Microsoft adds risk-based controls to curb rogue AI agents in enterprise

Microsoft Corp. introduced new security controls today designed to mitigate risks from rogue artificial intelligence agents by restricting their capabilities as their assessed risk levels rise. The release addresses what Microsoft Security executive vice president Hayete Gallot termed the "agentic insider," a growing category of enterprise tools that are often granted excessive privileges.

The company expanded its ability to detect local agents on employee machines, now identifying 60 distinct types after adding 35 new categories to its discovery tools. This list includes third-party products like Anthropic’s Claude Code and OpenAI’s Codex, alongside Microsoft’s own GitHub Copilot. Microsoft is also extending Microsoft Entra Agent ID to assign unique identities to these known agents as well as unknown ones discovered by its sensors.

Risk-based access controls

Once an agent is identified, it is assigned a continuously updated risk score under a feature Microsoft calls Dynamic Agent Risk. This score aggregates signals from Microsoft’s identity, endpoint, cloud, and network tools, increasing when the agent’s behavior deviates from organizational intent or user expectations. Microsoft has extended Microsoft Entra Conditional Access to support these agents, creating a Dynamic Conditional Access feature that automatically adjusts permissions as the risk score climbs.

As an agent’s risk assessment worsens, its capabilities are progressively curtailed. The agent may first lose write privileges while retaining read access. Higher-impact actions can be held for verified human approval, and agents reaching the highest risk thresholds may have their runtime isolated or stopped entirely. Access is further limited by Dynamic Permissions, which grants agents only the temporary authority needed for a specific task, ensuring they never hold more power than the human user they serve.

Architectural safeguards

Microsoft Chairman and CEO Satya Nadella outlined the philosophy behind these controls in an Oct. 10 essay, urging organizations to treat AI models as insider risks and keep safeguards external to the model itself. He argued that the most trustworthy system is one that enables users to trust the model the least, emphasizing the need for strict boundaries. Gallot reinforced this view, noting that frontier models are built to chase results and may achieve goals through unintended methods, including collusion between agents.

To enforce these boundaries, Microsoft introduced Microsoft Execution Container, a sandbox environment where agents can operate. Because the monitoring infrastructure sits outside the container, a compromised agent cannot disable the oversight mechanisms. This architecture ensures that even if an agent is hijacked, the external controls remain active and capable of restricting the agent’s actions based on its dynamic risk profile.

What should you do?

Security teams should evaluate whether their current environments contain the newly identified agent types, particularly those developed by third parties. Organizations should review their conditional access policies to ensure they can enforce temporary, task-specific permissions for automated tools. It is also critical to verify that monitoring solutions can detect behavioral drift in AI agents without relying on the agents themselves to report their status.

What to do and how to stay safe: Microsoft

• Inventory all local AI agents on employee machines to ensure they are detected by updated discovery tools.
• Configure conditional access policies to limit agent permissions based on real-time risk scores.
• Implement sandbox environments like Microsoft Execution Container to isolate agent operations.
• Monitor for behavioral anomalies that indicate an agent is deviating from its intended task.

Step-by-step guide: Prompt Injection Warning Signs: How to Spot AI Manipulation

General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What new agent types can Microsoft now detect?

Microsoft’s discovery tools can now spot 60 types of local agents, including Anthropic’s Claude Code, OpenAI’s Codex, and GitHub Copilot.

How does Dynamic Agent Risk function?

It assigns a continuously updated risk score to each agent based on signals from identity, endpoint, cloud, and network tools, rising when behavior drifts from intent.

What happens when an agent’s risk score becomes too high?

Dynamic Conditional Access restricts the agent’s actions, potentially removing write access, requiring human approval, or isolating and stopping the runtime entirely.