Microsoft details agent identities and adaptive permissions in Project Perception

Microsoft is widening discovery of local AI agents and outlining task-scoped permissions that can narrow as risk changes. Project Perception remains limited to invited preview customers.

Microsoft detailed agent identities and adaptive permissions in Project Perception on 19 October 2026, outlining security controls intended to restrict an AI agent’s access as its assigned task and risk change. The expansion shifts Project Perception beyond helping defenders respond to external threats towards supervising AI agents already working inside companies.

In its official security announcement, Microsoft described wider agent discovery, dedicated identities, Dynamic Permissions, Dynamic Agent Risk and Dynamic Conditional Access. These are announced and developing capabilities, not a single generally available security package.

Finding local agents before applying policy

Microsoft says it is expanding discovery by 35 types of locally running agents, taking the number supported to 60. The examples include Claude Code, OpenAI Codex and GitHub Copilot. Discovered agents can enter a shared registry linked to Microsoft Agent 365 so security teams can establish who owns them and examine their activity.

The company is also extending Microsoft Entra Agent ID to cover additional agent patterns, including local agents that were not centrally registered. An identity separate from the employee makes the agent itself a target for permissions, audits and access policies. The underlying Entra Agent ID platform reached general availability earlier in 2026; the newly described extensions should not be assumed to have the same rollout status.

Access designed around the task, not the employee’s account

Microsoft’s proposed Dynamic Permissions start from no access or the minimum authority needed for an approved assignment. Limits can be tied to a task and time window, then narrowed or removed as circumstances change. An agent should not automatically receive every privilege held by the employee who authorised its work.

Microsoft illustrated the distinction with an expense-approval agent. It could inspect submissions and approve routine claims, but if an untrusted document caused suspicious behaviour, a separate policy system could leave reading available while blocking approvals or writes.

Risk signals can change access while work continues

Dynamic Agent Risk is designed to combine evidence from identity, endpoints, data, cloud services, networks and agent activity. Dynamic Conditional Access could then reduce permissions, restrict resources, require verified human approval, isolate an execution environment or stop the agent. Microsoft also introduced Guardian Agents and Playbooks to coordinate investigation and containment under human-defined policies.

The controls are an architectural direction and set of announced features, not evidence that all organisations can deploy them today. Microsoft’s current product documentation describes Project Perception as a limited, invitation-only public preview. The 19 October release provides no unified general-availability date or independent results demonstrating how well these new controls prevent incidents.