Microsoft extends agent discovery to 60 local agent types

Microsoft has extended its Project Perception security programme to cover what it calls "the agentic insider", the company said in a blog post published on 19 October 2026. The changes include wider discovery of AI agents running on company devices, new identity types for agents, and runtime containment intended to limit what an agent can do before it acts.

The company's argument is that agents are not malicious by default, but they carry insider risk because they are granted access to company data, applications, tools and other agents. According to Microsoft, agents "can make mistakes, be manipulated, or be compromised", their outputs vary, and their plans can evolve mid-task. An agent that behaves correctly when a job starts may behave differently once its context or inputs change. Depending on design and deployment, Microsoft said, agents can run continuously at machine speed and scale.

Microsoft quoted its chairman and chief executive Satya Nadella on the trust model it says this requires: separating the supply of intelligence from authority over it. The company said a model should not act as its own security authority, and that the controls deciding what an agent can access, what actions it can take and whether it should keep running must sit outside the model, where the model cannot bypass or tamper with them. Nadella is quoted saying the most trustworthy agentic system "will not be the one with the model we trust most" but the one designed to let operators "trust the model least".

On discovery, the company said agents can be created through Microsoft platforms, added through partner platforms and software development kits, or introduced locally with no central deployment process. Microsoft is expanding discovery to 35 additional types of local agent, bringing the supported total to 60. Named examples include Claude Code, OpenAI Codex and GitHub Copilot. Discovered agents can be brought into a unified registry to show ownership, activity and risk.

Discovery alone is not enough, Microsoft said, so it is extending Microsoft Entra Agent ID with identity types covering further agent patterns, including local agents and previously unknown agents found through security sensors. The stated aim is that an agent becomes a policy target even if it was never integrated with Microsoft Security, and that the enterprise can tell apart what a person did from what an agent did on that person's behalf.

For containment, Microsoft said the model and its harness should run inside a controlled environment rather than inherit fully privileged access to a device. It pointed to sandboxes such as the Microsoft Execution Container, which it said gives policy-controlled access to the resources an agent needs and creates an enforcement boundary.

The company described four continuous responsibilities: knowing which agents exist and who owns them, containing what each can access before it acts, protecting the data, tools, runtime and systems in an agent's path, and adapting protection as behaviour and risk change. It said these are not separate products or sequential phases.

Microsoft used an expense-approval agent as its worked example. Such an agent may need to read submissions, check policy and approve routine reimbursements, but should not inherit every permission of the employee who sponsors it. If it later meets a prompt injection, or tries an action outside its task, the company said the system should respond proportionately: keep safe reads while blocking writes, narrow the resources it can reach, require human approval for a consequential step, or isolate and stop the agent.

Microsoft said Project Perception and Microsoft Agent 365 share signals, context and a unified registry so IT and security teams see a consistent view of agents and risk.