caveats, though. Microsoft’s own documentation notes that discovery is activity based, so an installed agent appears only once it acts, and runtime inspection depends largely on each agent vendor exposing hooks. For this family, the binding risk is often poisoned input (a malicious repository, a crafted web page) more than identity.
Agents built in-house are the most natural fit. The organization defines the task, so it can also define the scope, and Entra Agent ID plus Dynamic Permissions give it a place to encode both.
Agents that come with an application, the assistants inside CRM, ITSM, and similar platforms from Salesforce, ServiceNow, and many others, are the hardest family, because the controls largely belong to the application vendor. Microsoft describes least privilege here as mapping an agent’s intent, with help from an LLM, to an ontology of operations that the resource provider itself publishes. That is a sensible design, and it also means the approach is only as good as each provider’s willingness to expose such an ontology. Microsoft, of course, is also a major vendor in this family through Copilot.
One more wrinkle cuts across all three: approved is not governed. Agents a vendor switched on through a product update, or that a company enabled without touching the defaults, sit on the approved list and attract less scrutiny than shadow agents, even when nobody configured their controls.
Authorization Remains the Hard Problem
This is where we would temper the enthusiasm. Authentication for agents is converging, while authorization is still the gap. Mapping intent to permissions with an LLM, inside a harness that bounds what it can grant, is a reasonable approach, but it relocates the hardest question rather than answering it.
People think in tasks and outcomes, which usually span several systems and many individual operations. It is not common for a security-minded organization to onboard an intern (of the human kind) by handing over “read access to sales,” and agents are unlikely to stay neatly inside a single resource’s vocabulary either.
The same applies to Guardian Agents. Using agents to supervise agents is likely the only way to operate at machine speed and scale, and Microsoft is right to keep people in charge of policy and consequential decisions. Still, the supervisors carry their own error rates and their own exposure to the content they review, which brings back the old question of quis custodiet ipsos custodes: who guards the guardians?
Everyone Wants This Control Point
Microsoft is far from alone here. Endpoint and platform vendors such as CrowdStrike, Palo Alto Networks, and SentinelOne, identity security vendors such as Okta, Ping Identity, SailPoint, and Cisco, and network security vendors such as Zscaler are all pursuing agent discovery, agent identity, and runtime control. A raft of startups, including Keycard, Oasis (which Cyera intends to acquire), Aembit, Noma, and Zenity, among many, many others, are pushing on intent-based and just-in-time agent access.
Microsoft’s advantage is presence. In ETR’s October 2026 Technology Spending Intentions Survey, Microsoft appears in roughly 80% of information security respondents’ environments (n=1,047), with a Net Score of 49, about three times the sector’s. It is already in identity, the endpoint, and the management plane, and folding agent containment into tools customers already run is likely to put pressure on single-function tooling that lives entirely inside the Microsoft estate.
We would not read that as automatic. The family where incumbency helps least, agents that come with someone else’s application, is also the hardest one, and coverage of non-Microsoft estates and of agents without hooks is where outcomes will be decided.
Precision Matters More When You Set the Terms
Given its reach, Microsoft has a large say in how the market defines this category, which makes terminology and scope matter more. “Agentic insider” is a useful, memorable framing. Practitioners will still need to know which families and which provisioning states a given control covers, and where it stops, because a coding agent on a laptop, a vendor-enabled CRM assistant, and an in-house workflow agent are different security problems with different owners.
What to Watch:
- How far does discovery reach beyond Windows and hook-friendly agents? Discovery is broadest on Windows, with macOS in preview, and runtime inspection leans on vendor hooks. Watch native Linux coverage and agents that do not integrate with Microsoft.
- Will application vendors publish the ontologies this model needs? Task-scoped permissions work only if Salesforce, ServiceNow, and others expose their operations in a form a policy engine can reason over. Watch whether they do, and on whose terms.
- Will controls reach agents that arrive already switched on? Vendor-enabled agents and default configurations sit on the approved list. Watch whether discovery records how an agent was provisioned, not only that it exists.
- How do Guardian Agents perform at scale? Supervising agents carry their own error rates and read the same content that can poison the agents they watch. Watch for disclosed accuracy, false-positive costs, and independent testing.
- What does it cost, and when does it ship? Watch how capabilities split between E7 licensing and consumption pricing, and how quickly each piece moves from announcement to general availability.
For more information, read the full announcement from Microsoft. Read the companion post on securing the agentic insider.
Declaration of generative AI and AI-assisted technologies in the writing process: This content has been generated with the support of artificial intelligence technologies. Due to the fast pace of content creation and the continuous evolution of data and information, The Futurum Group and its analysts strive to ensure the accuracy and factual integrity of the information presented. However, the opinions and interpretations expressed in this content reflect those of the individual author/analyst. The Futurum Group makes no guarantees regarding the completeness, accuracy, or reliability of any information contained herein. Readers are encouraged to verify facts independently and consult relevant sources for further clarification.
Disclosure: Futurum is a research and advisory firm that engages or has engaged in research, analysis, and advisory services with many technology companies, including those mentioned in this article. The author does not hold any equity positions with any company mentioned in this article.
Analysis and opinions expressed herein are specific to the analyst individually and data and other information that might have been provided for validation, not those of Futurum as a whole.
Read the full Futurum Group Disclosure.
Other Insights From Futurum:
Microsoft Turns Dynamics 365 Into an Ambient CRM Layer
Microsoft Splits the Copilot Pricing Model Into Everyday and Advanced AI
Microsoft Copilot Becomes an Agentic Work Platform
Author Information
Fernando Montenegro serves as the Vice President & Practice Lead for Cybersecurity & Resilience at The Futurum Group. In this role, he leads the development and execution of the Cybersecurity research agenda, working closely with the team to drive the practice's growth. His research focuses on addressing critical topics in modern cybersecurity. These include the multifaceted role of AI in cybersecurity, strategies for managing an ever-expanding attack surface, and the evolution of cybersecurity architectures toward more platform-oriented solutions.
Before joining The Futurum Group, Fernando held senior industry analyst roles at Omdia, S&P Global, and 451 Research. His career also includes diverse roles in customer support, security, IT operations, professional services, and sales engineering. He has worked with pioneering Internet Service Providers, established security vendors, and startups across North and South America.
Fernando holds a Bachelor’s degree in Computer Science from Universidade Federal do Rio Grande do Sul in Brazil and various industry certifications. Although he is originally from Brazil, he has been based in Toronto, Canada, for many years.
