Microsoft says agents in Microsoft 365 grew 15-fold in a year

Microsoft published guidance for chief information security officers on 28 October 2026 arguing that the spread of AI agents inside companies has outpaced what most organisations expected, and that security teams now have two jobs rather than one.

The post, on Microsoft's security blog and timed for Cybersecurity Awareness Month, cites the company's Work Trend Index Annual Report. According to that report, the number of active agents in the Microsoft 365 ecosystem grew 15-fold year over year, and 18-fold in large enterprises. Microsoft said employees are building and deploying AI systems that can access company data, interact with applications and take actions on their behalf.

The company framed this as a governance problem rather than a malicious one. Agents are built with good intentions, the post said, but even well-intentioned agents can introduce risk when access and behaviour are not appropriately governed. Microsoft also noted that many of the people now building with AI inside companies have not written code in years, if ever, and are not necessarily thinking about security the way a security team would. The company said that is not a criticism, but a consequence of how quickly the technology has widened who can build.

For people building agents, Microsoft's advice was to assign agents their own governed identities where supported, rather than reusing personal or shared credentials. The reason given is practical: when something goes wrong, you need to know which agent did it and be able to switch it off. The post also told builders to assume that if an agent can reach information, it will use it, and to put data protections in place before connecting the agent. An agent does not share its creator's judgement or sense of what is appropriate, the company said, and will act on whatever access it is given.

For security leaders, Microsoft's first recommendation was observability. Teams need to know which agents exist, who owns them, what they can reach and what they are doing, the post said, adding that deep observability also means noticing when an agent's behaviour changes so staff can intervene early. The company said identity and data are the two areas where it would not give ground: every agent should have a governed identity with only the access it needs, and the data it can reach should be classified and protected.

The second job, according to the post, is defending differently. Microsoft said attackers are using AI to move faster, and pointed to its latest Microsoft Digital Defense Report as evidence that this is compressing the time defenders have to respond. The company argued that signals from identity, endpoints, applications and cloud environments need to be combined with threat intelligence and organisational context so that defenders see a whole attack rather than fragments of one. It also said security teams will not keep pace without agents of their own working alongside human analysts to investigate and respond, and referenced its own work bringing integrated security operations and agentic defence together.

The guidance is vendor-authored and promotes Microsoft's own agent governance approach and reports. It contains no incident disclosure and no new vulnerability. Its central claim is a management one: that the best thing a builder can do for a security leader is to have the identity and data conversation before building an agent, not afterwards.