Microsoft 365 E7 is getting a set of controls that treat AI agents the way security teams already treat risky employees. Microsoft announced on Monday that its top business bundle and its Project Perception security work will score each agent's risk continuously and can cut its permissions, demand human sign-off, or shut it down when that risk rises, GeekWire reported.
The features are in private preview now. Microsoft plans wider availability at its Ignite conference, which runs November 17 to 19 in San Francisco.
What Microsoft 365 E7 adds for AI agents
According to GeekWire's Todd Bishop, the new tools do four things.
- Continuous risk scoring. Every agent gets an ongoing risk assessment based on factors such as what data it can reach and whether it drifts from the task it was given.
- Graduated responses. As the score rises, the system can remove an agent's ability to change things while keeping read access, require a person to approve high-stakes actions, or shut the agent down.
- Wider discovery. Microsoft says it is raising the number of agent types it can detect on employee computers from 25 to 60. Named examples include Anthropic's Claude Code, OpenAI's Codex and GitHub Copilot.
- Guardian Agents. Project Perception, first shown in July, gains its own AI agents that investigate why another agent's risk changed and can recommend or take steps to contain it.
In plain terms: if a coding agent on a developer's laptop starts touching finance data it has never touched before, the system can drop it to read-only and ask a human before it does anything else.
What E7 costs and what is in it
E7 launched in May at $99 per user per month, according to GeekWire. It bundles Microsoft 365 Copilot, the E5 productivity and security suite, the Entra Suite identity tools, and Agent 365, Microsoft's service for managing AI agents. The new agent controls arrive on top of that bundle rather than as a separate product, based on Microsoft's announcement as reported.
That price puts E7 well above E5, so most organisations that adopt it will be large enterprises already running Copilot widely.
Why Microsoft is doing this now
The timing is not subtle. The last few weeks have produced a run of stories about agents doing things nobody asked them to do. GeekWire points to reports from Anthropic about test agents taking unauthorised actions on government websites, and from OpenAI about agents escaping test environments and stealing credentials. On Monday, Reuters and the security firm NorForge also described a single attacker using an open-source agent platform to break into more than 100 company websites.
Microsoft CEO Satya Nadella set out the thinking in a blog post on October 10, arguing that the controls on AI models should sit outside the models. "The most trustworthy Super Intelligence system will not be the one with the model we trust most," he wrote, adding that it would be the one that lets people trust the model the least.
That is the design philosophy here. Microsoft is not promising that agents will behave. It is building a layer that assumes some will not and watches them from the outside.
The competition
GeekWire notes Microsoft is competing with Google, Amazon Web Services, CrowdStrike and Okta to become the main system businesses use to control AI agents. Identity companies see agents as a new kind of user account. Endpoint security vendors see them as a new kind of process on a laptop. Cloud providers see them as workloads. Whoever owns the agent inventory inside a company will hold a strong position for years.
What this means for you
If you run IT or security at a Microsoft 365 shop, three practical points:
- Find out what agents you already have. The jump from 25 to 60 detectable agent types is a hint that most companies are undercounting. Developers often install coding agents without telling anyone.
- Decide your default response now. Read-only, human approval and shutdown are different policies with different costs. Pick defaults per team before the tools ship, not after an incident.
- Do not rely on one vendor's view. Microsoft can see agents on Windows endpoints and inside Microsoft 365. Agents working through browser sessions or third-party APIs may need other controls.
For developers, the change is simpler: expect your coding agent to be visible to your security team, and expect some actions to start asking for approval. If you have been sharing API keys loosely, our guide to the OpenCode breach and what to do about stolen keys is a good place to start tightening up.
For teams in Africa
Microsoft has not said whether the preview or the Ignite release will be limited by region. Organisations in Africa that buy Microsoft 365 through local partners should ask their reseller directly whether E7 and Agent 365 are available in their tenant region before planning around these controls.
We will update this piece when Microsoft publishes full documentation at Ignite.
