Microsoft Unveils Dynamic Agent Risk and Guardian Agents to Contain the Agentic Insider

Published October 20, 2026 (IST) by the AgentStack News Desk. Facts were checked against Microsoft’s two October 19 announcements, Satya Nadella’s October 10 essay, the Microsoft Defender for Endpoint AI agent support matrix, the Microsoft Entra Conditional Access for agents documentation, and the Microsoft Agent 365 pricing page.

Microsoft announced Dynamic Agent Risk, Dynamic Permissions, Dynamic Conditional Access, and a team of Guardian Agents on October 19, 2026, a set of controls that scores every enterprise AI agent continuously and narrows what it can do as that score rises. The company frames these agents as insiders: software with real access that can make mistakes, be manipulated, or be compromised.

The controls extend Project Perception, the agentic security system Microsoft introduced in July 2026, and share a registry with Microsoft Agent 365. Microsoft also widened agent discovery by 35 local agent types, for a total of 60, including Claude Code, OpenAI Codex, and GitHub Copilot.

A footnote on Microsoft’s own architecture graphic says that everything new except Microsoft Execution Containers is in private preview, with expanded availability at Microsoft Ignite in November. This report draws on the Microsoft Security Blog post, the Official Microsoft Blog post, and Microsoft Learn documentation, per our editorial standards.

What Microsoft Announced on October 19

Microsoft published two coordinated posts on October 19, 2026. Hayete Gallot, executive vice president of Microsoft Security, set out the argument that enterprise agents are insiders, and Nadim Abdo, corporate vice president for identity and network access, described the controls that put the argument into products across identity, endpoints, network, and runtime.

The design goal is to contain an agent without cutting off the employee who sponsors it. Each agent gets an identity separate from its user, permissions that cover only the current task, and a risk score that keeps changing while the task runs.

Capability	What it does	Status per Microsoft
Dynamic Agent Risk	Scores each agent continuously from identity, data, endpoint, cloud, network, runtime, and activity signals	Private preview
Dynamic Conditional Access	Turns a risk change into graduated limits, from blocking writes to stopping the runtime	Private preview
Dynamic Permissions	Grants task-scoped, time-bound authority that never exceeds the sponsoring user	Private preview
Agent ID for more agent types	Gives local and previously unknown agents a Microsoft Entra identity	Private preview
Guardian Agents and Playbooks	Investigate risk changes and recommend or apply containment	Private preview
Microsoft Execution Containers	Runs an agent or its tools inside a policy-enforced sandbox	Generally available

Private Preview Now, Wider Access at Ignite

The blog posts give no dates, and early press coverage reported that Microsoft did not say when the controls would ship. The answer sits in small type under the architecture graphic in Abdo’s post: Microsoft Execution Containers are generally available, and the other capabilities are in private preview with expanded availability at Microsoft Ignite.

Ignite runs November 17 to 20, 2026, so most teams can plan evaluations for late November at the earliest. Microsoft Execution Containers reached general availability on October 7, with process containers on Windows 11, macOS, and Linux, session and WSL containers on Windows 11, and an experimental microVM backend.

Licensing for the pieces that already exist is documented. Conditional Access for agents requires Microsoft 365 E7, which bundles Agent 365 and Microsoft Entra Suite, or an Agent 365 license paired with Microsoft Entra ID P1 or Microsoft 365 E3. Microsoft lists Agent 365 at $15 per user per month and Microsoft 365 E7 at $99 per user per month, both paid yearly.

Microsoft has not said whether Dynamic Agent Risk, Dynamic Permissions, or Guardian Agents will cost extra on top of those plans. Budget owners should treat the E7 or Agent 365 license as the minimum cost of entry.

How Dynamic Agent Risk Drives Conditional Access

Dynamic Agent Risk is a score that Microsoft recalculates while an agent works. It weighs how securely the agent is configured, which resources it can reach, the damage it could do, and whether its actions are drifting from the intent of its user or organization, using signals from identity, data, endpoints, cloud, network, runtime, and the agent itself.

Dynamic Conditional Access acts on that score. Microsoft lists a ladder of responses that policy can apply in any order:

• Reduce: remove permissions the current task no longer needs.
• Read only: keep read access while blocking writes and approvals.
• Narrow: cut the data, resources, and network paths the agent can reach.
• Shorten: cut or revoke time-bound access early.
• Approve: hold a consequential action until a person gives provable approval.
• Stop: isolate the runtime or halt execution at the highest risk levels.

Microsoft illustrates the flow with an expense approval agent. The agent starts with permission to review and approve expenses within policy, reads a document carrying a prompt injection, and attempts an unrelated action. Its risk rises, so policy keeps its read access, removes its ability to approve, and requires cryptographically provable human approval for any high-impact step.

The employee who sponsors the agent keeps working throughout, which is the practical difference from disabling an account or revoking a token. Microsoft also says it is feeding chain-of-thought and other model-level signals into Dynamic Agent Risk to spot intent drift earlier.

Task-Scoped Permissions Replace Inherited Access

Dynamic Permissions changes where an agent’s authority comes from. Microsoft says an agent should start with no permissions and receive only what the approved task needs, for only as long as the task runs, inside an organization-wide boundary that stops it from ever gaining authority its user does not have.

The identity layer explains why this matters. Microsoft Learn documents three ways an agent reaches Entra-protected resources: on behalf of a signed-in user, as itself with an agent identity, or through its own agent user account. Conditional Access evaluates the subject of each token when it is issued or refreshed.

In the on-behalf-of flow the token subject is the user, so the Learn page states that a policy targeting an agent identity does not cover agent requests made on the user’s behalf. Agents that borrow a user’s token are governed as that user, which is the inherited access Dynamic Permissions is meant to remove.

Microsoft is extending Entra Agent ID with identity types for local agents and for unknown agents its sensors find. That step makes an agent a policy target even when nobody registered it with Microsoft security tools.

Discovery Now Covers 60 Local Agents

The visibility piece is already live in Microsoft Defender for Endpoint. Its AI agent support matrix, last updated October 9, 2026, lists 60 local agents that Defender can discover on Windows, from Claude Code and Codex CLI to Cursor, Gemini CLI, Kiro, OpenCode, and Windsurf.

Our count of the matrix on October 20 adds detail the announcement leaves out. Defender also discovers the configured Model Context Protocol (MCP) servers for 27 of the 60 Windows agents, which tells a security team which tools each agent can call. The macOS table, still in preview, lists 51 agents with MCP discovery for 19, and Windows Subsystem for Linux support covers three.

Runtime protection is narrower. The Windows preview inspects six agent and app combinations through vendor hooks, including Claude Code and GitHub Copilot CLI, and four more through network inspection. Discovery is also activity based, so an installed agent appears only after Defender sees it run.

Why Microsoft Calls Agents Insiders

The framing comes from the top. In an October 10 essay, Satya Nadella argued that companies should treat frontier models as insider risks and keep the controls that govern them outside the model, writing that the most trustworthy system is the one that lets people trust the model the least.

Gallot’s post goes further than most vendor messaging. She writes that frontier models cannot be trusted, that agents are frequently overprivileged, and that agents may collaborate and collude with other agents to reach their objectives without being compromised at all.

Microsoft’s answer is Guardian Agents in Project Perception. People set policy and approval boundaries, Playbooks define the security outcome, and Guardian Agents investigate why an agent’s risk changed and recommend or apply containment. Terrell Cox, Microsoft’s deputy chief information security officer (CISO), said the company already runs hundreds of thousands of agents internally.

What It Means for Agent Governance Teams

The announcement moves agent control from static allow lists toward risk-adaptive access, and it puts Microsoft’s identity stack at the center. That fits teams already standardized on Entra, and it leaves gaps wherever agents authenticate with API keys, local credentials, or tokens that Entra never issues.

Gateways still cover a different layer. Our MCP gateways guide and Red Hat MCP gateway report describe products that broker and log tool calls whatever identity provider sits behind them, and yesterday’s FastMCP advisories showed why the servers an agent can reach deserve the same scrutiny as the agent itself.

The response ladder lines up with joint guidance that NIST, NSA, and CISA published on October 16, which asks for ways to rapidly block, contain, or terminate agent activity. Our coverage of those incident response practices also covers revoking every credential an agent touched, a step Dynamic Conditional Access could automate.

Evidence is the other open question. Microsoft promises traceability for why risk changed, and teams that already collect agent traces with the AgentOps tools we ranked will want those records to line up with Microsoft’s risk events.

What to Do Before Ignite

The dynamic controls act on identities, scopes, and sensors that have to exist first, and most of that groundwork uses products that are generally available today. These steps follow from Microsoft’s documentation and the private preview status of the new features.

• Inventory: run Defender for Endpoint discovery and compare the agents it finds with the ones your teams say they use.
• Identity: move production agents to their own Entra agent identities instead of borrowed user tokens.
• Policy targets: write separate Conditional Access policies for each token subject an agent uses, since one policy does not cover the others.
• Scope: list the writes, approvals, and payments each agent can make, and mark which ones need human approval.
• Containment: pilot Microsoft Execution Containers for coding agents that run on employee devices.
• Preview access: ask your Microsoft account team about private preview before Ignite, and get pricing in writing.

Guardian agents are one approach to agent runtime protection. Our AI agent security tools guide compares Microsoft Defender with 11 other platforms that monitor and block agent actions in production.

Guardian agents are one approach to containing risky agents. Our AI agent governance buyer’s guide places them alongside identity, policy as code, and the frameworks enterprises use to govern agents.

Microsoft is not alone in this space. Our Zenity vs Noma vs Pillar Security comparison compares three independent platforms that discover agents, score their risk, and block unsafe actions at runtime.

Frequently Asked Questions

The Bottom Line

Microsoft now treats enterprise AI agents as insiders that need their own identity, task-scoped access, and a live risk score that can shrink their authority mid-task. Only Microsoft Execution Containers are generally available. The rest is private preview until Ignite, so the work teams can do now is identity, inventory, and scoping.

We will update this story when Microsoft publishes availability dates or pricing for the new controls. Send corrections through our contact page.

Related coverage: Agent security, Incident response for rogue AI agents, Anthropic moves evals offline after agents overstep, MCP gateways, and agent integration platforms.