Microsoft’s CISO advice for keeping enterprise AI agents in check

As AI agents gain access to company data and the ability to act across workplace systems, Microsoft is urging security teams to govern each agent’s identity, permissions and behaviour. Its practical message for businesses: know what agents can reach, and bring security teams into the conversation before building them.

Microsoft AI Watch analysis

What happened

In a Microsoft Security blog published on 28 October, Microsoft’s corporate vice-president of security sets out two challenges for CISOs: protecting organisations as they adopt agents, and adapting defences as attackers use AI to move faster. Microsoft says active agents in its Microsoft 365 ecosystem grew 15-fold year on year, and 18-fold in large enterprises, citing its Work Trend Index.

The guidance starts with the basics. Give agents governed identities rather than personal or shared credentials, limit their access to what they need, and protect the data they can reach. Microsoft also recommends tracking which agents exist, who owns them, what they can access and what they are doing, so teams can spot changes in behaviour and intervene.

Why it matters

An agent is not just another account to add to a spreadsheet. It can use the permissions it has to interact with applications and company data, without sharing a person’s judgement about what is appropriate. Identity, access and visibility therefore shape what an agent can do, and how quickly a security team can work out what happened if something goes wrong.

For defence, Microsoft argues that signals from identity, endpoints, applications and cloud systems need to be brought together, with threat intelligence and organisational context. It also sees agents assisting analysts with investigation and response. That is a direction of travel, not evidence that every organisation already has those systems working together.

Our read

The useful part here is refreshingly unglamorous: establish who owns an agent, give it its own identity, restrict its access and watch what it does. That is a better starting point than hoping an agent will politely stay within the lines. Microsoft’s recommendations are an industry perspective, but they give security teams concrete questions to put to builders before an agent reaches company data or tools.

What to watch

• Whether organisations assign agents distinct, governed identities and limit their permissions.
• Whether security teams can see who owns each agent, what it can access and what it is doing.
• How effectively companies connect security signals across identity, endpoints, applications and cloud systems.

Discussion spark: Should companies be allowed to deploy workplace agents before security teams can identify, limit and monitor them, or would that slow useful experimentation too much?

not affiliated with or endorsed by Microsoft