Microsoft told enterprises this week that their own AI agents are the bigger risk, not outside hackers. On 19 October, its security team shipped what it's calling the "agentic insider" framework: agent discovery, risk scoring, and permissions that shrink automatically. It treats every deployed agent like a new hire you haven't earned trust with yet. If you're running a scoped WhatsApp bot instead of a Copilot fleet, the headline isn't really about you. The principle underneath it already is.
What is Microsoft's "agentic insider" framework?#
Microsoft's security chief, Hayete Gallot, wrote plainly that "frontier models cannot be trusted." The problem isn't malice, in her framing. It's unpredictability.
The company shipped this under Project Perception, which launched back in June. Agent discovery now spots up to 60 types of agents employees bring into the workplace on their own, including Claude Code, Codex, and GitHub Copilot. A Dynamic Agent Risk score tracks each agent's behavior, and Dynamic Conditional Access strips permissions as that score climbs: first write access, then higher-impact actions, then the agent's runtime gets isolated. CEO Satya Nadella had already argued, in an October 10 essay, that companies should "separate the supply of intelligence from the authority over it." Full details are in TechCrunch's writeup and SiliconANGLE's breakdown of the rollout.
The five pieces, roughly:
- Agent discovery across up to 60 agent types, each getting its own identity in Entra
- A Dynamic Agent Risk score built from identity, endpoint, and network signals
- Dynamic Conditional Access that strips write access, then runtime, as risk climbs
- Dynamic Permissions scoped to a single task's duration
- A Microsoft Execution Container, a sandbox the agent can't see or disable
Does this change anything if you're running a WhatsApp bot, not a Copilot fleet?#
Mostly not, directly. If you're sending a couple hundred automated conversations a month through a lead-qual bot or an n8n flow, you don't have 60 different agent types roaming your network. Microsoft 365 E7 isn't a line item you're adding this quarter either. This is built for enterprises with real agent sprawl, the kind of containment gap we've written about before in CIO surveys out of the GCC.
What you can't skip is the question it's forcing everyone to answer. What is your agent actually allowed to touch, and who signs off before it touches something risky? That question scales down fine. We've been answering it on client builds since before Microsoft gave it a name.
The honest trade-offs#
Containment is good practice and also a drag. Human-approval gates slow down exactly the automation you built to be fast. If every risky action needs a person to click approve, you've reintroduced the bottleneck the bot was supposed to remove.
Microsoft gave no availability date or pricing for most of this, and more detail is promised at Ignite in November, so today it's a direction, not a shipped product you can test yourself. My honest read: risk-scoring the agent is the right idea, but a score that drifts slowly is a weaker signal than someone actually watching the logs in week one. We got that wrong on an early build ourselves. We trusted an automated flag to catch everything, and it didn't, until we added a human spot-check on top of it.
How we're already building around this#
We don't run Copilot fleets, but we build the pattern Microsoft is now formalizing. At WebEpex we gave a WhatsApp lead-qualification bot we shipped for a Dubai real estate agency this month a narrow job on purpose. Its access stops at new-listing broadcasts, lead categorization, and human-toned follow-ups, with no wiring into the client's CRM or listings backend, because that's not the job it needs yet.
Every n8n automation we build for clients gets exactly the API and data access its task requires, nothing standing beyond it. Anything that would change a client record outright still routes through a human step before it fires, the same scoped-access idea behind the personal agent protocol work Meta and Sierra opened up, just sized for a ten-person business instead of an enterprise fleet.
That's not a Dynamic Risk Score. It's the same principle, running at the size most of our clients actually operate at.
What should I do about this this week?#
If you're already running automation, a chatbot, an n8n flow, anything that acts without you clicking send, list what it can actually touch. Not what you assume it can touch. If it can write to a database or message a customer on your behalf with zero human step before the risky actions, that's the gap Microsoft is describing, just at your scale instead of theirs. You don't need their product to close it. You need to actually check, this week, not after something breaks.
If you're not running anything agentic yet, this changes nothing about your week.
I'll be watching what Microsoft adds at Ignite in November. Folding chain-of-thought signals into the risk score, not just behavior, is the part that would make this genuinely useful instead of a lagging indicator. It's the same gap we flagged in Microsoft's Decision-1 routing model last week. Until then, if you want a second pair of eyes on what your own bot or workflow is actually allowed to do, send me what you're running and I'll tell you straight. Two minutes, no pitch. [cal.com/webepex/growth-review]
