Explain This: Microsoft's Agentic AI Security Strategy
Microsoft's new AI security controls address the unique risks of autonomous agents that make decisions without human approval.
Explain This: Microsoft's Agentic AI Security Strategy
Agentic AI systems make decisions and take actions without waiting for human approval. That autonomy creates a security problem traditional tooling wasn't built to solve. Microsoft's latest Defender, Entra, and Purview updates target this gap.
What it is
Agentic AI executes actions autonomously based on its training and context. Unlike standard AI that recommends ("You should approve this expense"), agentic AI acts ("I approved the expense"). Microsoft's new controls add three layers:
Identity-bound agent policies (Entra). Each AI agent gets its own identity profile with policies that restrict which APIs it can call, what data it can access, and which actions require human approval. Think of it as RBAC for robots.
Real-time agent activity monitoring (Defender). Behavioral baselines tailored to agent activity patterns. The system flags when an agent deviates from its declared purpose, accesses unusual data volumes, or attempts privilege escalation.
Data lineage for agent decisions (Purview). Full audit trails showing which agent accessed what data, what decision it made, and what action resulted. Compliance teams can reconstruct the reasoning chain.
Why it matters
Standard IAM assumes humans make requests. When an AI agent provisions cloud resources, traditional controls can't distinguish between legitimate automation and privilege escalation. The agent can grant itself broader permissions if its logic allows it.
Decision chains obscure accountability. When Agent A calls Agent B, which calls a cloud API, audit logs show the API call but not the reasoning. Incident response teams can't reconstruct "why did this happen?" without agent-specific telemetry.
Lateral movement happens at machine speed. A compromised agent with cross-system access can exfiltrate data across SaaS platforms faster than SOC teams can detect the anomaly. Human-paced threat hunting doesn't catch it.
Where teams screw up
Treating agents like privileged users. Organizations assign agents the same permissions as their human operators. An agent running under a DevOps engineer's identity inherits full production access. No secondary controls exist.
Skipping behavioral monitoring. Teams deploy agents without establishing baselines for normal activity. When an agent starts making 1,000 API calls per minute (exfiltration indicator), no alert fires because "it's just automation."
Ignoring decision lineage. GDPR Article 22 restricts automated decision-making about individuals. If your AI agent denies a loan application, you must explain why. "The model said so" violates the regulation. Without decision logging, you can't comply.
What "reasonable" looks like
Agent-specific IAM policies. Create identity profiles for agents in your IdP. Apply least-privilege policies. Require multi-step approval for sensitive actions (deleting resources, granting permissions, accessing PII).
Behavioral baselines and anomaly detection. Use UEBA tooling or equivalent to baseline normal agent activity. Alert on deviations: unusual API calls, data volume spikes, access to resources outside the agent's declared scope.
Full decision audit trails. Log which agent accessed what data, what decision it made based on that data, and what action resulted. Retention policies must meet your industry's compliance requirements (7 years for HIPAA, indefinite for certain legal holds).
Risk assessments that include agentic scenarios. Add these to your threat model: compromised agent, logic error causing data deletion, unauthorized privilege escalation. Update incident response playbooks with agent-specific procedures.
What to do this week
- Audit current agent deployments. List every AI system with write access to production data or APIs. Document their permissions, data access scope, and approval workflows. Identify gaps.
- Configure agent-specific policies in your IdP. If you use Entra, enable the new agentic AI controls. If not, create custom policies that restrict agent API access and require approval for high-risk actions.
- Enable behavioral monitoring. Turn on Defender's agentic AI module or configure your SIEM/UEBA to baseline agent activity. Set alerts for privilege escalation attempts and unusual data access.
- Document decision lineage. Use Purview or equivalent DLP tools to log agent data access and resulting actions. Verify logs capture the full decision chain (data input → decision → action).
- Update incident response playbooks. Add "compromised agent" as a distinct scenario. Include steps for halting automated pipelines, isolating affected systems, and forensic analysis of agent-generated artifacts.
Agentic AI isn't just automation. It's autonomous decision-making at scale. Security controls built for humans don't transfer. Microsoft's updates acknowledge that gap. Whether your organization uses their stack or a different one, the principle applies: agents need their own security model.
