Microsoft extends Project Perception to monitor and contain AI agents

In a post published October 19, 2026, Microsoft said it is extending Project Perception to secure AI agents operating inside organizations. The system combines Project Perception with Microsoft Agent 365 signals, context and a shared registry intended to give IT and security teams a consistent view of agents and their risks.

Microsoft says these agents are not inherently malicious. The concern is that software with access to important systems can make mistakes, be manipulated or become compromised while operating continuously and at machine speed.

An agent's output can vary as its context, inputs and plan change. That means an agent behaving as intended at the start of a task may act differently later, while a delay in detection can allow damage before a person finishes investigating.

Identity and authority stay outside the model

Microsoft recommends placing access, action and continuation controls outside the model so the model cannot bypass or alter them. It also says each agent should have an identity distinct from the person who created, uses or sponsors it.

Microsoft is extending Entra Agent ID to cover additional patterns, including local agents and previously unknown agents found by security sensors. A distinct identity lets an organization attribute actions, assign ownership, manage permissions and distinguish a person's activity from work an agent performed on that person's behalf.

Visibility is another part of the problem because agents may originate in Microsoft products, partner platforms, software development kits or local installations with no central deployment process. Microsoft Security uses integrations, connectors and sensors to discover more of that agent population.

Controls follow the agent's tools and data

Microsoft advises organizations to mediate an agent's calls to tools, APIs, Model Context Protocol servers, resources and other agents. Those controls should inspect both the destination and the information moving through the connection, including sensitive data, its origin and whether untrusted content may be influencing the agent.

New Playbooks define a desired security outcome and coordinate protective actions, while Guardian Agents carry out that work as activity, risk and policy change. People retain responsibility for policy, approval boundaries and delegation rules.

Microsoft's account does not specify rollout dates, licensing or whether every announced capability is generally available. Organizations therefore need to confirm product availability before treating the design as an immediately deployable control set.