Microsoft says its new controls can contain risky AI agents—what do they actually cover?
The company has widened local-agent discovery and announced adaptive permissions and containment. Its own support matrix shows runtime blocking is still preview and much narrower than discovery.
The short version
3 key points
- What changed
- Microsoft says Defender can now discover 35 additional local-agent types, bringing its documented total to 60, including Claude Code, OpenAI Codex and GitHub Copilot.
- Why it matters
- Employees may keep their own access while an agent receives narrower temporary authority; high-impact actions can be routed to a person for approval.
- What to watch
- General-availability dates and a product-by-product table for the adaptive controls
Microsoft has added discovery and adaptive controls
Microsoft has extended Project Perception so AI agents can be managed as identities whose access changes while they work. In a 19 October announcement, the company said Defender can discover 35 additional types of local agent, taking the documented total to 60. The Windows list includes Claude Code, OpenAI Codex and GitHub Copilot. Discovery is activity-based: installation alone does not guarantee that Defender sees an agent.[1][2]
Why this matters for workers and security teams
For staff, the practical change could be a clearer separation between a person's permissions and an agent's temporary authority. Security teams may gain one registry and an automated containment path, but must decide which actions can proceed, which need approval and what evidence should stop an agent. Agent ID is available to Entra customers; Microsoft's agent-security extensions require Agent 365 licensing.[1][3]
Who it affects
Employees may keep their own access while an agent receives narrower temporary authority; high-impact actions can be routed to a person for approval.[1][2][3][4]
Keep in mind
All central claims come from Microsoft product announcements and documentation; no independent evaluation is supplied.
Discovery is activity-based; runtime protection is separate, narrower and documented as preview on Windows.
Microsoft reports no customer denominator, containment rate, false-positive rate, latency result or comparative benchmark.
Source analysis · 4 linked sources. Original source date: 19 October 2026.
Read the full report · 3 min The evidence, methods, implications and limitations
Microsoft has added discovery and adaptive controls
Microsoft has extended Project Perception so AI agents can be managed as identities whose access changes while they work. In a 19 October announcement, the company said Defender can discover 35 additional types of local agent, taking the documented total to 60. The Windows list includes Claude Code, OpenAI Codex and GitHub Copilot. Discovery is activity-based: installation alone does not guarantee that Defender sees an agent.
Dynamic Permissions are meant to give an agent task-scoped, time-limited authority instead of a worker's full access. Dynamic Agent Risk combines signals from identity, endpoints, networks, cloud, data and runtime activity. Conditional Access can then block writes, narrow resources, require human approval, isolate the runtime or stop execution. Playbooks and Guardian Agents are intended to recommend or apply those responses under policies set by people.[1][2]
Why this matters for workers and security teams
For staff, the practical change could be a clearer separation between a person's permissions and an agent's temporary authority. Security teams may gain one registry and an automated containment path, but must decide which actions can proceed, which need approval and what evidence should stop an agent. Agent ID is available to Entra customers; Microsoft's agent-security extensions require Agent 365 licensing.[1][3]
The distinction that matters
Discovery and containment are different claims
Microsoft's own documentation shows a wide inventory layer and a narrower preview enforcement layer.
Discover
Observe agent activity and MCP configuration
Up to 60 documented local-agent types
Assess
Combine identity, data, endpoint and runtime signals
Dynamic risk and policy decision
Contain
Reduce access, require approval, isolate or stop
Preview coverage for fewer combinations
The support matrix sets a much narrower boundary
The total should not be read as 60 agents receiving the same blocking. Microsoft's matrix separates discovery from runtime protection. WSL discovery is preview and limited to three tools. Windows runtime protection is also preview: agent-native inspection lists six combinations centred on Claude and GitHub Copilot, while network inspection lists four applications and excludes certificate pinning and HTTP/3. Agent 365 itself became generally available on 1 May, so this is an extension rather than a new platform launch. Microsoft provides no deployment denominator, independent adversarial test, containment rate, false-positive rate or response-time result. Evidence of reliable containment across real enterprises still has to be published.[2][4]
Evidence check
All central claims come from Microsoft product announcements and documentation; no independent evaluation is supplied.
Discovery is activity-based; runtime protection is separate, narrower and documented as preview on Windows.
Microsoft reports no customer denominator, containment rate, false-positive rate, latency result or comparative benchmark.
Reporting basis: Source analysis. Original source date: 19 October 2026.
Continue the story
Read next
Also about ai agents
Who holds AI agents accountable when they reach government systems?
The UK privacy regulator has opened enquiries into recent AI-agent testing and launched a six-week evidence call, while Australia, Canada and California are pursuing different accountability routes. None has yet produced a final finding on the reported agent incidents.
Read the 14 min reportAlso about ai agents
Can companies control what AI agents can access? Gartner finds a governance gap
In a survey of 297 cybersecurity leaders, 54% said their organisation had no defined approach to limiting AI-agent access or reused human permissions. The finding supports tighter privilege controls, but the public release omits geography, sampling and question wording.
Read the 5 min reportExplore the full source and evidence record
What this means for people
- Employees may keep their own access while an agent receives narrower temporary authority; high-impact actions can be routed to a person for approval.
- Security teams must still define policies, verify licensing and test preview controls; an inventory listing does not guarantee runtime blocking.
Global context
This is Microsoft's enterprise product architecture, not a regulator's requirement or a universal standard. Other technology stacks need their own evidence.
What the evidence does not yet show
- All central claims come from Microsoft product announcements and documentation; no independent evaluation is supplied.
- Discovery is activity-based; runtime protection is separate, narrower and documented as preview on Windows.
- Microsoft reports no customer denominator, containment rate, false-positive rate, latency result or comparative benchmark.
What to watch next
- General-availability dates and a product-by-product table for the adaptive controls
- Independent tests reporting containment, misses, false positives and response latency
- Wider runtime coverage and evidence that approvals reduce harm without blocking legitimate work
Living evidence record
Impact record IAI-19H5PNZ
Evidence stage
Announced
Confidence
Supported
Reporting basis
Source analysis
Independent or research support
Not yet
Record status
Monitoring
Last checked
20 October 2026
Source trail
4 direct sources across 2 source types.
People impact
Documented in this record.
Uncertainty
Limits and next checks are explicit.
Stages describe the evidence available—not whether a technology is good or bad. See the public method.
Related-source reporting disclosure
This record analyses 4 linked source records around the same underlying development. The extra records add method, date or context, but they do not by themselves constitute independent replication of every performance claim or predicted outcome.
Evidence trail
Sources used for this report
Links checked 20 October 2026
Research question, topics and regions
What Microsoft added to its agent-security controls, which local agents are discoverable and how documented runtime protection differs from discovery
Topics: AI agents · Cybersecurity · Microsoft · Identity · Enterprise software · Technology
Regions: United States · Global enterprise technology
This report is labelled source analysis. We summarise and analyse source material in our own words; company statements remain attributed claims until independently supported. Translated summaries preserve the meaning of the original source and link back to it. Read our editorial standards.
The Impact Brief · Free
Keep following the stories that matter to you.
Get our weekday briefing on what changed and why it matters. Choose your topics below.
Reader commentary
What does this mean where you are?
Tell us what you have seen at work, in your community or in everyday life. A question is welcome too. No account is needed; we review notes before publishing them.
Explore commentary across the portal →Published reader notes
0No published reader notes yet. You can start the evidence-led discussion above.
Prefer a private correction or response? Contact the newsroom.