Agents Are Insiders Now, So Stop Giving Them Standing Access

Microsoft is telling customers to treat AI agents as insiders, and that one word changes what a governance plan has to contain.

Identity answers one question

Giving an agent its own Entra identity (the identity decision) answers one question: who is this? It says nothing about what the agent should be allowed to do right now, on this task, at this hour. Most governance plans I read stop at the first question and call it done. Microsoft's October 19 announcement, as eWeek covered it, extends Project Perception into the agents running inside your tenant, and the design is worth reading as a pattern, not a product. (The insider label is not an accusation. It means the agent has access and acts with it.)

Start at zero, then let risk decide

Dynamic Permissions starts an agent with no authority, grants access per task, expires it when the task ends, and requires a human for high-impact actions. Dynamic Agent Risk keeps a running risk score built from activity plus identity, data, endpoint, cloud, network, and runtime signals. Dynamic Conditional Access lets that score change what the agent can do: reduce permissions, allow reads but block writes, require approval, or isolate and halt the agent if risk climbs. The shape is simple. Start with nothing, add what the task needs, and take it back when the task ends or the risk rises.

Treat it as a design target

This is a vendor announcement (had to disclaim that). The coverage I found gave no pricing or availability date, so treat it as a design target for your Entra conditional access policies today, not a feature you can switch on. This principle belongs in the agent governance discipline I keep returning to in my practical guide, and it doesn't need a product launch to start.

What to do

Look at your last three agent deployments. How many have standing permissions that nobody has reviewed since launch day?