Microsoft Introduces Zero-Access Security Controls for AI Agents
Microsoft has announced new security controls designed to limit the access and activity of AI agents inside businesses, starting with no permissions and granting only the access needed for an approved task. The system can also tighten restrictions when an agent’s behaviour raises security concerns, addressing risks as autonomous AI tools gain the ability to interact with corporate applications, data and networks.
Announced on October 19, the measures extend Microsoft’s Project Perception security system to address what the company calls “agentic insiders”. The approach treats AI agents as potential sources of internal security risk, even when they have not been compromised by an external attacker.
AI Agents Will Receive Task-Specific Permissions
Microsoft’s Dynamic Permissions approach is designed to prevent AI agents from automatically inheriting all the access available to the employees who use them. Instead, each agent would receive a separate identity and only the permissions required for its current task, with access limited to the period in which it is needed.
For example, an AI agent processing an employee expense claim might need to read a particular set of financial records but should not automatically gain access to unrelated company files. Higher-impact actions can also require verified human approval, while organisation-wide policies establish the maximum authority an agent can receive.
The principle follows least-privilege security, in which users and systems receive only the access necessary to perform their work. Applying it to AI agents is particularly important because their actions can change as they interpret new information, use tools or respond to unexpected situations.
Microsoft Adds Continuous Risk Monitoring
Microsoft is also introducing Dynamic Agent Risk, which assesses an agent’s activity using signals from areas including identity, data, endpoints, cloud services, networks and runtime environments. The aim is to identify behaviour that appears inconsistent with the task or the organisation’s security policies.
Dynamic Conditional Access can then adjust what an agent is permitted to do as its risk level changes. Responses may include reducing its permissions, allowing read access while blocking changes, restricting the resources it can reach, requiring human approval or isolating the agent and stopping its activity.
The controls are intended to work alongside monitoring and policy enforcement rather than relying solely on an AI model to follow instructions. Microsoft argues that an agent’s underlying model may pursue its assigned objective in ways that do not match an organisation’s expectations, making external controls essential.
Project Perception Extends Security to AI Workflows
The new measures build on Project Perception, Microsoft’s agentic security system introduced earlier in 2026. The system combines signals across enterprise security tools to discover agents, assign identities, assess risk and support responses to suspicious activity.
Microsoft also outlined the role of Guardian Agents, which can supervise the actions of other agents and help enforce security controls as risks change. The company’s broader approach covers identity, permissions, data access, network activity and the environments in which agents operate.
The announcement reflects a shift in enterprise security as AI tools move beyond answering questions and begin taking actions across business systems. An agent that can access documents, update records or interact with company services creates risks that differ from those posed by a chatbot that only generates text.
For businesses, the challenge will be to let agents complete useful work without giving them unnecessary authority. Microsoft’s approach places more emphasis on continuous monitoring, limited permissions and intervention when behaviour changes. Its effectiveness will depend on how reliably organisations can discover their agents, configure appropriate policies and enforce restrictions across their systems.
