Microsoft Is Treating AI Agents Like Insider Threats. Here Is the Plan.
A new security framework and admin console aim to give IT teams the same control over AI agents that they already have over human employees, before something goes wrong.
Key points
- Microsoft has expanded Project Perception, its AI security framework, to cover what it calls the "agentic insider," treating AI agents as a new class of internal threat alongside human employees.
- A companion product called Agent 365 gives IT teams a single inventory of every AI agent in an organisation, who owns it, what systems it can reach, and what it has done.
- Agent 365 can now discover 60 types of locally installed agents, adding 35 newly supported types, including Claude Code from Anthropic and GitHub Copilot.
- Every agent gets its own identity entry in Microsoft Entra, Microsoft's user-identity service, so its access rights can be set and revoked separately from the human who deployed it.
- CEO Satya Nadella has framed the guiding principle as "separate the supply of intelligence from the authority over it," meaning the AI model itself should never decide what it is allowed to do.
An AI agent is software that acts on your behalf without waiting for you to click: it reads your email, files expense reports, pushes code to a repository. To do any of that it needs access to company systems. That access is the problem.
As first reported by ThreatVectr, Microsoft this week extended Project Perception, the security framework it introduced in July 2026, specifically to cover agents as an insider-risk category. We first covered Project Perception on 31 July 2026, and our October benchmark story found that most AI agents fail real business tasks far more often than a single test suggests. The announcement pairs that framework with a new admin product called Agent 365.
The comparison to a human insider is deliberate. A rogue employee who already has system access is harder to stop than someone trying to break in from outside. An agent is the same problem, only it can act at machine speed and it never goes home.
What are they actually shipping?
Two products that work together. Project Perception is the sensing and response layer, the part that watches for unusual behaviour. Agent 365 is the control console: a single list of every agent in the organisation, what it can touch, and a record of what it has done.
Any agent published through Microsoft 365 channels and registered with an Entra Agent ID shows up in that inventory automatically. Agents built outside Microsoft's own pipeline require a manual onboarding step, a real gap given how many developer tools exist outside that ecosystem.
Responsibility is divided across four existing admin roles. Defender admins handle threat protection. Entra admins manage agent identity and access permissions. Purview admins govern what data agents can read and create. Microsoft 365 admins hold the master view and run the onboarding workflow. Avoiding a fifth admin team is practical; it also piles new duties onto teams already stretched thin.
| Capability | Detail |
|---|---|
| Framework | Project Perception, extended to agent insider risk |
| Control console | Microsoft Agent 365 |
| Identity layer | Microsoft Entra Agent ID |
| Local agents discovered | 60 total, 35 newly added |
| Named integrations | Claude Code, GitHub Copilot |
| Admin roles involved | Defender, Entra, Purview, Microsoft 365 |
Why does a "local agent" matter?
Local agents are the ones a developer installs directly on their own laptop, not through any central IT system. A developer running Claude Code against a private code repository might be the only person who knows that agent exists. Security teams have had no visibility into these at all.
Expanding discovery to 60 local agent types is the most concrete new capability here. It's also where Microsoft's coverage has the most ground to cover, because the number of developer tools in this category keeps growing.
Should IT teams be worried about the workload?
Honestly, yes. Microsoft's documentation leans hard on the word "continuous" when describing monitoring, and that word carries a real cost. Teams already buried in Defender security alerts are the same teams about to inherit agent oversight.
Brad Smith was calling for liability rules around autonomous agents just days before this announcement, as our coverage noted. Budget and staffing conversations need to happen before the agents are deployed, not after.
Surrounding non-deterministic software (AI that can behave differently each time, depending on what it reads or is told) with deterministic controls (fixed, enforceable rules) is the right principle. What'll determine whether this matters is whether enforcement actually triggers when an agent steps outside its brief, and whether non-Microsoft agents get scrutinised as carefully as Microsoft's own.
