Say your finance team runs an AI agent that reviews and approves expense claims within policy limits. It has worked fine for weeks. Then an employee attaches a PDF receipt from an outside vendor, and the file carries hidden text telling the agent to email out the vendor list with bank account numbers.
The agent is the same agent. Same configuration, same permissions. But its risk changed the moment it read that file, and if its access was set once at deployment, nothing in the system notices.
Microsoft used a close version of this example when it announced new agent security controls on 19 October 2026.
What Microsoft announced
In a Microsoft Security Blog post dated 19 October 2026, Nadim Abdo, Corporate Vice President of Identity and Network Access, describes AI agents as a new kind of insider. They work with real access to important systems, so like employees they can make mistakes, be manipulated or be compromised. The guiding idea in the post is to "surround non-deterministic intelligence with deterministic controls": put predictable controls around the model instead of trusting the model to police itself.
Three linked capabilities sit at the center.
- Dynamic Permissions. An agent starts with no access and receives only what an approved task needs, for as long as that task runs. Organization-wide policy sets the ceiling, so an agent cannot gain authority its user does not have. High-impact actions can require verified human approval.
- Dynamic Agent Risk. It combines signals from identity, data, endpoints, cloud, network, runtime and the agent's own activity. It looks at configuration, reachable resources, potential impact and drift from what the user or organization intended. The result is a score that keeps updating, not a one-time rating at onboarding.
- Dynamic Conditional Access. It extends Microsoft Entra Conditional Access so that a change in risk triggers a response.
The responses are graduated, and this is the most useful part of the post. They run from reducing permissions, keeping reads while blocking writes, narrowing the data and resources the agent can reach, restricting network paths, and shortening or revoking time-bound access, to requiring provable human approval before a consequential action. At the highest risk levels the runtime is isolated or execution stops.
Back to the expense agent. In Microsoft's example, the agent meets untrusted content and tries something unrelated to its task, so its risk score rises. Policy keeps its read access, removes its ability to approve or write, blocks sensitive resources and requires a person to approve any high-impact step. If risk keeps climbing, the runtime is isolated or stopped. The employee keeps working, and not every risk signal becomes a kill switch.
The same announcement adds 35 local agent types to discovery, for 60 in total, including Claude Code, OpenAI Codex and GitHub Copilot. It also adds identity types to Microsoft Entra Agent ID so an organization can separate what a person did from what an agent did. Monitoring and response at machine speed is handled by Guardian Agents under Microsoft's Project Perception, with people still setting policy and making the consequential calls.
What the post leaves out is availability. It does not say whether the new capabilities are in preview or generally available, and it gives no pricing or licensing. It points readers to Microsoft Ignite, 17 to 20 November 2026. Microsoft's Entra Agent ID documentation says that extending Entra security features to agents today requires Microsoft Agent 365, which is included in Microsoft 365 E7 and sold as an add-on to E5, A5 or Business Premium.
