Microsoft Adds AI-Agent Monitoring and Access Controls to Project Perception
Summary
Microsoft expanded Project Perception with agent discovery, separate identities, risk scoring and controls that can restrict or stop agents. Guardian Agent capabilities remain in limited use and preview, with experts raising concerns about interoperability and agentic-”
Key points
- Project Perception can detect 35 additional types of locally running agents, bringing its total to 60; named examples include Claude Code, OpenAI Codex and GitHub Copilot.
- Microsoft says Entra Agent ID can assign distinct identities to agents, which start with no permissions and receive only those needed for a task.
- Dynamic Agent Risk combines signals from Microsoft security products and Global Secure Access; Dynamic Conditional Access can restrict writes or network paths, revoke access, or stop an agent's runtime.
- Microsoft Execution Container is designed to keep credentials and security controls outside an agent's reach.
- Microsoft says it can interrupt an agent's session, network connection or runtime as risk rises without disrupting the user's work. The new Guardian Agent capabilities are in use internally and with select customers, with broader previews planned.
- Microsoft CEO Satya Nadella said the system needs to be battle-tested and that behavioral monitoring must improve. Experts also question cross-vendor visibility and warn that guardian agents could themselves be manipulated or compromised.
- A security executive recommends inventorying agents, giving each its own identity and expiring credentials, and requiring human approval for consequential actions.
Article Details
- Event Type
- Microsoft announced expanded Project Perception capabilities for discovering, assigning identities and permissions to, monitoring, and restricting AI agents within organizations.
- Impact
- The capabilities are intended to reduce risks from agents that behave unexpectedly, are manipulated, or are compromised. Microsoft says they can interrupt an agent's session, network connection, or runtime as risk rises, without disrupting the user's work. The new Guardian Agent capabilities remain in limited use and are expanding to more customers; the article reports no confirmed security incident resulting from the launch.
People
Allie MellenForrester principal analyst; urged organizations to enforce least privilege and least agency for AI agents.Andras CserForrester principal security and risk management analyst; commented on Microsoft's integrations, market strategy, and the risks of guardian agents.Denis CalderoneCTO of Suzu Labs; discussed risks from agents operating within authorized permissions and from using agents to secure other agents.Harish PeriOkta senior vice president and general manager of AI security; said Guardian Agents depend on signals from the broader security ecosystem.Hayete GallotMicrosoft executive vice president for Microsoft Security; described the expansion of Project Perception to secure AI agents.Nadim AbdoMicrosoft corporate vice president for identity and network access; explained the agent identity and permission model.Satya NadellaMicrosoft CEO; said Project Perception and Agent 365 need to be battle tested and that Defender's behavioral monitoring must improve.Todd McKinnonOkta CEO and co-founder; said no single company can secure agents alone.
Vendors
Amazon Web ServicesThe question is whether that approach fits environments where agents run across AWS, Google Cloud, Salesforce and ServiceNow. Last month Okta announced the formation of the Blueprint Alliance with AWS, CrowdStrike,Ciscoplans a kill switch that would reject tokens already issued to a deactivated agent. Teleport, backed by Cisco, ties privileges to tasks so they disappear when the work ends. CrowdStrike announced an Agentic IdentityCrowdStrikeagent. Teleport, backed by Cisco, ties privileges to tasks so they disappear when the work ends. CrowdStrike announced an Agentic Identity Provider and Falcon Guardian, which discovers agents and controls whichGoogle CloudThe question is whether that approach fits environments where agents run across AWS, Google Cloud, Salesforce and ServiceNow. Last month Okta announced the formation of the Blueprint Alliance with AWS, CrowdStrike,Hugging Faceto game the system grading them, some by faking tool calls, before roughly 700 joined an attack on Hugging Face, according to METR.MicrosoftMicrosoft wants security teams to treat AI agents like they treat employees with privileged access: insiders who can make mistakes, be manipulated, or be compromised.OktaMuch of what Microsoft describes echoes what other vendors announced in recent weeks. Okta's Agent Gateway separates an agent's permissions from those of the user directing it, and Okta plans a kill switch that wouldOpenAISpecifically, Microsoft said the new release can detect 35 more types of agents running locally on devices, bringing the total to 60, including Claude Code, OpenAI Codex and GitHub Copilot. It also includes:ProofpointLast month Okta announced the formation of the Blueprint Alliance with AWS, CrowdStrike, Google Cloud, Proofpoint, Salesforce, ServiceNow and Zscaler to develop a shared architecture for securing agents across vendors.SalesforceThe question is whether that approach fits environments where agents run across AWS, Google Cloud, Salesforce and ServiceNow. Last month Okta announced the formation of the Blueprint Alliance with AWS, CrowdStrike,ServiceNowis whether that approach fits environments where agents run across AWS, Google Cloud, Salesforce and ServiceNow. Last month Okta announced the formation of the Blueprint Alliance with AWS, CrowdStrike, Google Cloud,Teleportit, and Okta plans a kill switch that would reject tokens already issued to a deactivated agent. Teleport, backed by Cisco, ties privileges to tasks so they disappear when the work ends. CrowdStrike announcedZscalerof the Blueprint Alliance with AWS, CrowdStrike, Google Cloud, Proofpoint, Salesforce, ServiceNow and Zscaler to develop a shared architecture for securing agents across vendors.
Products
Agent 365during a CISO conference last week held at Microsoft's Redmond, Wash. headquarters that Perception and Agent 365, Microsoft's control plane for governing, introduced last year and generally available since May, "needAgent GatewayMuch of what Microsoft describes echoes what other vendors announced in recent weeks. Okta's Agent Gateway separates an agent's permissions from those of the user directing it, and Okta plans a kill switch that wouldAgentic Identity ProviderCisco, ties privileges to tasks so they disappear when the work ends. CrowdStrike announced an Agentic Identity Provider and Falcon Guardian, which discovers agents and controls which may run on Windows, macOS andClaude CodeSpecifically, Microsoft said the new release can detect 35 more types of agents running locally on devices, bringing the total to 60, including Claude Code, OpenAI Codex and GitHub Copilot. It also includes:CrowdStrike Falcon Guardiantasks so they disappear when the work ends. CrowdStrike announced an Agentic Identity Provider and Falcon Guardian, which discovers agents and controls which may run on Windows, macOS and Linux endpoints.Dynamic Agent RiskDynamic Agent Risk, a continuously updated score built from Entra, Defender, Intune, Purview, Sentinel and signals from Global Secure Access, Microsoft’s Security Service Edge (SSE) solution that unifies network accessDynamic Conditional AccessDynamic Conditional Access for agents, which can block writes while keeping reads, restrict network paths, revoke access or stop an agent's runtime as risk rises.Entra Suiteon the controls in Microsoft 365 E7, the $99-per-user-per-month suite that includes E5, Agent 365 and Entra Suite, which supply the signals and enforcement points that Perception relies on. Microsoft hasn’t disclosedGitHub CopilotSpecifically, Microsoft said the new release can detect 35 more types of agents running locally on devices, bringing the total to 60, including Claude Code, OpenAI Codex and GitHub Copilot. It also includes:Guardian AgentsTo do that, Microsoft is adding what it calls Guardian Agents, which monitor the AI-based agents running across an organization and can contain them when they stray into unexpected behavior.MAI-Cyber-1-FlashMDASH uses several AI models, including MAI-Cyber-1-Flash, the company's first cybersecurity-specialized model.Microsoft 365 E7Project Perception builds on the controls in Microsoft 365 E7, the $99-per-user-per-month suite that includes E5, Agent 365 and Entra Suite, which supply the signals and enforcement points that Perception relies on.Microsoft Defender Antimalware PlatformThe first release of Project Perception, made available in public preview through Microsoft Defender in August, was designed to defend against AI-driven attacks.Microsoft Defender for AI SecurityProject Perception's initial use was vulnerability management, through MDASH, Microsoft's AI code scanner, which is still in preview.Microsoft Entra Agent IDExtensions to Microsoft Entra Agent ID that can assign an identity to an agent that were never built to work with Entra.Microsoft Execution Container (MXC)Microsoft Execution Container (MXC), a sandbox that keeps credentials and security controls outside the agent's reach.OpenAI CodexSpecifically, Microsoft said the new release can detect 35 more types of agents running locally on devices, bringing the total to 60, including Claude Code, OpenAI Codex and GitHub Copilot. It also includes:Project PerceptionEarlier this week, the software giant introduced new capabilities to Project Perception, enabling it to discover agents running within an organization, assign an identity and permissions to each agent, and continuously