The agent gets its own identity
Microsoft has published a security architecture that treats AI agents as insiders rather than as features. In a post by Nadim Abdo, corporate vice president for identity and network access, the company sets out an agent that starts with no authority of its own, receives permissions scoped to one task for the length of that task, and is scored continuously for risk while it runs.
The identity layer is Microsoft Entra Agent ID, extended with identity types for more agent patterns, including local agents and previously unknown ones found by security sensors. Each agent gets an identity separate from the person who sponsors it. That separation is the precondition for everything else: you cannot revoke an agent’s access independently of its user unless the agent has access of its own.
Permissions that expire with the task
Dynamic Permissions is the mechanism. Organisation-wide policy sets the outer limit; within it, an agent receives task-scoped, time-bound permissions, and higher-impact actions can require verified human approval. The model runs inside a Microsoft Execution Container, a sandbox that holds the agent’s model and harness under policy-controlled access with enforcement placed outside the agent’s reach.
Dynamic Agent Risk is the scoring side. Microsoft says it draws on identity, data, endpoint, cloud, network, runtime and agent-activity signals, listing Sentinel, Entra, Intune, Purview, Global Secure Access and Defender as inputs. The post also says the score includes model-level signals such as chain-of-thought evidence — the agent’s own reasoning used as a security input.
Dynamic Conditional Access turns the score into action, and the responses are graduated rather than binary: reduce permissions, block writes while keeping reads, narrow the resources in scope, shorten the access window, require human approval, isolate the runtime, or stop execution.
Sixty kinds of agent, including the competition
Microsoft says agent discovery now covers 35 additional local agent types for a total of 60, and names Anthropic’s Claude Code, OpenAI’s Codex and GitHub Copilot among them. That is a security product that inventories rival vendors’ agents on employee machines, which is the practical shape of the problem: the agents an enterprise has to govern are not only the ones it bought from Microsoft.
Two new pieces sit on top. Guardian Agents are security agents that run continuously, investigate why another agent’s risk changed, and recommend or apply containment. Playbooks define the security outcome and coordinate what the Guardian Agents do. Microsoft says people keep control of objectives and consequential decisions.
What the post leaves out
The post gives no availability dates, no general-availability timing, and no licensing tier. The only date in it is Microsoft Ignite, 17 to 20 November. GeekWire reported that the features are part of Microsoft 365 E7, the company’s top-tier bundle, and that agent detection rose from 25 types to 60; neither the E7 tier nor the figure 25 appears in Microsoft’s own text, which says only “35 additional” for a total of 60.
Satya Nadella is quoted in the post saying “The most trustworthy agentic system will not be the one with the model we trust most.” Terrell Cox, deputy chief information security officer for customer security, says “Agents will only be adopted at scale if they can be trusted at scale.”
Ignite is the place to watch. A security architecture with no ship dates is a position, not a product.
