Microsoft announced new agent risk controls on October 19, 2026, that treat AI agents the way a security team treats a risky insider. Each agent gets a risk score that updates as it works, and its access shrinks as the score rises: first no writes, then human approval for big steps, then shutdown.
The features sit in Microsoft 365 E7 and Project Perception, Microsoft’s agent-based security system. Microsoft also expanded the list of coding and desktop agents it can find on staff computers to 60, including Claude Code, Codex and GitHub Copilot. This piece covers what the agent risk controls do, what they cost, which parts a Business Premium tenant can use today, and what to watch at Ignite.
The short version: the new agent risk controls need E7 at $99 per user per month, or the Agent 365 add-on paired with Defender for Endpoint Plan 2. GeekWire reports they are in private preview. Most small nonprofits will not have them this year. But the Agent 365 registry, the basic inventory of your agents, is included in Microsoft 365 Business plans. Start there.
We covered the product these controls build on in our Microsoft Agent 365 explainer in May.
What Microsoft announced on October 19
Two Microsoft posts carry the news. Hayete Gallot, executive vice president of Microsoft Security, wrote Securing the agentic insider on the Official Microsoft Blog. She argues that frontier models cannot be trusted, whoever builds them, and that agents should be managed as insiders.
Nadim Abdo, corporate vice president for Identity and Network Access, wrote the detailed post on the Microsoft Security blog. It is careful on one point: "This does not mean agents are inherently malicious." The concern is that agents can reach a goal in ways nobody intended.
| Feature | What it does | Status, as of October 2026 |
|---|---|---|
| Dynamic Agent Risk | A risk view for each agent, built from identity, data, endpoint, cloud, network and runtime signals | Announced; no date from Microsoft |
| Dynamic Conditional Access | Extends Entra Conditional Access to agents, with responses that tighten as risk rises | Announced; no date from Microsoft |
| Dynamic Permissions | Task-scoped, time-limited access that ends when the task ends | Announced; no date from Microsoft |
| Guardian Agents and Playbooks | Agents in Project Perception that investigate risk changes and contain other agents | Announced; no date from Microsoft |
| Local agent discovery | Finds 60 agent types on Windows devices, up from 25 | Windows live; macOS in preview |
Microsoft’s posts do not give a preview or release status for the dynamic agent risk controls. GeekWire’s report on the launch says they are in private preview, with broader availability planned for Ignite.
How the agent risk controls respond as risk rises
The core idea fits in one line from Abdo’s post: "Evidence changes risk. Risk changes policy. Policy changes what the agent is allowed to do."
The risk score rises when an agent’s behavior drifts from what its user or organization intended. Microsoft lists the responses Dynamic Conditional Access can apply as that happens:
- Cut write access, keep reads. The agent can still look things up but cannot change anything.
- Narrow its reach. Limit the data, resources and network paths it can use.
- Shorten or revoke time-bound access. Temporary rights end early.
- Require human approval. Higher-impact actions wait for a verified person to approve them.
- Isolate or stop it. At the highest risk levels, the runtime is isolated or execution stops.
Dynamic Permissions sets the outer limit. Access is scoped to a task and expires when the task changes or ends. Organization-wide policy also blocks any authority the user does not have. An agent should never hold more rights than the person it works for.
Guardian Agents do the response work. When an agent’s risk changes, they investigate why. They can recommend containment or apply it. Security staff write Playbooks that set the outcome they want, and people keep control of policy and approval rules.
Microsoft also says it plans to feed model reasoning, such as chain-of-thought, into the risk score. Enforcement stays outside the model. In Abdo’s words: "We should not ask a model to be its own security authority."
Finding the agents your staff already run
The part most likely to matter soon is discovery. Microsoft says it added 35 local agent types, bringing the total to 60. Its Defender for Endpoint AI agent support matrix lists them, updated October 9.
The Windows list includes Claude Code, Claude Desktop, Codex CLI and Desktop, Cursor, Gemini CLI, GitHub Copilot CLI and app, OpenClaw, Ollama Desktop, Windsurf and VS Code extensions for several of them. macOS discovery is in preview and covers 51 agents.
Microsoft’s discovery guide sets the requirements:
- A Microsoft Defender for Endpoint Plan 2 license.
- Devices onboarded to Defender for Endpoint, in the commercial cloud.
- Microsoft Defender Antivirus in active mode with real-time protection on.
No extra setup is needed. Discovered agents appear in the Defender portal under Assets, then AI agents, then the Local agents tab.
For agencies and developers, this is worth knowing on the other side too. If a client runs E5 or E7, your team’s coding agents on their machines may show up in their Defender inventory.
Who can use Microsoft’s agent risk controls
Licensing for the agent risk controls has three layers. Microsoft’s discovery guide spells out the split, and the Agent 365 service description lists what base plans get.
| What you have | Agent registry and basic actions | Local agent discovery | Risk level and recommendations |
|---|---|---|---|
| Microsoft 365 Business Premium | Yes | Not listed; Business Premium includes Defender for Business, not Plan 2 | No |
| Business Premium plus Defender Suite | Yes | Yes, through Defender for Endpoint Plan 2 | No |
| Microsoft 365 E5 | Yes | Yes | Only with Agent 365 added |
| Agent 365 with Defender for Endpoint Plan 2 | Yes | Yes | Yes |
| Microsoft 365 E7 | Yes | Yes | Yes |
The prices come from Microsoft’s Agent 365 page. Agent 365 is $15 per user per month, paid yearly. E7 is $99, or $90.45 without Teams. GeekWire reports E7 bundles Microsoft 365 Copilot, E5, Entra Suite and Agent 365.
Agent 365 is not limited to enterprise plans. Microsoft’s Entra Agent ID page says it "is available as an add-on to Microsoft E5/A5/Business Premium." That matters for nonprofits, where Business Premium is common.
One question is still open. Microsoft has not said whether the new dynamic features will reach Agent 365 add-on customers or stay with E7. The current Defender page grants risk scores to either. Treat the October features as E7 first until Microsoft says otherwise.
What a small nonprofit IT lead can do without E7
Most of the useful work does not need the new agent risk controls. A Business Premium tenant can start this week.
- Open the agent registry. The Agent 365 service description lists the registry inventory as included in Microsoft 365 Business plans. It sits in the Microsoft 365 admin center.
- Use the basic actions. Business plans can block, delete, approve and reassign the owner of an agent. Assign an owner to every agent that has none.
- Sync outside platforms. The registry can pull in agents and metadata from other platforms, not just Copilot Studio.
- Ask who runs coding agents. Without Plan 2, Defender will not list local agents for you. A short staff survey covers most small offices.
- Price the gap. If local discovery matters, compare the Defender Suite add-on for Business Premium against Agent 365. Ask your partner for nonprofit pricing.
The local agents need their own settings, whatever Microsoft licenses. Our post on Claude Code permission modes covers one example. Our piece on agent configuration management covers keeping those settings consistent across machines.
One Windows piece is already live and free to try. Microsoft Execution Containers became generally available on October 7, according to the Windows Developer Blog. It is a sandbox that limits which files and network destinations an agent can use. The policy stays outside the agent’s control.
GitHub Copilot, OpenAI Codex, OpenClaw and LM Studio support it now. Microsoft says Claude Code is coming. Intune policy for these containers is listed as "soon," so central management is not here yet.
If you buy through a nonprofit program, our post on nonprofit Copilot discounts covers the current offers. It does not cover E7 or Agent 365, and Microsoft’s Agent 365 page does not mention nonprofit pricing.
How OpenAI, Google and Anthropic handle agent controls
The other platforms are building similar controls. OpenAI lets each user set custom rules for a ChatGPT dot, such as "ask first" for a type of action. Enterprise admins turn dots on by role, as our dot setup guide explains. Google says Gemini agent permissions are role-based and approved by security admins, with spend caps that pause an agent. Anthropic gives Team owners an "Automatically approve" setting for Cowork, covered in our Claude Cowork merger post. None of them has announced agent risk controls that change an agent’s access in real time.
This also connects to a gap we flagged in August. Our post on CMS agent governance found no CMS meets an agent governance standard yet. Microsoft’s controls govern agents at the identity layer. They do not change what your CMS lets an agent do once it is in.
What to watch at Ignite
Microsoft Ignite opens November 17 in San Francisco, and Microsoft’s security blog invites customers there for more. These are the questions to bring:
- Release dates. When do the agent risk controls, including Guardian Agents, leave private preview?
- Licensing. Do they come with the $15 Agent 365 add-on, or only with E7?
- Defender for Business. Will local agent discovery reach Business Premium without Plan 2?
- Container management. When do the Intune and Agent 365 controls for Execution Containers ship?
- macOS. When does macOS discovery leave preview?
- Nonprofit pricing. Will E7 or Agent 365 get a nonprofit offer?
Frequently Asked Questions
What did Microsoft announce on October 19, 2026?
Agent risk controls that score each AI agent and tighten its access as risk rises, plus Guardian Agents in Project Perception and discovery of 60 local agent types. Microsoft calls this securing “the agentic insider.”
What happens when an agent’s risk score rises?
Microsoft lists graduated steps: remove write access while keeping reads, narrow its data and network access, shorten temporary access, require human approval for high-impact actions, and at the top, isolate or stop it.
Are the new agent risk controls available now?
Microsoft’s posts give no dates. GeekWire reports the features are in private preview, with broader availability planned for Ignite in November 2026. Local agent discovery on Windows is already live for Defender for Endpoint Plan 2.
Do I need Microsoft 365 E7?
For the risk scores and recommendations, you need E7 or Agent 365 with Defender for Endpoint Plan 2, per Microsoft’s Defender docs. Microsoft has not said whether the new dynamic features will come to the Agent 365 add-on.
How much do E7 and Agent 365 cost?
Microsoft lists E7 at $99 per user per month, paid yearly, or $90.45 without Teams. Agent 365 alone is $15 per user per month, paid yearly. Microsoft does not list nonprofit pricing for either.
Can a Business Premium tenant use any of this?
Yes. The Agent 365 registry and basic actions, such as block, delete and reassign owner, are included in Business plans. Agent 365 is also sold as an add-on to Business Premium.
Which agents can Microsoft find on staff computers?
Sixty on Windows, including Claude Code, Codex, GitHub Copilot, Cursor, Gemini CLI and OpenClaw. macOS discovery is in preview with 51. An agent appears only after Defender sees it run.
What are Microsoft Execution Containers?
A sandbox for AI agents on Windows, generally available since October 7, 2026. It limits files and network destinations an agent can reach. GitHub Copilot and Codex support it now; Claude Code is listed as coming.
Do other AI platforms offer similar controls?
OpenAI, Google and Anthropic offer approval rules, admin toggles and role-based permissions for their agents. None has announced a live risk score that changes an agent’s access as it works.
