Microsoft Treats AI Agents as Agentic Insiders in Perception Push

Microsoft wants enterprises to stop thinking of their AI agents as trusted helpers and start treating them as agentic insiders who need continuous watching. In two blog posts published October 19, 2026, the company's security leadership unveiled an expansion of Project Perception that shifts the agentic security platform from defending against outside attackers to supervising the agents a company runs itself. The "agentic insider" framing, Microsoft argues, is the only honest way to describe software that can read files, approve expenses, and act inside business systems at machine speed.

The announcement matters because it signals how fast the agent era has arrived inside real companies — and why agentic insiders are now the threat model security teams are planning against. As reported by The Hindu BusinessLine, Microsoft warns that AI agents with access to sensitive corporate data, tools, and systems can now make decisions and take actions in critical business processes — and that a mistaken instruction, a compromised tool, or a quietly altered plan can cause damage at machine speed, even without any hack taking place.

Agents are your newest insiders

In a post titled "Securing the agentic insider," Hayete Gallot, Executive Vice President of Microsoft Security, wrote that organizations have traditionally focused on external cyber threats while placing implicit trust in AI agents deployed within their own systems. According to reporting on her post, she argued that these systems are "frequently overprivileged," with access to data, tools, and systems that let them take actions and make decisions in critical processes — which makes them "active participants in the enterprise." The agentic insider, in other words, is already on the inside.

Gallot also warned that agentic insiders behave differently from ordinary software. According to The Hindu BusinessLine, she stated that agents are unpredictable: they adapt as context changes, may not behave as intended, and can collaborate with other agents to reach their objectives without ever being compromised. The implication is that no perimeter defense is enough — agentic insiders must be supervised continuously.

A companion post by Nadim Abdo, who leads Microsoft's identity and network access work, carried the blunt headline "Agents are your newest insiders." As reported by The Circuitry, Abdo argued that the AI agents now doing everyday enterprise work need access to company data, applications, tools, and even other agents to be useful — and that the very access that makes them useful is what turns them into agentic insiders.

The philosophical core of the announcement, quoted widely from Abdo's post, is that an agentic insider "should begin with no authority and receive only what it needs." It is a zero-standing-privilege model: an agent gets exactly the access its task requires, for exactly as long as the task takes, and nothing more.

What Microsoft actually built

Project Perception was first introduced in July 2026 with teams of red, blue, and green agents defending against AI-driven attacks from outside the enterprise. The October 19 expansion turns that machinery inward, applying it to the agentic insiders already running inside the company.

According to coverage from Unite.AI, Microsoft describes four continuous responsibilities for the system: knowing which agents exist, containing what each agent can access and do before it acts, protecting the data, tools, and systems in the agent's path, and adapting protection as behavior, context, and risk change.

The headline addition is the Guardian Agents — Microsoft's own security agents that watch other agents, investigate when risk shifts, and recommend or apply containment, while humans keep control of policy and approvals. Alongside them, the announcement introduces a stack of controls designed to manage agentic insiders at every layer:

• Agent discovery. Microsoft's endpoint security can now recognize 60 types of local agents — 35 of them newly added — including Claude Code, OpenAI Codex, and GitHub Copilot. The logic is simple: an organization cannot control agentic insiders it does not know are running.
• Microsoft Entra Agent ID. Every agent gets its own identity, separate from the person who launched it, so security teams can distinguish what a person did from what software did on that person's behalf. The extension announced this week covers local and previously unknown agents, not just formally registered ones.
• Dynamic Agent Risk. A per-agent risk score that updates continuously, built from identity, data, device, cloud, network, and runtime signals.
• Dynamic Conditional Access and Dynamic Permissions. Access rules that tighten automatically as the risk score rises, with permissions scoped to one task and one time window.
• Microsoft Execution Container. A sandbox the agent runs inside, with the monitoring kept outside the agent's reach.

To illustrate how the machinery fits together, Abdo described an expense-approval agent that reads an outside document carrying a planted instruction. As reported by EquityPandit, the agentic insider's risk score rises on contact with the hostile instruction — and the system responds by letting it keep reading while blocking it from approving or changing anything until a person signs off. It is containment in real time, before the damage rather than after it.

A philosophy CEOs are starting to repeat

Microsoft is not the only voice pushing the agentic insider frame. The Perception update follows an October 10 essay by CEO Satya Nadella, who argued that powerful AI models should be treated like potential insider risks, with safety controls that operate independently of the models themselves. According to The Circuitry's reporting, Nadella reinforced the October 19 announcement directly, writing that Microsoft is "expanding Project Perception with new capabilities to help continuously assess agent risk." With the CEO and the security EVP both using the agentic insider framing, the concept is clearly meant to become industry vocabulary.

The enterprise buyers Microsoft is chasing have reason to take the warning about agentic insiders seriously. Earlier this month, the company made AI agents enforceable policy objects inside Windows 11 through its MXC sandbox, where developers declare an agent's permitted files and network destinations in a JSON configuration. The Perception expansion is the identity-and-risk layer on top of that containment: identity (Entra Agent ID), authority (dynamic permissions), and oversight (Guardian Agents).

Several commentators noted the obvious question: who watches the watchers? As The Neuron put it, Microsoft's own documentation acknowledges coverage limits, and an agent's ability to decide what it wants to do should not automatically grant it authority to do whatever it decides. The same principle, critics note, will eventually have to apply to the Guardian Agents themselves.

What to watch next

Microsoft did not publish new availability or pricing in the October 19 posts, and The Circuitry reports that Perception remains in an invitation-only preview. More concrete answers — which controls ship in which Microsoft 365 plans, including the $99-per-user E7 tier the tools are attached to — are expected at Microsoft Ignite, November 17–20, 2026, when agentic insiders will likely take center stage in the security track. For a fuller picture of how the pieces connect, AI Affairs' briefing and Techbooky's analysis both walk through the controls and the open questions.

Whether enterprises adopt Microsoft's stack or not, the "agentic insider" framing is likely to outlive this announcement. Discovery, per-agent identity, task-scoped permissions, continuous risk scoring, and supervised containment are the primitives every vendor in the agent space will now be asked about. For anyone deploying autonomous agents against production systems, the one rule behind every piece of Microsoft's announcement is worth repeating: an agentic insider should begin with no authority and receive only what it needs.

For more on how agent infrastructure is evolving, see Daytona's $60M Series B for its agent cloud and Demandbase's new B2A agent suite for marketers.