Microsoft has extended Project Perception, its agentic security system, to cover AI agents working inside company systems. In an Oct. 19 post, Nadim Abdo, corporate vice president of Identity and Network Access, describes agents as insiders: capable tools with access to data, applications, and other agents that can make mistakes, be manipulated, or be compromised.
Abdo builds on a principle Satya Nadella, Microsoft’s chairman and CEO, recently described: controls over what a model can access and do must sit outside the model. The post quotes Nadella saying the most trustworthy agentic system is one designed so organizations can “trust the model least.” Project Perception shares signals, context, and a registry with Agent 365, which governs Work IQ agents.
How Microsoft Treats Agents as Insiders
Abdo organizes the response around four continuous jobs: know which agents exist, contain what each can do before it acts, protect the data and systems in its path, and adapt as risk changes. In this model, new evidence changes an agent’s risk, and the risk level changes what the agent is permitted to do.
Discovery covers 60 types of local agents, including Claude Code, OpenAI Codex, and GitHub Copilot, and feeds one registry of owners, activity, and risk. Each agent also gets its own identity through Microsoft Entra Agent ID, separate from its sponsor, so security teams can tell what a person did from what an agent did on that person’s behalf.
How Dynamic Permissions and Risk Scoring Work
Dynamic Permissions starts every agent with no authority. Organization-wide policy sets the outer limit, including a bar on an agent gaining access its user lacks, and the agent receives only what an approved task needs, for only as long as the task runs. Higher-impact actions can require verified human approval.
Dynamic Agent Risk then assesses each agent continuously, combining signals from identity, data, endpoints, cloud, network, runtime, and the agent’s own activity, including drift from its assigned task. Dynamic Conditional Access, an extension of Microsoft Entra Conditional Access, turns changes in that risk into graduated responses: narrower permissions, read access without write access, a required human approval, or isolation at the highest levels.
Microsoft’s example is an expense-approval agent that approves routine reimbursements. If it meets a prompt injection in an external document, the system can keep its read access, remove its approval rights, and require a person to confirm any high-impact step.
How Guardian Agents and Playbooks Fit
Microsoft is adding Playbooks and a team of Guardian Agents to Project Perception for the work that manual triage cannot cover as agent numbers grow. People define policy, approval boundaries, and delegation rules, Playbooks set the security outcome, and Guardian Agents carry out the work.
Guardian Agents can explain why risk changed, investigate the evidence, and recommend or apply containment. Model-level signals such as chain-of-thought are also feeding into Dynamic Agent Risk, with enforcement kept independent of the model. The capabilities sit within Project Perception and Microsoft 365 E7, which includes Agent 365 and Microsoft Entra Suite, according to Microsoft Learn.
What This Means for ERP Insiders
Inventory agents before writing policy. Microsoft’s model starts with knowing which agents exist and who owns them. Listing the agents that touch finance and supply chain data, and naming an owner for each, gives ERP teams clear accountability before agent numbers grow.
Define task-scoped access for each agent. In Microsoft’s expense-approval example, the agent handles routine reimbursements without inheriting its sponsor’s full access. Writing the same kind of task boundary for postings, approvals, and payments gives teams a clear test for any platform’s agent controls.
Pair agent controls with ERP security roles. ERP Today has reported that Microsoft lists agent-specific ERP restrictions as a coming Dynamics 365 capability. Mapping existing security roles to each agent’s task gives teams a working boundary now and an easy handover to dedicated controls later.
