Microsoft adds dynamic permissions and risk controls for AI agents in M365 E7
New tools in Microsoft 365 E7 treat AI agents as insiders, applying dynamic permissions and continuous risk monitoring to limit access.
Key points
- Microsoft introduces Dynamic Permissions, granting AI agents only the specific access needed for individual tasks.
- Dynamic Agent Risk continuously rates agents using signals from identity, data, devices, and network activity.
- Entra Agent ID provides separate identities for agents, covering known tools like Claude Code and unknown agents.
Microsoft announced new security controls for artificial intelligence agents on Monday, introducing features within Microsoft 365 E7 and its Project Perception platform. These tools are designed to limit what each agent can access and automatically tighten those restrictions when risk levels increase.
Hayete Gallot, executive vice president of Microsoft Security, outlined the strategy in a blog post, stating that companies should treat AI agents as insiders. She noted that agents often receive excessive access to data and systems and can behave unpredictably, necessitating strict oversight.
Context and background
Gallot emphasized that every agent should be monitored by Guardian Agents, which review actions before they occur. She also advocated for security tools that reveal a model’s reasoning process, rather than just displaying inputs and outputs. This approach builds on an essay by CEO Satya Nadella earlier this month, which advised treating models as insider risks.
Nadim Abdo, corporate vice president for identity and network access, detailed the technical features in a separate post. The primary addition is Dynamic Permissions, which ensures an agent starts with no access of its own. It receives only the permissions required for a specific task and retains them only for the duration of that task.
Who is affected
Microsoft is also deploying Dynamic Agent Risk, a feature that continuously rates each agent. It utilizes signals from identity, data, devices, cloud services, networks, and the agent’s own actions to determine risk levels. This allows for granular control over agent behavior based on real-time threat assessment.
Dynamic Conditional Access extends Entra controls to agents, implementing stepped responses when risk rises. An agent might lose the ability to modify files while retaining read access, lose access to certain data, require human approval for specific steps, or be stopped entirely. These measures apply to agents running on staff devices.
Microsoft can now identify 35 additional types of agents on staff devices, bringing the total to 60. This list includes Anthropic’s Claude Code, OpenAI’s Codex, and GitHub Copilot. Entra Agent ID assigns each agent a unique identity separate from its user, covering these known tools and other unknown agents as well.
Terrell Cox, Microsoft’s deputy chief information security officer, stated that the company is already operating in an environment with hundreds of thousands of agents. To further secure these interactions, agents can run inside sandboxes like the Microsoft Execution Container. This keeps security controls out of the agent’s reach, even if the agent itself is compromised.
What should you do?
Organizations using Microsoft 365 E7 should review their current agent permissions and enable Dynamic Permissions to enforce least-privilege access. Security teams should monitor Dynamic Agent Risk scores to identify anomalous behavior early.
What to do and how to stay safe: Microsoft
- Enable Entra Agent ID to assign unique identities to AI agents, separating them from user accounts for better tracking and control.
- Configure Dynamic Conditional Access policies to automatically restrict agent capabilities, such as file modification, when risk scores increase.
- Utilize Project Perception’s Guardian Agents and Playbooks to investigate changes in agent risk and apply necessary limits.
- Ensure AI agents operate within secure sandboxes like Microsoft Execution Container to protect underlying security controls from compromise.
Step-by-step guide: Mobile Device Security: How to Protect Data Beyond Passwords
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is Dynamic Permissions in Microsoft 365 E7?
Dynamic Permissions ensures AI agents start with no access and receive only the specific permissions needed for a single task, for the duration of that task only.
Which AI agents are covered by these new controls?
The controls cover 60 types of agents, including Anthropic’s Claude Code, OpenAI’s Codex, and GitHub Copilot, as well as unknown agents via Entra Agent ID.
How does Dynamic Agent Risk work?
It continuously rates each agent’s risk using signals from identity, data, devices, cloud, network, and the agent’s own actions to trigger stepped security responses.
