The hardest question in agent governance is embarrassingly basic: how many agents are running in your company, and who owns each one? On 19 October 2026, Microsoft published a security blueprint that answers it with inventory, identity and containment — and adds a class of supervising agents to enforce the result.
What happened
Microsoft’s Security Blog post, “Agents are your newest insiders. Security must move at their speed,” extends Project Perception to what the company calls the “agentic insider.” The substance, in the company’s own terms:
- Discovery expansion. Microsoft is adding 35 more local agent types to its detection coverage, for a total of 60 supported local agents, including Claude Code, OpenAI Codex and GitHub Copilot. Discovered agents — however they were found — can be pulled into a unified registry covering ownership, activity and risk.
- Identity as the anchor. Microsoft is extending Microsoft Entra Agent ID with identity types for additional agent patterns, including local and previously unknown agents discovered through security sensors. The stated principle: every agent should have a first-class identity distinct from the person using or sponsoring it, so the enterprise can tell what a person did from what an agent did on that person’s behalf.
- Dynamic Permissions. Agents start with no authority and receive only what an approved task needs, time-bound and task-scoped, and never authority their user does not have. Higher-impact actions can require verified human approval.
- Dynamic Agent Risk and Dynamic Conditional Access for agents. Risk is continuously recomputed from identity, data, endpoint, cloud, network, runtime and the agent’s own activity; the response is graduated — trim permissions, keep reads and block writes, narrow reachable resources, shorten or revoke time-bound access, require “cryptographically provable human approval,” isolate the runtime, or stop execution.
- Containment boundaries. The model runs inside a policy-controlled sandbox (Microsoft Execution Container, MXC), and controls sit outside the model so a compromised agent cannot switch off its own supervision.
- Guardian Agents. A team of supervising agents inside Project Perception, driven by Playbooks, that carry out protective actions at machine speed while “people define policy, approval boundaries, and delegation rules.”
Project Perception and Microsoft Agent 365 are described as sharing signals, context and that unified registry. Satya Nadella’s framing, quoted in the post, is the thesis: “The most trustworthy agentic system will not be the one with the model we trust most. It will be the one designed that enables us to trust the model least.”
Why it matters for KYA
This is the first large-platform statement that agent discovery and agent identity are the same problem, and it moves KYA from a concept to a console.
- “Unknown agent” becomes a first-class identity type. Registering only the agents you deployed centrally is a fiction: agents arrive through SDKs, partner platforms and developers’ laptops. Microsoft is now issuing identities to agents it found by sensor rather than by deployment record — the registry equivalent of enrolling a walk-in. For KYA, that is the right order of operations: discover, then identify, then authorize.
- Identity is explicitly separated from the sponsoring human. The employee keeps their access; the agent gets its own identity, its own permissions and its own task-scoped authority. That is exactly the distinction KYC does not make, and it is what makes attribution possible in an audit trail.
- The accountability chain gets a revocation path. Time-bound authority, continuous risk scoring and graduated response — including revoking access mid-task — are the operational counterpart of a KYA check. A verification that cannot be withdrawn at machine speed is decoration.
- Guardian Agents raise a second-order question. Who verifies the verifiers? Microsoft’s answer is procedural — policies and approvals set by people, actions executed by agents. Buyers should ask for the same evidence they would demand of any agent: the guardian’s own identity, its scope, and an auditable record of what it did and on whose instruction.
The claim to test in a pilot is not the feature list but the coverage: how many of your agents does discovery actually find, how many of those resolve to a named owner, and can you show an auditor a decision record that separates the human’s authority from the agent’s?
Sources
- Microsoft Security Blog, “Agents are your newest insiders. Security must move at their speed.”, 19 October 2026 — microsoft.com.
- Microsoft Learn, Microsoft Entra Agent ID — the identity object extended in this announcement — learn.microsoft.com.
- Microsoft Learn, AI agent support matrix (Defender for Endpoint) — the list behind the “60 supported local agents” figure — learn.microsoft.com.
- Satya Nadella, “Models as insider risks” — the essay the post quotes for the trust-architecture argument — snscratchpad.com.
Note: capability descriptions, the 60-agent count and the Nadella quotation are as stated by Microsoft in the 19 October post; this is a vendor announcement, not an independent evaluation.
Know Your Agent (KYA) explains agent identity, verification and accountability. This is an explainer, not legal or compliance advice — see our Sources & methodology. New to KYA? Start with What is Know Your Agent? and the glossary.