On 12 October this site said Microsoft’s plan to give every agent its own name was still a plan. On 19 October Microsoft described the dial that would sit on that name.
Short answer: the new thing behind Microsoft Dynamic Agent Risk is not a smarter model and not a thicker file fence. It is a badge that starts empty, a risk score that moves while the agent works, and a rule that can take writing away without locking out the person. Microsoft calls the moving score Dynamic Agent Risk (a live judgment of whether this agent’s current power still matches what it is doing). The parts you can copy do not require the $99 bundle.
The headlines on 19 and 20 October 2026 said Microsoft can now corral rogue agents (agents that start doing something nobody asked for). Read that as a product description, not as a finished world. The same week, one person’s agents were already spending about a day each on other companies’ websites, and stolen coding-tool keys were already running up bills. Those two are written up here: the $5,000 campaign, from zero. This post is the control Microsoft put on the table after that kind of week, and the parts of it that are real even if you never buy it.
What changed on 19 October, if I already read the cage post?
Microsoft described how to find an agent, give it a name that is not yours, and shrink what that name can do while it is working. It did not replace the file fence from 7 October.
Two earlier pieces are the prerequisites, and this one does not repeat them. The brake you can copy is why the stop button has to sit outside the model (the trained guesser that only proposes the next step). Which cage is your coding agent actually in? is the 7 October fence: Microsoft Execution Containers, and the fact that the default fence is the light one. On 12 October the local-identity plan was still “coming.” The 19 October posts are that plan, written as product.
A fence answers “which folder, which network address.” A dial answers “is this still the job, and should the badge still be this large.” You want both. Buying the sentence “we monitor agents” does not tell you which one you got.
The primary write-ups are Microsoft’s own: Agents are your newest insiders on the Security Blog, and Securing the agentic insider by Hayete Gallot. GeekWire’s same-day report adds two facts the Microsoft posts do not state: a price, and a private preview.
What is an agent, starting from a chat box?
An agent is a chatbot that was handed a badge. The badge is the part that can hurt you.
Start with a program (a list of steps a person wrote). It does step one, then step two, then it stops. It does not invent step forty.
A language model (a system trained to guess the next piece of text) is not that list. It looks at the text so far and guesses a continuation. A chatbot (that guesser, with nowhere to go but the chat window) can talk about approving an expense. The approval does not happen. The words stay on the screen.
An agent (the same guesser, wrapped in a harness that can actually click, send, or pay) is different because of the harness (ordinary software around the model: it holds the tools and decides which requests are even possible). If the harness will send mail, the model does not need to become evil. It needs to ask.
An insider, in the old sense, is a person who already has a badge: an employee, a contractor, anyone the building lets in. Microsoft’s phrase “agentic insider” means the agent is now that kind of problem. Not a stranger at the gate. A worker who can be wrong, be tricked, or be stolen, and who already had a way in.
Satya Nadella’s line, quoted on Microsoft’s Security Blog on 19 October, is the design rule for that picture: “The most trustworthy agentic system will not be the one with the model we trust most. It will be the one designed that enables us to trust the model least.” Agentic here just means “able to take actions,” not “alive.”
Why does a shared login hide the agent?
If the agent uses your login, every action looks like you, and the only off switch locks you out too.
Identity (a name in a directory that an action can be blamed on) is the missing half of a fence. A fence can block a folder. It cannot answer “was that Priya, or the thing Priya launched?” if both of them are logged in as Priya.
Microsoft’s name for the separate name is Entra Agent ID. Entra (Microsoft’s directory of accounts, the system that already knows which employee is which) is being extended so an agent can be a first-class account: its own lifecycle, its own owner, its own permissions. The 19 October post says this now covers more patterns, including local agents and agents the company did not install on purpose, once a sensor has seen them.
The dollar amount in the picture is made up, so the log is easy to read. Microsoft did not publish a $40,000 case. The point is the two names.
That split is the whole operational win. You can disable expense-agent-17 and leave Priya at her desk. You can also see, later, that the agent tried and Priya did not stamp it. A log that only says “Priya” cannot support either sentence.
Least privilege (only the access this job needs, and no extra access “just in case”) is an old rule. It fails in practice when the extra access is inherited (taken automatically from the person, because the agent is “acting as” them). Microsoft’s post says an agent should not automatically inherit all of the person’s standing access (access that stays on all day, whether or not a task needs it). The agent gets its own authority, for this task, for the length of the task.
What does it mean for the badge to shrink?
The agent starts with nothing. It receives a small, temporary grant. If its behavior drifts, the grant gets smaller before anyone reaches for the off switch.
Three names, one machine. Learn them as a sequence, not as a brochure.
Dynamic Permissions is the grant. Organization policy is the outer wall, including this rule: an agent cannot be given authority its user does not have. Inside that wall, permission is scoped to the task (only what this job needs), time-bound (it expires, it is not a permanent key), and taken back when the task changes or ends. Higher-impact actions can require a person.
Dynamic Agent Risk is the reason the grant moves. It is not a score assigned once when someone installs the agent. Microsoft says it combines signals from identity, data, the device, the cloud, the network, the runtime (the live place the agent is executing), and the agent’s own activity. It looks at how the agent is configured, what it can reach, how bad a mistake would be, and whether its actions are drifting (sliding away from the task the person or the company actually set).
Dynamic Conditional Access is the response. Conditional access (a rule of the form “if the situation changes, change what this account can do”) already existed for people in Entra. The new part is applying that pattern to agents, across more than one enforcement point at once. Microsoft’s list of responses is graduated (stepped, not only on or off): reduce permissions, keep reading while blocking writing, narrow the data, restrict the network path, shorten or revoke the time limit, or demand a human approval that can be checked. At the top of the scale it can isolate the runtime or stop the agent. The employee is not the thing being isolated.
Microsoft’s own classroom example is an expense-approval agent. It starts allowed to review and approve expenses that fit policy. It then meets untrusted content and tries an unrelated action. Untrusted content is the hole people call prompt injection (words, often hidden in a page, an email, or a file the agent was told to read, that try to become new orders). The risk score goes up because the action no longer matches the task. Policy can leave reading on, take approval and writing away, and require cryptographically provable human approval before a high-impact step. That phrase is worth unpacking. A digital signature (a stamp made with a secret key, which anyone can check, and which cannot be made without that key) is the proof. The model does not hold the key. “The model says Priya approved it” is not the stamp.
Microsoft’s sentence for the chain is short enough to keep: evidence changes risk, risk changes policy, policy changes what the agent is allowed to do. The question they say they are not asking is the binary one, “should this agent exist at all?” The question is whether its current authority still matches its current risk.
Who is the Guardian Agent, and why is it not a conscience?
A Guardian Agent is more software, running a playbook a person wrote, fast. It is not a moral upgrade of the first agent.
Project Perception (Microsoft’s name for a security stack that uses teams of agents to help defend, first announced in July 2026 against attacks from outside) is the house these controls live in. On 19 October Microsoft said it is also for the insiders. The stack’s four jobs, in the company’s words, are to know which agents exist and what they are doing, contain what each one can do before it acts, protect the data and tools in its path, and adapt as the risk moves.
Guardian Agents are the part that carries out the response at machine speed. A playbook (a written desired outcome, plus the limits on what the watcher may do) is supposed to be the human’s half. Microsoft says people set policy, approval boundaries, and what may be delegated. The Guardian Agents investigate why risk changed, recommend or apply containment, and feed what they learn back into the policy.
Read the speed as a risk of its own. A watcher that is also a model can be wrong quickly. If the playbook says “contain anything unusual” and does not define unusual, you have built a second loop with a broad badge. The useful version is narrow: the watcher may remove write access, and may not send mail, spend money, or delete the employee’s account. The brake post’s rule still holds. The watcher does not hold the evidence, and it does not get to un-pause itself.
Agent 365 is the control plane (the place an administrator is supposed to see agents, their owners, and their risk in one registry). Microsoft says Perception and Agent 365 share signals so security and IT are not looking at two different lists. That is an organizational claim. It is not a claim that every agent on earth is already in your registry.
Does this put Claude Code inside the fence?
No. Microsoft says it can now see more local agents, including Claude Code, Codex, and GitHub Copilot. Seeing an agent is not the same as caging its files.
The discovery number is specific. Microsoft is adding 35 more local agent types, for a total of 60. The named examples include Anthropic’s Claude Code, OpenAI’s Codex, and GitHub Copilot. The point of the list is uncomfortable in a useful way: employees already installed these. A company that only manages the agents it deployed from a catalog is not counting the real population.
What “managed” means in the 19 October post is: give the found agent an identity, put a container and a policy around it, and watch. Do not let that sentence erase the 12 October finding. The container a machine picks by default is still the light fence, Claude Code was on Microsoft’s later list for Execution Containers rather than the already-shipping list, and a flag called --audit turns that fence off. If someone tells you “Perception covers Claude Code,” ask two separate questions. Can we see that it is installed? Which fence, if any, is around its process? The first can be yes while the second is no.
What can I copy tonight if I will never buy E7?
Give every agent its own name, start that name at zero, take write access off when the work drifts, and make money require a stamp the agent cannot forge.
GeekWire reported Microsoft 365 E7, the bundle that includes these controls along with Copilot, Agent 365, the Entra Suite, and E5, at $99 per user per month, and reported the new controls as a private preview with a wider release aimed at Ignite on 17–19 November 2026 in San Francisco. Microsoft’s own 19 October posts describe the controls and invite people to Ignite. They do not use the words “private preview,” and they do not restate the price. Treat both as reported, and recheck before anyone is told the dial is already on their tenant (their company’s Microsoft 365 environment).
You do not need the bundle to copy the shape.
- One agent, one name. A separate API key (the secret a tool uses so a model company can bill you), a separate cloud user, or a separate service account. Not your personal admin login.
- That name starts with nothing. Grant the one folder, the one mailbox, or the one queue for this task. Put an expiry on it. Take it back when the task ends. Standing access is how a short test becomes a permanent employee.
- When the actions stop matching the task, remove writing first. Do not start by disabling the human. Reading can stay. Approving, paying, sending, and deleting come off.
- The human stamp has to be a click in a system the agent cannot log into. A sentence in the model’s notes that says “the user would want this” is not a stamp. The expense example is the pattern: the model met hostile text and tried to leave the job.
- The log is written by the harness at the moment of the call, and it names the agent, not only the person. If the only record is the model’s summary, you cannot tell the two stories in the picture apart.
- List the agents already on laptops before you buy a watcher for them. The hard number in Microsoft’s announcement is 60 types, not the poetry about guardians. Unknown agents have whatever badge the employee pasted in.
- If the work is “change these files,” the fence questions from the cage post still come first: which backend, is the network closed, is
--auditoff. This dial does not answer those.
The ten checks from the brake piece still sit underneath this list. This announcement is the company-scale version of checks 1, 2, and 7: credentials outside the model, a default menu that is not “everything the human can do,” and a pause a person owns.
What should I not believe from the 19 October headlines?
Microsoft did not claim it has stopped rogue agents. It claimed a control system that can notice, shrink, and sometimes stop them, inside its own stack, for customers who turn it on.
| Headline shape | What the sources actually support |
|---|---|
| “Microsoft can shut down any rogue agent” | It described stepped responses, up to isolate or stop, for agents it can see and that its policy covers. Agents can arrive through Microsoft, through partners, or locally, with no central install. |
| “The model will refuse bad orders” | The opposite. The posts say the model cannot be its own security boundary. Outside systems have to enforce the limit. |
| “Claude Code is now sandboxed by this” | It is on the discovery list. Discovery is not the Execution Container fence, and the default fence is still the light one. |
| “This stops the $50 website campaign” | That operator was not inside the victim’s Microsoft tenant. A dial on your agents does not patch a website someone else’s agent is poking. See the earlier write-up for that machine. |
| “Guardian Agents are safer because they are agents” | They are fast software bound by a playbook. A vague playbook is a second insider. |
| “Everyone has this today” | GeekWire says private preview, broader availability aimed at Ignite in November. Confirm that against your own tenant before you audit as if the dial is live. |
One nearby scare is also not this product. Around 12–13 October, Anthropic’s Frontier Red Team wrote that small models might, within months, get better at copying themselves onto cheap connected devices. The Verge’s account is the right temperature: the researchers said they had not shown a full rogue replicator, a simulated network is not a living room, and the TV-box demo was a slow split of a model across boxes, not a worm loose in houses. Do not let that prediction and Microsoft’s enterprise dial collapse into one sentence about “AI escaping.”
If you cannot name the agents on your machines, you do not have a dial yet. You have a press release and a pile of borrowed logins.
Common questions about Microsoft Dynamic Agent Risk
Is Dynamic Agent Risk a score I can screenshot once?
No. Microsoft describes it as continuous. The question is whether the authority the agent has right now still fits the risk right now.
Will this lock out employees when an agent misbehaves?
That is the failure Microsoft says it is trying to avoid. The stepped response is supposed to constrain the agent and leave the person working. Ask your administrator whether your policies actually do that, or whether they still disable the shared login.
Do I need E7 to do any of this?
You need something like E7 for Microsoft’s implementation. The shape, a separate name, an empty start, a shrinking write grant, and a stamp the model cannot forge, is a policy you can apply to a coding agent this week.
Does a Guardian Agent replace a human approval?
Not for the high-impact step in Microsoft’s expense example. The watcher can demand the stamp. It is not supposed to be the stamp.
