Microsoft Unveils Guardian Agents to Treat AI Agents as Insider Threats

In a blog post, Nadim Abdo, Microsoft’s corporate vice president for Identity and Network Access, wrote that AI agents are not inherently malicious but can make mistakes or be manipulated and compromised. Because they must be granted relatively extensive permissions to work properly, he said, they create risks that can prove disastrous if not handled properly.

Abdo said agents cannot be trusted with their own security and cited Satya Nadella, Microsoft’s chairman and chief executive officer, on the need to separate “the supply of intelligence from the authority over it.” “We should not ask a model to be its own security authority,” Abdo wrote. “The controls that determine what it can access, what actions it can take, and whether it should continue operating must sit outside the model, where the model cannot bypass or tamper with them.”

Microsoft said human oversight alone is insufficient because agents move at machine speed. The company is extending its Project Perception system, which coordinates red agents that probe for weaknesses, blue agents that investigate threats and green agents that implement fixes, to secure what it calls the agentic insider. The resulting Guardian Agents are meant to help security teams operate continuously, Abdo wrote. “Guardian Agents help security teams operate continuously, at machine speed and scale, while sensors, context, and actuators across the cyber stack help understand changing agent risk and continuously adapt protection in response,” he said. He added that Project Perception and Microsoft Agent 365 share signals, context and a unified registry that gives IT and security teams a consistent view of agents and risk.

Abdo said Guardian Agents rest on the principle that non-deterministic intelligence must be surrounded by deterministic controls, independent evidence and containment boundaries. The controls cover identity, permissions, data, endpoints, network, cloud and runtime. Microsoft said they are intended to identify which agents exist, who owns them and what they are doing; contain what each agent can access and do before it acts; protect the data, tools, runtime, resources and systems an agent uses; and adapt protection as behavior, context and risk change.

Microsoft also said it is expanding discovery to 35 additional types of local agents, including Claude Code, OpenAI Codex and GitHub Copilot. It is extending Microsoft Entra Agent ID with identity types for additional agent patterns, including local and previously unknown agents found through security sensors. Dynamic Permissions will limit agents to access needed for a specific task, while Dynamic Agent Risk checks for potential threats. Dynamic Conditional Access can restrict permissions, block operations or ask for human approval when risk rises, and in more extreme cases stop and isolate an agent, the company said.