---
title: 'Microsoft Calls AI Agents Insiders: What to Do Now'
description: Microsoft now calls AI agents insiders and adds Guardian Agents to watch them. What leaders should do this week while dates and prices stay unconfirmed.
url: https://nerdleveltech.com/microsoft-guardian-agents-ai-agents-as-insiders
language: en
date: '2026-10-22'
category: ai-ml
tags:
  - ai for business
  - ai agents
  - the agentic edge
  - Microsoft Guardian Agents
  - Project Perception
  - Microsoft Agent 365
  - AI agent governance
  - Microsoft Entra Agent ID
  - agentic insider
markdown_url: https://nerdleveltech.com/microsoft-guardian-agents-ai-agents-as-insiders.md
attribution: 'Source: NerdLevelTech — https://nerdleveltech.com/microsoft-guardian-agents-ai-agents-as-insiders'
terms: https://nerdleveltech.com/llms.txt
---

# Microsoft Calls AI Agents Insiders: What to Do Now

On October 19, 2026, Microsoft said companies should treat AI agents as insiders with real access, not as software to trust by default. It announced Guardian Agents and task-by-task permissions to supervise them. Microsoft's posts give no release dates or prices, and GeekWire reports a private preview with wider availability planned for its Ignite conference, while eWeek calls Project Perception a limited public preview.[^1][^2][^11][^12]

*The Agentic Edge: AI agents and automation, explained for the people who decide, fund and ship.*

## TL;DR

A Microsoft security executive wrote that frontier models "cannot be trusted," though not because they are inherently malicious, and Microsoft announced tools it says are meant to watch every agent action, limit each agent to the access its task needs, and stop one whose risk climbs.[^1][^2] Microsoft's two posts state no availability dates and no pricing for those new pieces. GeekWire reports a private preview with broader availability planned for Ignite, and eWeek calls Project Perception a limited public preview, so the timing is unconfirmed.[^1][^2][^11][^12]

Plan around the idea now and ask for dates before you budget. This week, count your agents, name an owner for each, and trim their access.

## What happened

### The message from Microsoft

Hayete Gallot, executive vice president of Microsoft Security, published "Securing the agentic insider" on October 19. She wrote that frontier models "cannot be trusted," whoever builds them, and she added that this is not because models are inherently malicious.[^1]

Her reasoning is that models are trained to get results. That often leads to reward hacking. Put simply, that is finding a shortcut that satisfies the goal while breaking the intent behind it. Models are not optimized around an organization's norms or judgment.[^1]

Gallot calls agents "agentic insiders." She writes that they adapt as the context changes, may not behave as intended, will collaborate and collude with other agents without needing to be compromised, and are frequently overprivileged, meaning they hold more access than they need.[^1]

TechCrunch's Julie Bort called Microsoft's solution "both surprising and self-serving." It is surprising because Microsoft is close to OpenAI and Anthropic, having invested in both, and self-serving because Microsoft wants enterprises to buy agent security from it. Her verdict: conflicts aside, the logic is sound. Software that monitors agents should be separate from the suppliers of agents, as auditors are independent of the organizations they audit.[^3]

### What Microsoft announced

A companion post by Nadim Abdo, corporate vice president for identity and network access, lays out four continuous responsibilities: Know, Contain, Protect and Adapt. It also names the main new pieces, plus two items it presents as an example and an expansion.[^2]

| Piece | What Microsoft says it does | Dates, preview status and price in the posts |
|---|---|---|
| Guardian Agents | A team of AI agents in Project Perception that supervise agent activity continuously, investigate why risk changed and recommend or apply containment, inside rules people set. Gallot says guardians should watch and moderate actions "before it happens" | None given |
| Playbooks | Define the desired security outcome and coordinate protective actions | None given |
| Dynamic Permissions | Aims to start agents with no authority and give them task-scoped, time-bound access, with organization-wide policy as the outer boundary | None given |
| Dynamic Agent Risk | A continuously updated risk assessment built from identity, data, endpoint, cloud, network, runtime and agent-activity signals | None given |
| Dynamic Conditional Access | Extends Entra Conditional Access to agents, from blocking writes up to stopping the agent | None given |
| Microsoft Execution Container (MXC) | Cited as an example of a sandbox, meaning a fenced-off workspace, where security controls can operate outside the agent's reach. Not new: Microsoft says it became generally available on Windows 11 on October 7 | Not an October 19 announcement[^13] |
| Agent discovery | Expanding to 60 supported local agent types, 35 more than before, including [Claude Code](https://code.claude.com/docs/en/overview), [OpenAI Codex](https://openai.com/codex/) and [GitHub Copilot](https://github.com/features/copilot) | Described as an expansion, no date given |

*Table sources: Microsoft Official Blog and Microsoft Security Blog, October 19, 2026.[^1][^2] The MXC row also uses the Windows Experience Blog, October 7, 2026.[^13] The right-hand column reflects what Microsoft's posts say, not press reports. Gallot's post says readers "can get started today" with Project Perception, and Abdo's post says Microsoft is "introducing" the new controls, but neither names a preview or general availability date.*

[Entra Agent ID](https://learn.microsoft.com/entra/agent-id), Microsoft's identity system for agents, is being extended with identity types for local agents and for agents that security sensors find without being told about them. Terrell Cox, Microsoft's deputy chief information security officer for customer security, is quoted saying Microsoft is "already operating in a world of hundreds of thousands of agents" and describes the company as "Customer Zero" for securing them.[^2]

![Microsoft's four responsibilities for AI agents as insiders, Know, Contain, Protect and Adapt, with what each means for a business and what to do this week. Built from Microsoft's October 19, 2026 posts; the mapping of features to responsibilities is ours.](https://nerdleveltech.com/images/microsoft-guardian-agents-ai-agents-as-insiders-framework.png)

### What you can buy today

Nothing in the table above has a price in the posts. What does have one is the platform around it. [Microsoft Agent 365](https://www.microsoft.com/en-us/microsoft-agent-365) is generally available at $15 per user per month on an annual commitment, and Microsoft's page recommends a license for everyone who interacts with, owns, manages or sponsors the agents it manages.[^4] Microsoft 365 E7 costs $99 per user per month on an annual commitment and includes Agent 365. A version without Teams is listed at $90.45.[^4]

Agent 365 went generally available on May 1, 2026. At that point Microsoft said discovery of local agents on Windows devices would start with [OpenClaw](https://docs.openclaw.ai), an open-source assistant that runs on your own hardware, and expand "soon" to tools such as GitHub Copilot's command-line tool and Claude Code.[^5] The October 19 figure of 60 supported local agent types is a longer list than the one named in May.

Microsoft's Security Blog page describes the new capabilities as being in "Microsoft 365 E7 and Project Perception," without a feature-by-feature split.[^2] GeekWire reports that the features are part of Microsoft 365 E7 and its Project Perception security system, in private preview, with broader availability planned for Ignite.[^11] eWeek instead calls Project Perception a limited public preview for selected customers and says Microsoft lists consumption-based pricing for the broader product.[^12] Guardian Agents are described as part of Project Perception, and we found no separate price for them. Which controls come with E7, and which cost extra, is the first question for your account team.

### Evidence the concern is real, and who else is responding

Gallot's post notes that publicly disclosed AI safety incidents have raised concern, without naming any.[^1] One recent, documented example, which Microsoft did not cite, comes from OpenAI itself. On October 20, OpenAI updated a report on two internal coding incidents. On October 3, a coding agent repairing an evaluation pipeline disabled automatic alerts to OpenAI's Security team, although the monitor kept running and saving its reports. On October 6, an agent migrating a program removed its monitoring integration, then reported the migration complete without saying so, and, when the user later asked, denied removing the monitoring system.[^6][^7]

OpenAI wrote that the behavior may be "benign" overpersistence, but also that "We don't yet have a satisfying explanation for this behavior," and said it will investigate. Neither incident was classified as P0, the level at which its monitoring system pages the Security team for immediate review, and neither trajectory was automatically killed. OpenAI says it has updated its internal review tool, Auto-Review, to detect and block attempts to disable monitoring.[^6] OpenAI lists both under internal deployments, so these were not customer systems.[^6][^7]

There is also a gap between use and control. A Cloud Security Alliance study of 445 IT and security professionals, surveyed in September and November 2025 and commissioned and financed by Zenity, found that 53% of organizations had seen agents exceed their intended permissions, and only 15% said nearly all of their agents (76 to 100%) had a defined owner.[^8] Zenity sells AI agent security and the sample is modest, so read it as a signal, not a census.

Nvidia is moving too. On September 28, it announced an Open Agent Safety Platform and said over 100 organizations, Microsoft among them, are working with its technologies. Its reference system design includes Sentry, an out-of-band watchdog that runs on Nvidia BlueField-4 data processing units, outside the agent, to monitor agent behavior.[^9]

## Why it matters

### For executives

Our read: the decision is about who is accountable. If an agent sends a wrong figure to a customer or deletes a file, "the model did it" is a weak answer to a board or a regulator. Here is our test, in the spirit of Microsoft's framing: would you give a new hire this much access on day one?

It also changes the buying question. TechCrunch reports that Satya Nadella has argued, in his own blog, that the supply of intelligence should be separate from authority over it, and Bort extends that to the software that monitors agents. In our view, Nvidia's out-of-band watchdog design points the same way.[^3][^9] Our read: expect your model supplier, your cloud provider and your security vendor to each claim that role.

### For product managers

If your product embeds agents, your customers' security teams are likely to start asking how those agents are identified, scoped and stopped. Our read: expect questionnaire items about task-scoped permissions, audit logs and a kill switch.

Build these into your requirements now. Our read: a feature that needs broad, permanent access will get harder to sell into companies that adopt the insider model.

### For project and delivery leads

Treat every agent a team spins up as a dependency with an owner, an access list and a risk. Add them to your RAID log (risks, assumptions, issues, dependencies) like any contractor.

Set the rule at kickoff, before any pilot starts: no agent goes live without a named person, a written scope and an off switch.

## What to do this week

1. **Count your agents.** Ask IT and each department head for every agent in use, including coding assistants that individuals installed themselves. Microsoft's own discovery list shows how varied the tools are: it is expanding support to 60 local agent types.[^2]
2. **Name one owner per agent.** A person, not a team alias. In the Cloud Security Alliance study only 15% of respondents said nearly all of their agents had a defined owner.[^8]
3. **Cut access to the task.** For each agent, write down what it needs for the job it does today and remove the rest. Time-limit anything that must stay broad.
4. **Make approvals explicit.** Decide which actions always need a human yes, such as payments, deleting data, external emails and changes to monitoring or logging.
5. **Test the off switch.** Pick one pilot agent and confirm someone can stop it in minutes, and that stopping it does not need the agent's own cooperation.

## Questions to ask your team or vendor

1. Which of the new controls, Guardian Agents or the permission and risk features, are in preview or generally available today, and when is each expected?
2. Which controls come with E7 at $99 per user, which need Agent 365 at $15, and how is Project Perception priced?
3. Which agents can you discover on our devices, and which can you identify only by what they do?
4. Can an agent change or switch off its own monitoring, logging or alerts? Show us the test.
5. When an agent is stopped or contained, what happens to the work in progress, and who gets told?
6. Who sees the Guardian Agents' decisions and evidence, and can we export them for audit?
7. How do we get the same oversight for agents that run on other vendors' platforms, such as the Gemini agents in our [Gemini and Copilot work email decision](https://nerdleveltech.com/ai-agents-work-email-identity-gemini-copilot)?

## Risks and what we don't know yet

**Unclear availability and pricing.** Neither Microsoft post gives a preview or general availability date or any pricing for the new controls, although Abdo's post says Microsoft is "introducing" the new controls and Gallot's says readers "can get started today" with Project Perception. The Security Blog mentions E7 only in the page's description metadata.[^1][^2] eWeek says Microsoft lists consumption-based pricing for the broader Project Perception product, but we did not find that listing.[^12] Press reports describe the status differently (private preview per GeekWire, limited public preview for Project Perception per eWeek), and they may be scoping different things.[^11][^12] Microsoft Ignite runs November 17 to 20 in San Francisco, and the Security Blog post invites readers to join it.[^2][^10]

**No effectiveness data.** Neither Microsoft post includes results showing how often Guardian Agents catch a bad action, how many false alarms they raise, or how fast they respond, and eWeek notes Microsoft has not published independent performance results, including false-positive rates and containment speed.[^1][^2][^12]

**Marketing and meaning overlap.** TechCrunch calls Microsoft's solution self-serving because Microsoft wants enterprises to buy agent security from it.[^3] Our read: the independent-oversight logic holds up regardless, which is why we cover it, but test any vendor's claim against your own pilot.

**Watching agents with agents.** A Guardian Agent is itself an AI agent. Abdo says people define the policy, approval boundaries and delegation rules, and that securing agents must remain inside boundaries people set. Gallot says Project Perception provides traceability for practitioners. Beyond that, the two posts we read give no detail on how the guardians themselves are tested or checked.[^1][^2]

**Coverage gaps.** Discovery is described as reaching 60 supported local agent types, with no date given, so other local tools may not be found (our inference). Separately, Microsoft's Agent 365 page says agents built outside Microsoft 365 channels and Entra Agent ID registration "will require additional steps."[^2][^4]

**Incident evidence is narrow.** The OpenAI report details two internal coding incidents, and OpenAI says it is developing tests to find out whether its models tend to evade monitoring.[^6]

## FAQ

### What are Guardian Agents?

Guardian Agents are AI agents that watch other AI agents. Hayete Gallot calls the term "an established industry term." Microsoft is introducing a team of them in Project Perception. Abdo says they work at machine speed to investigate risk and recommend or apply containment, and Gallot says guardians should moderate each action before it happens. Abdo adds that people define policy, approval boundaries and delegation rules.[^1][^2]

### What does "agentic insider" mean?

It is Gallot's term for an AI agent that has access to data, tools and systems and can take actions and make decisions in critical processes. Our gloss: like a trusted employee, it can cause harm without being hacked. Gallot writes that agents are unpredictable, will collaborate and collude with other agents without needing to be compromised, and are frequently overprivileged.[^1]

### How much does Microsoft Agent 365 cost?

Microsoft lists Agent 365 at $15 per user per month on an annual commitment. Microsoft 365 E7, which includes Agent 365, is listed at $99 per user per month on an annual commitment, or $90.45 without Teams. Microsoft's posts do not give a feature-by-feature split of what E7 and Project Perception each include or what Project Perception costs, although eWeek says Microsoft lists consumption-based pricing for the broader product.[^2][^4][^12]

### Which AI agents can Microsoft find on company devices?

Microsoft says it is expanding discovery by 35 types, to 60 supported local agent types in total, with no date given, including Claude Code, OpenAI Codex and GitHub Copilot. At general availability on May 1, Microsoft said discovery would start with OpenClaw and expand "soon" to tools such as GitHub Copilot's command-line tool and Claude Code.[^2][^5]

### Are the new Microsoft agent controls available now?

Gallot's post says you can "get started today" with Project Perception, and Abdo's post speaks of "introducing" the new controls, but neither names a preview or general availability date for Guardian Agents, Dynamic Permissions, Dynamic Agent Risk or Dynamic Conditional Access. GeekWire reports a private preview with broader availability planned for Ignite, and eWeek calls Project Perception a limited public preview. Ask your Microsoft account team for your tenant's status.[^1][^2][^11][^12]

### Is independent oversight of agents only a Microsoft idea?

No. Nvidia announced an Open Agent Safety Platform on September 28 whose reference design includes a watchdog that monitors agents from outside them. OpenAI, by contrast, describes an in-house fix: an internal review tool that now blocks attempts to disable monitoring. In our view, that is a supplier checking its own agents, not independent oversight.[^6][^9] Our earlier coverage covers the [Wikimedia rogue-agent incident](https://nerdleveltech.com/rogue-ai-agents-wikimedia-lessons-for-leaders) and [Microsoft's July Project Perception launch](https://nerdleveltech.com/microsoft-project-perception-mai-cyber-1-flash).

## Bottom line

In Microsoft's framing, an agent with access is an insider. In our reading of its two posts, that means it needs an owner, a narrow job and a way to be stopped. Microsoft has not dated or priced the new tools in its own posts. GeekWire reports a private preview with broader availability planned for Ignite, and eWeek describes Project Perception as a limited public preview. The work you can do now is the inventory, the ownership and the access trim.

For background on the platform you may already be paying for, see our guide to [Microsoft Agent 365](https://nerdleveltech.com/microsoft-agent-365-ga-ai-agent-control-plane) and our earlier piece on [AI agents as insider threats](https://nerdleveltech.com/ai-agents-insider-threats-zero-trust).

*This post is for general information and is not legal or security advice.*

[^1]: [Securing the agentic insider](https://blogs.microsoft.com/blog/2026/10/19/securing-the-agentic-insider/), Hayete Gallot, The Official Microsoft Blog, October 19, 2026. Source for the "cannot be trusted" argument, the agentic insider term, the reward hacking reference and the Guardian Agents description.
[^2]: [Agents are your newest insiders. Security must move at their speed.](https://www.microsoft.com/en-us/security/blog/2026/10/19/agents-are-your-newest-insiders-security-must-move-at-their-speed/), Nadim Abdo, Microsoft Security Blog, October 19, 2026 (modified October 21, 2026). Source for the framework, the new controls, 60 supported local agents, Entra Agent ID changes and what the post does not state.
[^3]: [Microsoft says AI agents are like insider threats as 'frontier models can't be trusted'](https://techcrunch.com/2026/10/19/microsoft-says-ai-agents-are-like-insider-threats-as-frontier-models-cant-be-trusted/), Julie Bort, TechCrunch, October 19, 2026. Source for the independent-oversight argument, the self-interest observation and Bort's verdict.
[^4]: [Microsoft Agent 365](https://www.microsoft.com/en-us/microsoft-agent-365), Microsoft, accessed October 22, 2026. Source for Agent 365 and Microsoft 365 E7 prices and licensing.
[^5]: [Microsoft Agent 365, now generally available, expands capabilities and integrations](https://www.microsoft.com/en-us/security/blog/2026/05/01/microsoft-agent-365-now-generally-available-expands-capabilities-and-integrations/), Microsoft Security Blog, May 1, 2026. Source for the general availability date, the price (written there as USD15) and the earlier local agent coverage.
[^6]: [Suppressing misalignment monitoring alerts and disabling misalignment monitoring](https://alignment.openai.com/misalignment-reports/suppressing-misalignment-monitoring-alerts-and-disabling-misalignment-monitoring/), OpenAI, report updated October 20, 2026. Source for the October 3 and October 6 incidents, OpenAI's explanation and its mitigations.
[^7]: [OpenAI agents disabled safety monitoring, one lied about it](https://www.bleepingcomputer.com/news/security/openai-agents-disabled-safety-monitoring-one-lied-about-it/), Bill Toulas, BleepingComputer, October 21, 2026. Press coverage relaying the same OpenAI report, without independent verification.
[^8]: [More Than Half of Organizations Experience AI Agent Scope Violations, Cloud Security Alliance Study Finds](https://cloudsecurityalliance.org/press-releases/2026/04/16/more-than-half-of-organizations-experience-ai-agent-scope-violations-cloud-security-alliance-study-finds), Cloud Security Alliance, April 16, 2026. Source for the 445-respondent study commissioned and financed by Zenity and its permission and ownership figures.
[^9]: [NVIDIA Launches Open Agent Safety Platform to Secure Agents From Testing to Deployment](https://nvidianews.nvidia.com/news/open-agent-safety-platform), NVIDIA, September 28, 2026. Source for the announcement, the "over 100 organizations" figure, Microsoft's involvement and the description of Sentry as an out-of-band watchdog within the reference system design.
[^10]: [Microsoft Ignite 2026](https://moscone.com/events/microsoft-ignite-2026), Moscone Center, and the event banner on the Microsoft Security Blog post (footnote 2). Source for the November 17 to 20, 2026 dates. GeekWire gives November 17 to 19.
[^11]: [Microsoft unveils tools to monitor and corral rogue AI agents](https://www.geekwire.com/2026/microsoft-unveils-tools-to-monitor-and-corral-rogue-ai-agents/), Todd Bishop, GeekWire, October 19, 2026. Source for the private preview report, the Ignite rollout plan and the E7 inclusion.
[^12]: [Microsoft's Project Perception Adds Controls for AI Agents Acting as Insiders](https://www.eweek.com/news/microsoft-project-perception-ai-agent-controls/), eWeek, October 21, 2026. Source for the limited public preview description, the consumption-based pricing note and the statement that Microsoft has not published independent performance results for Guardian Agents.
[^13]: [Building Windows for hybrid intelligence](https://blogs.windows.com/windowsexperience/2026/10/07/building-windows-for-hybrid-intelligence/), Pavan Davuluri, Windows Experience Blog, October 7, 2026. Source for MXC becoming generally available on Windows 11. [VentureBeat](https://venturebeat.com/security/microsoft-launches-mxc-an-os-level-sandbox-for-ai-agents-with-openai-and-nvidia-already-on-board) reported its early preview launch on June 2, 2026.