Microsoft Enhances Agent Security with Project Perception and Guardian Agents
Microsoft is significantly advancing its security framework for artificial intelligence agents with the expansion of Project Perception and the introduction of Guardian Agents. This initiative addresses the growing need to secure AI agents, which are increasingly integrated into business operations, by treating them as potential 'agentic insiders' that require robust, continuous protection.
Securing the Agentic Insider
The core of this evolution lies in securing agents that operate with access to sensitive company data and systems. Microsoft's approach is built on the principle of "surrounding non-deterministic intelligence with deterministic controls, independent evidence, and containment boundaries." This means assuming agents can err, be manipulated, or compromised, and implementing controls that operate independently of the AI model itself. The system is designed with four continuous responsibilities: Know which agents exist and what they are doing, Contain their access and actions, Protect the resources they interact with, and Adapt protection as risk levels change. This framework aims to provide security teams with a consistent view of agents and their associated risks, enabling continuous adaptation of protections.
Enhanced Discovery and Identity Management
A critical component of securing agents is visibility. Microsoft is expanding its discovery capabilities to identify an additional 35 types of local agents, bringing the total to 60 supported agents, including popular tools like Claude Code, OpenAI Codex, and GitHub Copilot. These agents can be brought into a unified registry, regardless of their origin, to track ownership, activity, and risk. To further enhance control, Microsoft Entra Agent ID is being extended with new identity types for various agent patterns, including local and previously undiscovered agents. This provides a distinct, first-class identity for each agent, separate from its user, enabling granular policy targeting and attribution for actions taken by the agent.
Granular Containment and Dynamic Adaptation
Microsoft is introducing several features to ensure agents operate within defined boundaries. Dynamic Permissions will allow organizations to set task-specific, time-bound, and dynamically adjustable permissions for agents, adhering to the principle of least privilege. Agents will start with no authority and gain only what is necessary for their approved tasks. Furthermore, Dynamic Agent Risk will continuously assess an agent's risk based on signals from identity, data, endpoints, and its own activity. This dynamic risk assessment feeds into Dynamic Conditional Access, which extends Microsoft Entra Conditional Access for agents. This allows for graduated responses to changing risk levels, such as reducing permissions, preserving read access while blocking writes, or requiring human approval for critical actions. At the highest risk levels, an agent's runtime can be isolated or execution halted entirely.
Agentic Security at Scale
To manage the complexity of securing potentially hundreds of thousands of agents, Microsoft is introducing Guardian Agents and new Playbooks within Project Perception. These Guardian Agents will operate at machine speed to coordinate protective actions, investigate risks, and adapt policies based on evolving threats and agent behavior. This agentic approach to security, guided by human-defined policies and objectives, is designed to scale effectively. The initiative also extends containment to the model itself, leveraging signals like chain-of-thought to detect intent drift and untrusted information influencing an agent's reasoning, while ensuring security decisions remain independent of the model.
Satya Nadella, Chairman and CEO of Microsoft, emphasized the need for a trust architecture where "the controls that determine what it can access, what actions it can take, and whether it should continue operating must sit outside the model." This philosophy underpins the entire effort, aiming to build confidence for organizations to adopt AI agents at scale without compromising safety.
