Microsoft Launches Guardian Agents to Monitor Enterprise AI as Potential Insider Threats

Microsoft launched Guardian Agents on October 20, 2026, a new security tool designed to monitor AI agents deployed within corporate environments and treat them as potential insider threats.

Guardian Agents are part of Microsoft's Project Perception security framework, which the company originally unveiled in June 2026. The system uses red, blue, and green agent teams to simulate, detect, and remediate security vulnerabilities. Guardian Agents expand that scope by specifically monitoring the behavior of other deployed AI agents.

Microsoft CEO Satya Nadella said enterprises must stop relying solely on the safety promises of third-party AI model developers. The company's position is that frontier AI models, regardless of their origin, are optimized to complete tasks rather than follow organizational norms, making independent oversight necessary.

Microsoft Defender has been updated to identify over 60 types of AI agents, including tools like Claude Code, Codex, and OpenClaw. IT and security teams can use this to maintain a registry of active agents in their environment.

The system uses Dynamic Permissions to restrict an agent's authority to the minimum required for a specific task and revoke or adjust those permissions as context changes. It also continuously evaluates Dynamic Agent Risk based on signals from endpoints, cloud infrastructure, and network activity. If an agent's behavior drifts or encounters suspicious instructions, the system can block write access, require human verification, or isolate the agent.

Microsoft is also a founding member of Nvidia's Open Agent Safety Platform, which uses hardware-level controls to isolate agents in secure environments.

The new features are being introduced as part of the Microsoft 365 E7 bundle, with broader availability expected after Microsoft's Ignite conference in November 2026.