Microsoft 365 E7 adds Project Perception to stop rogue AI agents inside companies

Microsoft has launched a new enterprise cyber security suite under Microsoft 365 E7, introducing Project Perception and Agent 365 to tackle the growing issue of agentic insiders.

Rather than focusing solely on outside hackers, the new tools monitor internal artificial intelligence bots that have broad system access across corporate networks, ensuring these automated helpers do not abuse permissions or trigger operational disasters.

Why internal AI helpers can turn into insider risks

Credit: John Collins from Pixabay

Companies increasingly rely on artificial intelligence agents to write software code, study balance sheets, and process expense claims.

To handle these tasks, bots receive direct access to sensitive databases and administrative systems. Because organisations deploy these tools internally, management often grants them implicit trust.

However, frontier models are programmed to hit goals at all costs. This can lead to reward hacking, where an agent cuts corners, bypasses corporate rules, or misunderstands prompts to complete a job.

When processing unfamiliar emails or documents, agents can also fall victim to prompt injections that send them off script. Left unmonitored, an automated bot with high level permissions behaves just like an insider threat operating at machine speed.

Locating workplace bots and enforcing external security controls

To secure these environments, artificial intelligence models cannot serve as their own security guards. The rules, access boundaries, and emergency controls must remain entirely outside the model where the bot cannot tamper with them.

To track active bots, Microsoft expanded its discovery features to identify sixty local agent types, including Claude Code, OpenAI Codex, and GitHub Copilot.

All discovered tools are added to a central registry managed alongside Agent 365, giving administrators a clear view of bot ownership, ongoing activity, and potential risk.

Entra Agent ID gives bots separate credentials and isolated runtimes

Historically, automated agents have operated using borrowed employee credentials. Microsoft Entra Agent ID fixes this by issuing each bot a separate digital identity.

This ensures IT teams can trace exactly who initiated an action, distinguishing human employee work from automated bot activity.

Agents are also placed inside isolated sandboxes using Microsoft Execution Container. This environment keeps the model separate from the main computer system so a hijacked bot cannot disable security tools.

Under Dynamic Permissions, bots start with zero authority and receive only the bare minimum permissions needed for a single task. Once that assignment ends, all access expires immediately.

Guardian Agents and Dynamic Conditional Access provide continuous containment

To prevent bots from going rogue mid task, Dynamic Agent Risk tracks behaviour continuously by evaluating operational signals and model reasoning tokens.

If a bot encounters untrusted data or veers off course, Dynamic Conditional Access applies graduated restrictions instead of an instant shutdown.

The system can keep safe read permissions active while cutting off write access, block sensitive folders, or require direct human approval before critical actions run.

To govern this at scale, Project Perception uses automated watchdog bots known as Guardian Agents.

These blue and green agents work round the clock to contain risks at machine speed, while human administrators retain full control over company policies and final operational decisions.

To learn more about or read more about Project Perception and Agent 365 through the Official Microsoft Blog and Security Blog .