Microsoft adds SI agent controls to Microsoft 365 E7: zero access by default, separate identities, supervisor agents
Prepared by Sintelligent with the help of SI. Published in SI: . Updated: .
Companies get a way to give agents exactly the permissions a task needs, and to keep watch over them.
According to Microsoft, an agent gets zero access, and only for the duration of a specific task (dynamic permissions); risk is assessed continuously from signals about the agent's identity, data, devices, network and behavior. Entra Conditional Access for agents can, for example, remove the right to change files while keeping read access, require human confirmation, or stop the agent. The definition of agents has been expanded by 35 types (60 in total), including Claude Code, Codex and GitHub Copilot; each agent is assigned its own Entra Agent ID; "guardian agents" (Guardian Agents) in Project Perception, the company says, "watch every action of every agent before it is executed." TechCrunch recalls that Project Perception was introduced in June as a response to hacking models, built on the assumption of attacks from outside, and that Microsoft now warns the agents companies use themselves can also pose a danger. The announcement gives no dates or prices.