Microsoft extends employee risk monitoring tools to AI agents

Microsoft announced on October 19, 2026, that its internal risk management tools, originally designed for employees, will now apply to AI agents deployed in Microsoft 365 or on staff devices. According to Nadim Abdo, Microsoft's vice president for identity and network access, each agent will receive a unique identity and be listed in a centralized registry. Access rights will be dynamically adjusted based on a continuous risk assessment, which could lead to blocking, human validation, or agent shutdown.

These features, already available for employees via Microsoft Purview, have been extended to agents since summer 2026. They require at least a Microsoft 365 E7 license (€91.92/month in France) or Agent 365 (€13/month). The October 19 updates, described as private previews, will be expanded at Ignite (November 17-20). Microsoft now identifies 60 types of local agents on Windows, including Copilot, Codex, and Cursor, via Defender for Endpoint—but only on enrolled devices.

This move aligns with a broader strategy outlined by Satya Nadella on October 10, emphasizing the need to trace every agent action for tamper-proof security. Companies will need to adjust their licensing and security policies to incorporate these new controls, though thresholds and calculation methods remain undisclosed.