Microsoft Launches Guardian Agents to Police AI Agents at Work
Microsoft said on October 19, 2026 that it is extending Project Perception, its agentic security system, with a new layer called Guardian Agents. These are AI agents built to carry out security work at machine speed under policies that humans set: explaining why an agent's risk level changed, investigating incidents, recommending or applying containment, and helping harden policy before the next incident happens. The announcement came in a Microsoft Security Blog post by Nadim Abdo, Corporate Vice President for Identity and Network Access, with a companion post on the Microsoft Official Blog.
⚡ Quick facts
- What's new: Microsoft announced Guardian Agents on October 19, 2026, alongside Playbooks, Dynamic Permissions, Dynamic Agent Risk, Dynamic Conditional Access for agents, and a sandbox called the Microsoft Execution Container
- Scale: Microsoft says it already runs hundreds of thousands of agents internally under Project Perception
- Detection: Defender for Endpoint's local agent discovery grew by 35 types to 60 total, including Claude Code, OpenAI Codex and GitHub Copilot
- The argument: CEO Satya Nadella says trust in an agentic system should come from controls outside the AI model, not from the model itself
- Not announced: pricing or a general availability date for any of the new Guardian Agents components
Why Microsoft is treating agents like insiders
Microsoft's framing is deliberate: it is describing AI agents inside a company's network as a new category of insider, something with real access to systems and data that needs continuous watching rather than a one-time sign-off. Terrell Cox, Corporate Vice President and Deputy CISO for Customer Security at Microsoft, put it plainly in the announcement: securing agents requires continuous visibility into agent activity. Guardian Agents are Microsoft's answer to that, security agents that work alongside human teams to explain risk changes, investigate what an agent did and why, recommend or apply containment, and help tighten policy so the same gap doesn't reopen.
Playbooks, permissions and a sandbox the agent can't escape
Several new pieces ship alongside Guardian Agents. Playbooks define the security outcome a team wants and coordinate the protective actions needed to get there. Dynamic Permissions give an agent only the access it needs for a specific task, limited in time, and can require a verified human approval before a high-impact action goes through. Dynamic Agent Risk continuously scores an agent using signals pulled from identity, data, endpoints, cloud, network, runtime and the agent's own activity, drawing on Microsoft Sentinel, Entra, Intune, Purview, Global Secure Access and Defender. Dynamic Conditional Access extends that scoring into action: a graduated response that can reduce an agent's permissions, isolate the environment it runs in, or stop its execution outright. Underneath all of it sits the Microsoft Execution Container, a sandbox that gives an agent policy-controlled access to the resources it needs while keeping the actual security controls outside the agent's own reach, so a compromised or misbehaving agent can't simply talk its way around them.
Finding agents nobody signed off on
A separate piece of the announcement is about visibility into agents that were never formally approved. Microsoft Entra Agent ID and Entra Conditional Access now cover more types of agent identities, including local agents and previously unknown ones that sensors pick up on their own. Microsoft Agent 365 feeds signals into Project Perception through a shared agent registry, and Defender for Endpoint's agent discovery grew by 35 additional local agent types, bringing its total to 60 supported local agents. Microsoft specifically named Claude Code, OpenAI Codex and GitHub Copilot among them, tools that plenty of developers already run inside corporate networks whether or not security teams knew about it. That matters because the risk isn't limited to chatbots; it extends to coding agents with repository access and, as agents move into higher-stakes systems like cars and other physical products, into decisions with consequences beyond a single screen. It's a different approach from Anthropic cutting off internet access for its own internal agent tests: Microsoft is betting on visibility and containment rather than removing network access outright.
Why Microsoft wants to be the auditor, not just the model maker
Nadella made the underlying argument explicit: "The most trustworthy agentic system will not be the one with the model we trust most." The point he's making is that control over what an agent can access and do should sit outside the AI model itself, enforced by deterministic controls the model can't bypass, rather than left entirely to the AI lab that built the model. That positioning carries some tension, since Microsoft is a close business partner of both OpenAI and Anthropic, yet is pitching independent, lab-agnostic monitoring as the safer bet for enterprises, a comparison TechCrunch drew to how financial auditors operate independently of the companies they audit. TechCrunch also reported that Microsoft was an inaugural member of Nvidia's Open Agent Safety Platform, an effort now backed by more than 100 companies.
What's confirmed, what's not, and who needs to act
Confirmed: the October 19, 2026 announcement of Guardian Agents and the Project Perception extension, the new Playbooks, Dynamic Permissions, Dynamic Agent Risk, Dynamic Conditional Access and Microsoft Execution Container components, the Defender for Endpoint expansion to 60 local agent types, and the quotes from Nadella and Cox, all tied to Microsoft's own Security Blog and Official Blog posts. Not announced: pricing and a general availability date for any of these features. The post references Microsoft Ignite, running November 17 to 20, 2026, as wider context, but it does not say these specific features ship at that event, so treat any Ignite launch date as unconfirmed until Microsoft says otherwise.
This affects enterprises and IT security teams already running Microsoft 365, Entra, Defender, Sentinel or Purview, plus any organization where employees are using AI coding or agent tools inside the corporate network, sanctioned or not. For those teams, the near-term change is visibility: more agent identity types get tracked, and tighter permission and containment controls become available once Microsoft ships them, though cost and timing for that remain open questions.
Primary reporting from the Microsoft Security Blog and the Microsoft Official Blog, with independent coverage from TechCrunch. Microsoft has not published pricing or a shipping date for Guardian Agents; confirm current availability before relying on it.
Frequently asked questions
What are Microsoft's Guardian Agents?
Guardian Agents are a new layer Microsoft announced on October 19, 2026 for its Project Perception security system. They are AI agents that explain risk changes, investigate incidents, recommend or apply containment, and help harden policy at machine speed, all under security rules that humans set.
What is Project Perception and how do Guardian Agents fit into it?
Project Perception is Microsoft's agentic security system for monitoring AI agents running across a company's network. Guardian Agents extend it with new components: Playbooks, Dynamic Permissions, Dynamic Agent Risk, Dynamic Conditional Access for agents, and a sandbox called the Microsoft Execution Container.
What do Playbooks, Dynamic Permissions and Dynamic Agent Risk do?
Playbooks define desired security outcomes and coordinate protective actions. Dynamic Permissions grant agents task-scoped, time-bound access that can require a verified human approval for high-impact actions. Dynamic Agent Risk continuously scores an agent using signals from identity, data, endpoints, cloud, network, runtime and agent activity, drawn from tools including Sentinel, Entra, Intune, Purview, Global Secure Access and Defender.
How many AI agents can Microsoft Defender for Endpoint now detect?
Microsoft expanded Defender for Endpoint's agent discovery by 35 additional local agent types, bringing the total to 60 supported local agents. Microsoft named Claude Code, OpenAI Codex and GitHub Copilot among the agents it can now detect running inside a corporate network.
Is there pricing or a release date for Guardian Agents?
No. Microsoft has not announced pricing or a general availability date for Guardian Agents, Playbooks, Dynamic Permissions, Dynamic Agent Risk, Dynamic Conditional Access for agents, or the Microsoft Execution Container. The announcement references Microsoft Ignite, running November 17 to 20, 2026, as broader context, but it does not state that these specific features ship at that event.
Why does Microsoft say trust shouldn't rest only on the AI model?
Microsoft CEO Satya Nadella said the most trustworthy agentic system will not be the one with the model people trust most. His argument is that control over what an agent can access and do should sit outside the AI model itself, enforced by deterministic controls the model cannot bypass, rather than left to the AI lab that built the model.