Microsoft just moved the goalposts on what it means to secure an AI agent. On October 19, the company announced an expansion of Project Perception that treats internal AI agents not as external visitors to be authenticated at the door, but as insiders who need continuous supervision and adaptive containment. It is the first major enterprise vendor to build this layer.
The original Project Perception, previewed in August, was designed to defend against external threats using red, blue, and green agent teams. The October update turns that architecture inward. The new framing: agents are capable tools that can be granted access to important systems, and that access creates insider risk — not because agents are malicious, but because they can make mistakes, be manipulated, or drift from their assigned task as context changes.
The product details are specific. Guardian Agents provide continuous, machine-speed supervision of every agent action, investigating risk changes and recommending or applying containment. Dynamic Agent Risk calculates a continuously updated risk score by combining signals from identity, data, endpoints, cloud, network, runtime, and the agent’s own activity — including chain-of-thought analysis for intent drift. Dynamic Conditional Access extends Microsoft Entra so that a risk change triggers graduated responses: the system might preserve read access while blocking writes, narrow the data an agent can reach, require provable human approval for a consequential step, or isolate the runtime entirely. And Dynamic Permissions ensures agents start with zero authority and receive only task-scoped, time-bound access.
Satya Nadella framed the principle plainly: “The most trustworthy agentic system will not be the one with the model we trust most. It will be the one designed that enables us to trust the model least.”
Microsoft has expanded agent discovery to 60 supported local types — up from 25 — including Claude Code, OpenAI Codex, and GitHub Copilot. Entra Agent ID, which reached general availability in April 2026, has been extended with identity types for local and previously unknown agents discovered through security sensors. The whole stack is bundled into Microsoft 365 E7 at $99 per user per month, which packages E5, Copilot, Entra Suite, and Agent 365.
This follows a 27-day sprint in which three major vendors shipped agent security products. Okta launched Agent SSO on September 22. ServiceNow introduced AI Passport on October 15. Microsoft followed on October 19. The identity perimeter that began forming in late September now has a containment layer sitting on top of it.
But the measurement gap has not closed. The Okta AI Agents at Work 2026 survey found 96% of executives confident in their identity and access management for non-human identities, yet only 34% actually apply the same controls they use for human employees. The Saviynt CISO AI Risk Report 2026 found 92% of CISOs lack full visibility into AI agent identities. And the NIST AI Risk Management Framework MEASURE function — the part that would tell you whether an agent’s actions align with its intended purpose — scored 0.6 out of 5.0, rated critical.
Terrell Cox, Microsoft’s Corporate Vice President and Deputy CISO, offered the candid version: “As Customer Zero, we have learned that securing agents requires continuous visibility into agent activity, proactive protection of access and data, and adaptive protection that keeps pace with evolving threats.”
The question is not whether containment matters — it does, and Microsoft is first to build it at enterprise scale. The question is what containment cannot tell you. Dynamic Agent Risk can stop an agent from doing damage. It can narrow permissions in real time, require human approval, or kill the runtime. What it cannot yet tell you is whether the agent is actually doing its job correctly — whether the expense it approved was the right call, whether the code it wrote matches the spec, whether the research it produced is accurate. That is the measurement layer, and it still does not exist.
The $99 per user per month price tag also raises a practical question about who gets access to this kind of containment. If agent security becomes a premium bundle feature, smaller enterprises and budget-constrained teams will be making do with less — at exactly the moment when agents are proliferating fastest.