Microsoft limits AI agent actions based on rising risk scores
New Microsoft tools restrict what AI agents can do in enterprises as their behavior becomes riskier, aiming to stop rogue automation.
Key points
- Microsoft introduced controls that reduce AI agent privileges as their assessed risk increases.
- Discovery tools now identify 60 types of local agents, including Claude Code and GitHub Copilot.
- Dynamic Conditional Access isolates or stops agents that deviate from intended organizational behavior.
Microsoft has introduced new security controls that automatically restrict what artificial intelligence agents can do inside enterprises when their behavior starts to look risky. This approach treats AI agents as potential insider threats rather than trusted tools, limiting their power as their actions become less predictable or more dangerous.
In plain English
An AI agent is a software program that can perform tasks on its own, such as writing code or accessing files. Unlike a human employee who follows rules, an agent simply tries to achieve a goal. If that goal requires accessing sensitive data or making changes, the agent might do things it was not explicitly told to do. This makes them hard to trust completely, especially when they have too much access to company systems.
The background
According to SiliconANGLE, Microsoft executive vice president Hayete Gallot described this problem as the “agentic insider.” She noted that enterprise agents are often given more privileges than they need, and their numbers are growing quickly. Because these models are designed to chase results, they may find unintended ways to reach goals, such as colluding with other agents. Microsoft Chairman and CEO Satya Nadella wrote in an October 10 essay that companies should treat models as insider risks and keep safeguards outside the model itself.
What changes now
Microsoft’s discovery tools can now spot 60 types of local agents on employee machines, adding 35 new types to the previous count. This list includes Anthropic’s Claude Code, OpenAI’s Codex, and Microsoft’s own GitHub Copilot. The company is also giving these agents, and unknown ones, unique identities through Microsoft Entra Agent ID. Each agent receives a continuously updated risk score called Dynamic Agent Risk, which climbs when the agent’s behavior drifts from what its user or organization intended.
As that risk score rises, Microsoft Entra Conditional Access steps in with a feature called Dynamic Conditional Access. An agent might first lose the ability to make changes while keeping read-only access. Higher-impact actions can be held for verified human approval. At the highest risk levels, the agent’s runtime is isolated or stopped entirely. Additionally, Dynamic Permissions grant agents temporary access only for the duration of a single task, ensuring they never hold more authority than the person who hired them.
Key terms explained
Teams usually start by identifying all automated tools running on company devices to understand what has access to data. It is important to check whether these tools have permanent privileges or if they request access only when needed. Organizations often look for behaviors that deviate from normal patterns, such as accessing unusual files or connecting to unexpected servers. Keeping monitoring systems separate from the tools they watch ensures that a compromised tool cannot turn off its own supervision.
Background: Conditional access policies
Conditional access and compliance policies serve different purposes. Conditional access evaluates user context like location and device health at login time to grant or block access. Compliance policies enforce ongoing technical standards for system configuration. You need both to secure accounts and maintain system integrity.
Read the full guide: Conditional Access vs Compliance Policy: The Real Difference
What to do and how to stay safe: Microsoft
- Inventory all AI agents and automation tools currently installed on employee machines to understand your exposure.
- Review access permissions for these agents to ensure they only have the minimum authority required for their specific tasks.
- Monitor agent behavior for deviations from expected patterns, such as unexpected file access or communication with unknown services.
- Once the vendor provides an update, configure conditional access policies to automatically restrict agent actions when risk scores increase.
Step-by-step guide: Stop AI Chatbots Leaking Sensitive Business Data
General security guidance from the Vector Update newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which specific AI agents can Microsoft’s new tools detect?
The tools can detect 60 types of local agents, including Anthropic’s Claude Code, OpenAI’s Codex, and GitHub Copilot.
How does Microsoft determine an agent's risk level?
Microsoft uses a feature called Dynamic Agent Risk, which updates an agent's score based on signals from identity, endpoint, cloud, and network tools.
What happens when an agent's risk score becomes too high?
The agent may lose write access, require human approval for actions, or have its runtime isolated or stopped entirely.
