Microsoft says AI agents should start with zero access, unveils new security controls

Microsoft has announced a set of new security tools aimed at treating AI agents as a new kind of insider risk, with controls designed to limit what each agent can access and to tighten those limits automatically if its behaviour changes. The announcement was made in a blog post by Nadim Abdo, corporate vice president of identity and network access at Microsoft. It extends Project Perception, Microsoft’s agentic security system introduced earlier this year, to cover the agents that companies are deploying across their operations.

Why agents are an insider risk

Abdo said agents are quickly becoming part of how work gets done, from writing code and analysing revenue to processing expenses. To be useful, they often need access to company data, applications and tools, and that access creates insider risk.He stressed that this doesn’t mean agents are inherently malicious. They can make mistakes, be manipulated or be compromised, he said, and an agent that behaves as intended at the…