Microsoft spent Monday saying out loud what most security programs still haven’t written into policy. Your agents are insiders. Often over-privileged, hard to predict, running at machine speed. Hayete Gallot, Microsoft’s EVP of Security, put it flatly: frontier models “cannot be trusted.” Not because they’re malicious, but because they’re trained to hit results.
That’s not a small framing shift. Insider risk is a budget line, a program and a tool category. Microsoft just moved agents into it.
What was announced. Four pieces, per Nadim Abdo’s post on the Microsoft Security blog. Discovery: 35 more local agent types, 60 in total, including Claude Code, OpenAI Codex and GitHub Copilot, pulled into one registry. Identity: Entra Agent ID extended to local and previously unknown agents, so something a sensor finds can become a policy target. Containment: agents run in sandboxes such as Microsoft Execution Container, start with no standing authority, and get task-scoped, time-bound access through Dynamic Permissions. Adaptation: Dynamic Agent Risk scores each agent continuously, and Dynamic Conditional Access acts on the score. Guardian Agents in Project Perception run the playbooks.
Availability dates and pricing: not in the post. Ignite runs Nov 17 to 20 in San Francisco. Expect the SKU conversation there.
The idea worth stealing, whoever you buy from. Graduated response. Most agent controls today are binary. Allow or kill. Microsoft’s expense-agent example is the better model. The agent reads an untrusted document and tries something off-task. The system pulls write access but keeps reads, narrows what it can reach, and asks a human to approve the risky step. That’s how you contain a prompt injection without turning it into an outage. If your tool can only block, someone will eventually turn it off.
The second idea: the employee keeps the employee’s access, and the agent gets its own identity and its own scoped authority. A lot of agents in production today act on a user’s delegated token. In your logs, every agent action then looks like the user did it. Fix that first. It’s the precondition for everything else, including attribution in an incident.
Where the platform wins. If your agents live in Copilot Studio and Foundry, and your identity plane is Entra, Microsoft owns the sensors, the identity and the policy engine. Purview Insider Risk Management already ships a Risky Agents policy, in preview, for Copilot Studio, Foundry and P4AI SDK agents. It flags risky prompts, sensitive responses, sensitive data access and risky websites (per Microsoft Learn). Best-of-breed vendors pitching “agent discovery” into an E5 shop just lost their easiest demo.
Where it doesn’t, yet. Discovery isn’t enforcement. Seeing Claude Code on a laptop is not the same as mediating its tool calls. Microsoft’s own post says local, network and data controls have to mediate the agent’s path to tools, MCP servers and other agents. That only works where those controls sit in the path. A developer laptop running a non-Microsoft harness against a non-Microsoft MCP server is the gap. So is an agent acting through a third-party SaaS API.
That’s where the money is going. Asymptote Labs announced a $5.5 million seed today, led by Tower Research Ventures, for Beacon, an MIT-licensed telemetry layer across Claude Code, Codex, Cursor and more than 20 other harnesses, plus a paid platform that adds policy gates and approvals (per Unite.AI). Tenable’s OPEN for AI, also out today, goes the other way. Plug Tenable’s exposure data into whatever AI tools you already run, over MCP or APIs, with launch partners including SentinelOne, Splunk and BeyondTrust (per Tenable). Sophos made AI Defense generally available last week as a paid add-on for its EDR, XDR and MDR customers (per Sophos). Neutral telemetry, open data, bundled control. Three different bets against the same platform.
Five questions for any agent security pitch, Microsoft’s included. Where exactly is the enforcement point: in the execution path, or after the fact? Which harnesses can it block, not just observe? Does the agent get its own identity, or ride the user’s token? Can it downgrade an agent to read-only instead of killing it? And when the control service is unreachable, does the agent fail open or closed?
The financial read. Calling agents insiders pulls agent security toward an existing budget and an existing suite. That squeezes standalone agent discovery fast. It squeezes cross-platform runtime enforcement much less, because Microsoft can’t be neutral about runtimes it doesn’t own. The agent security startups that look strong after Ignite will be the ones sitting in the execution path on the non-Microsoft side, with block logs to prove it.
Our take: Satya Nadella’s line, quoted in the post, is right. “The most trustworthy agentic system will not be the one with the model we trust most. It will be the one designed that enables us to trust the model least.” The open question is whether the vendor that sells you the agent’s runtime should also decide what the agent is allowed to do. Some CISOs will say yes for simplicity. The ones running mixed fleets of Copilot, Claude Code and Codex probably won’t.