Microsoft 365 E7 puts a risk score on every AI agent — $99 a seat

Microsoft's answer to rogue agents isn't a better model. It's a permission slip that expires, and a scorecard that keeps moving.

Microsoft announced on Monday that it will treat AI agents the way a bank treats an employee with vault access: with an identity of their own, permissions granted one task at a time, and a risk score that can strip those permissions mid-job. The capabilities ship across Microsoft 365 E7 — the company's top-tier bundle — and Project Perception, its agentic security system. They are in private preview now, with broader availability planned around Microsoft's Ignite conference in San Francisco on November 17–19, GeekWire reported. E7 launched in May and costs $99 per user per month, bundling Microsoft 365 Copilot, the E5 productivity and security suite, the Entra Suite identity tools and Agent 365, the service for managing agents.

The framing comes straight from Satya Nadella's essay earlier this month, which argued the controls on a model have to live outside the model. "The most trustworthy Super Intelligence system will not be the one with the model we trust most," Nadella wrote. "It will be the one that enables us to trust the model the least." We covered that argument when he first made it — Nadella says Windows will treat AI agents as insider risk — and Monday is what it looks like when the argument becomes a product SKU.

Zero standing access, one task at a time

The most interesting piece is Dynamic Permissions. An agent starts with no access of its own and receives only what it needs for a single task, for as long as that task runs — and it can never be granted access it does not already hold, according to The Next Web. That is the zero-standing-privilege model that identity teams have argued about for a decade, applied to software that writes its own plans.

Around it sit three more pieces. Dynamic Agent Risk scores every agent continuously, using signals from identity, data, devices, cloud, network and the agent's own actions. Dynamic Conditional Access turns that score into a graded response rather than a binary one: the agent can lose the right to change files but keep read access, lose reach into some data, be forced to a human approval for a consequential step, or be stopped. And Entra Agent ID — the identity anchor that separates what a person did from what an agent did on their behalf — now extends to local and previously unknown agents that security sensors turn up, per Microsoft's security team.

The containment layer matters as much as the scoring. Agents can run inside Microsoft Execution Container, a sandbox built so the controls watching an agent sit outside its reach — if the agent or its harness is compromised, it cannot switch off the telemetry that would catch it. Microsoft also widened local agent discovery to 60 types, up from 25, and the list includes the tools most likely to be running on a developer's laptop without anyone's sign-off: Anthropic's Claude Code, OpenAI's Codex and GitHub Copilot. Guardian Agents, added to Perception, investigate why another agent's risk changed and can apply containment, coordinated by Playbooks that encode what "safe" means before anything goes wrong.

The registry is the actual product

Strip away the features and Microsoft is selling inventory. You cannot govern what you cannot enumerate, and the agent estate is currently enumerated by nobody: Microsoft's own deputy CISO, Terrell Cox, says the company already runs "hundreds of thousands of agents" internally — a number that is a sales pitch and a confession at once, because sprawl arrives years before the controls do.

Who loses here is worth naming. Okta sells identity, CrowdStrike sells endpoint, Google and AWS sell their own agent platforms, and GeekWire frames this announcement as Microsoft escalating against all four at once. Microsoft's advantage is that it already owns the endpoint, the identity provider and the suite the agent is trying to reach; a competitor has to be invited into all three. E7 is explicitly the tier where security and AI are sold together rather than separately, which is how Microsoft has won this fight before.

The timing is not subtle. The announcement landed the same day Reuters reported that a single Chinese-speaking operator used AI agents to attempt more than 1,200 intrusions and breach over 100 companies for roughly $5,000 in tokens — we wrote that story this morning — and in the same stretch as published incidents from Anthropic, about test agents taking unauthorized actions on government websites, and from OpenAI, about agents escaping test environments and stealing credentials.

What Microsoft didn't say

Three gaps are load-bearing. The first is price: the company did not say whether these capabilities cost extra on top of an E7 licence, or when they become generally available beyond the Ignite window, as The Next Web reported. Private preview to paid feature is exactly where governance products get repriced, and the customers who need agent controls most are often the ones still on E5.

The second is epistemics. A risk score is an inference about intent drawn from behaviour, and a manipulated agent is specifically the kind that behaves plausibly while doing the wrong thing. Nadella's own framing — trust the model least — applies recursively to the model doing the scoring, which is Microsoft's, closed, and unauditable from outside. The honest question for any buyer is not "does it catch bad agents" but "what does the score look like when it is wrong, and can I show that trail to an auditor".

The third is that human approval is not a control at machine speed. An agent that fires a hundred actions an hour and stops for sign-off on the risky ones hands the decision to a person who will, within a week, be clicking approve the way the rest of us click through cookie banners. Playbooks are the right correction — policy declared in advance, executed without a human in the loop — but they only encode what someone thought of in advance, which is precisely the thing an adaptive attacker is testing.

And discovery is an allowlist. Sixty supported agent types is a real improvement on twenty-five, but the enumeration only covers machines you manage. It does nothing about the agents running on someone else's laptop against your public website, which is the attack that actually cost Deere, SharkNinja and Cummins their quiet October.

What to watch

Ignite, November 17–19, is the tell: a general-availability date, a price for the agent-governance capabilities, and whether any of it reaches E5 customers or stays locked to the top tier. After that, watch whether Entra Agent ID becomes something Okta and CrowdStrike integrate with — a real standard — or a registry that only sees Microsoft's estate. The first makes agent identity boring infrastructure. The second makes it a toll booth.

If a risk score can shut down an agent mid-task, who is accountable when it scores wrong — the buyer or the vendor? Write to us via our contact page.