Microsoft adds agent containment controls to Project Perception

Microsoft published two posts on 19 October 2026. Nadim Abdo’s security blog extends Project Perception so it watches agents inside an organisation. Hayete Gallot’s post on the official Microsoft blog makes the same case: treat the agent as an insider, and keep the controls outside the model.

The mechanism is a loop. Dynamic Agent Risk recomputes a score from identity, data, endpoints and what the agent is doing. Dynamic Permissions give it only the access the current task needs, for a limited time, rather than the user’s standing rights. Dynamic Conditional Access in Microsoft Entra then changes that access: it can leave reads in place and block writes, shrink what the agent can reach, demand a human approval that can be proved, or isolate and stop the agent. Playbooks set the outcome. Guardian Agents carry it out.

Discovery is widening to 35 more local agent types, 60 in total, including Claude Code, OpenAI Codex and GitHub Copilot. New Microsoft Entra Agent ID types cover agents that were not registered before, so a discovered agent can be a policy target of its own.

The security blog introduces the controls without a release stage, while the diagram on the official blog marks only Microsoft Execution Container as generally available and the other capabilities as private preview, with wider availability at Microsoft Ignite. Microsoft Security’s post on X calls the package part of Microsoft 365 E7. Microsoft has not published a price.