CISA baseline tells federal agencies to block high-risk Microsoft 365 AI agents

CISA has added a Microsoft 365 security rule telling covered US federal agencies to block AI agents Microsoft flags as high risk. The catch is that the free checking tool identifies gaps, but agencies must configure separate, paid Microsoft controls to enforce the block.

Microsoft AI Watch analysis

What happened

The rule appears in version 2.0.0 of CISA’s ScubaGear tool, which checks Microsoft 365 configurations against the agency’s cloud-security baselines. It applies to covered federal civilian executive branch agencies; private organisations can use the baseline voluntarily. It does not cover Microsoft’s Government Community Cloud High or Department of Defense environments.

The requirement targets agents using their own identities in Microsoft Entra. Microsoft assesses risk using signals such as sudden increases in sign-ins, attempts to access unfamiliar resources and unauthorised directory searches. Administrators must apply the policy to agent identities and cloud resources, then configure Microsoft’s access controls separately: ScubaGear flags gaps but does not change settings or disable agents.

The controls require paid Microsoft identity and agent-management features. The baseline lists Entra ID P2 alongside Microsoft Agent 365 or Microsoft 365 E7, and labels the agent-risk condition a preview feature. The policy does not cover agents acting through an employee’s sign-in, where risky activity is attributed to that user instead.

Why it matters

This is a concrete step towards putting limits around AI agents that can access workplace files and applications. But it is not a magic off-switch supplied with a free CISA download: agencies need the relevant subscriptions and configuration, and the risk signal is assessed after activity occurs. The policy therefore cannot guarantee that an agent’s first harmful action will be blocked.

Our read

The useful bit is that CISA’s baseline gives administrators a specific control to check, rather than another general instruction to “secure the agents”. The less comforting bit is that detection follows activity, enforcement needs paid Microsoft features, and the key condition is still marked preview. For agencies in scope, this belongs on the configuration checklist, with those limits kept firmly beside it.

What to watch

• Whether Microsoft takes the agent-risk condition out of preview.
• How covered agencies configure and enforce the control in practice.
• Whether CISA or Microsoft expands coverage to other agent identities or environments.

Discussion spark: Should government agencies accept a control that detects risky AI-agent behaviour after activity has happened, or is that too late to count as meaningful protection?

not affiliated with or endorsed by Microsoft