Note
Access to this page requires authorization. You can try signing in or changing directories.
Access to this page requires authorization. You can try changing directories.
Enterprise security has always been built around two actors: people and applications. A person exercises judgment but works one step at a time and can be asked to confirm before acting; an application has no judgment and does only what it was configured to do. An agent is neither. It reasons and chooses its own tools like a person, yet acts on its own and at machine speed like software, and it can be turned against its task by content an attacker plants in its path. Securing something that selects its own next action, at that pace, isn't a variation on what came before.
Microsoft Agent 365 answers that by extending the security model an enterprise already runs to cover agents. Every agent is given its own identity in Microsoft Entra, and the same services that protect people and applications then govern, monitor, and defend it. That identity is what a policy attaches to, what an investigation traces, and what a restriction applies to.
Familiar risks, unfamiliar speed
The threats themselves aren't new. Unauthorized access, excessive permissions, data leakage, compromised identities, and suspicious behavior are problems security teams have handled for years. What's different is that the safeguards for them assume a human tempo: a checkpoint, a review, a moment for someone to notice. An agent runs a sequence of actions across every system it can reach, with no pause built into it. A familiar risk can play out end to end in the time those safeguards would have taken to surface it.
New attack surfaces
Because an agent processes instructions and acts on them, it opens exposures a static application never had. Prompt injection is the clearest example: adversarial content hidden in a document, email, or webpage the agent processes can hijack what it does next, turning a helpful assistant into an attacker's tool. Excessive agency is another: an agent granted more power than its task needs can take actions well beyond it. These risks are specific to AI, and the damage is larger, because one manipulated agent with broad access can touch many systems before anyone notices.
Where old controls break
Even the right controls go stale. An agent's permissions drift as its use cases expand and its behavior evolves, so a review that showed it was safe last quarter says little about today. Keeping up means treating each agent as an actor in its own right, with an identity, observable behavior, and enforceable limits, rather than as invisible automation running outside the security operations center.
Where enforcement has to happen
Real-time detection itself isn't new; security tools already watch users and applications as they work. What differs is what has to be watched, and when. For a person or an application, the revealing moments are familiar: a sign-in, a download, a configuration change. For an agent, the equivalent moment sits between the input it processes and the tool call that follows, with no human step separating the two. Controls have to evaluate the content an agent receives, the tools it invokes, and the data it accesses, and enforce at the point of the call rather than after it. That requirement is what Agent 365 is built around: because each agent carries its own identity, its limits travel with it to the moment it acts.
Watching agents more closely doesn't solve this. An enterprise solves it by making each agent an identity it can govern, so capability and control grow together instead of trading against each other. Agent 365 makes that identity the unit of governance, which is what turns a fast-moving population of agents into something an organization can hold to a standard.