Microsoft Dynamic Permissions: Least Privilege for AI Agents

Microsoft wants companies to think about AI agents the way they think about employees with system access: useful, trusted to a point, and governed by controls that sit outside their reach. On October 19, 2026 the company extended Project Perception, its agentic security system, with a set of tools for what it calls the "agentic insider," including task-scoped Dynamic Permissions, a continuously updated risk score for every agent and Conditional Access policies that can dial an agent's authority down in real time.

• Dynamic Permissions: agents start with no permissions or least privilege, get access scoped to a task and time window, and lose it when the task ends
• Dynamic Agent Risk: a live risk score built from identity, data, endpoint, cloud, network and runtime signals plus the agent's own activity
• Dynamic Conditional Access: extends Microsoft Entra Conditional Access to agents, with graduated responses from read-only to full isolation
• Discovery: 35 more local agent types, for 60 total, including Claude Code, OpenAI Codex and GitHub Copilot

Why Treat AI Agents as Insiders?

Microsoft is careful with the framing. Nadim Abdo, Corporate Vice President for Identity and Network Access, writes that calling agents insiders "does not mean agents are inherently malicious." The point is that agents can make mistakes, be manipulated by something like a prompt injection, or be compromised, and they act at machine speed. Microsoft's design principle is to surround non-deterministic models with deterministic controls, independent evidence and containment boundaries that the model itself cannot bypass. As Satya Nadella put it in the post, the most trustworthy system is the one "that enables us to trust the model least."

How Do Dynamic Permissions Work?

The core idea is that an agent should not inherit everything its human sponsor can do. Under Dynamic Permissions, organization-wide policy sets the outer boundary, including preventing an agent from gaining authority its user does not have. Inside that boundary, access is scoped to the approved task, made time-bound, and contracted or removed as the task changes or completes. Higher-impact actions can require verified human approval.

Microsoft's example is an expense-approval agent. It needs to read submissions, check policy and approve routine reimbursements, nothing more. If it later reads a poisoned document and tries an unrelated action, Dynamic Agent Risk rises and Conditional Access responds proportionately:

• Preserve reads, block writes: the agent keeps working on safe tasks but can no longer approve or change records
• Narrow its reach: sensitive data, resources and network paths are cut off
• Require a human: consequential steps need cryptographically provable approval
• Isolate or stop: at the highest risk levels, the runtime is isolated or execution is halted

The employee stays productive throughout, because the agent has its own identity and permissions separate from theirs. This builds on Microsoft Entra Agent ID, which is being extended to cover local and previously unknown agents found by security sensors.

What Are Guardian Agents?

Securing thousands of agents by hand will not scale, so Microsoft is also adding Playbooks and a team of Guardian Agents to Project Perception. People set the policy, approval boundaries and delegation rules; Playbooks define the security outcome; and Guardian Agents do the work at machine speed, investigating why an agent's risk changed and recommending or applying containment. Runtime sandboxes such as Microsoft Execution Container (MXC) keep agents inside a controlled environment where the monitoring cannot be disabled from within.

What This Means for Security Teams

This is a meaningful step for the industry's push to apply zero trust and least privilege to non-human identities, and it echoes the signed-permission approach behind ServiceNow AI Passport. Microsoft did not give availability dates for the new capabilities in its announcement and pointed customers to its Ignite conference on November 17-20 for more, so treat this as a roadmap to plan around rather than a switch to flip today. For background on where this started, see our look at how Microsoft Project Perception puts AI agents on defense, and follow more in our AI security coverage.

Sources: Microsoft Security Blog — Agents are your newest insiders. Security must move at their speed. — October 19, 2026; SecurityWeek — Microsoft Targets Rogue AI Agents With Dynamic Permissions, Risk Scoring — October 20, 2026.