Microsoft 365 E7 expands AI-agent security with Dynamic Permissions, Dynamic Agent Risk and Dynamic Conditional Access

On Oct 30 Microsoft disclosed new M365 E7 security controls for autonomous agents: Dynamic Permissions (scoped, time-limited per-task access instead of inheriting user rights), Dynamic Agent Risk and Dynamic Conditional Access (risk-based controls that limit access, block actions, require approval, or stop an agent), plus Entra Agent ID extension so more agents get their own identity and discovery extended to ~35 more local agent types (total ~60, incl. Claude Code, OpenAI Codex, GitHub Copilot). Guardian Agents and Playbooks in Project Perception now investigate risk changes and auto-act.

It is Microsoft's most concrete productized push to treat internal agents as a new insider-risk class with adaptive, non-static access control — directly addressing the over-privilege problem as agentic deployments scale across the enterprise installed base.

Security and IT leaders on M365 E7 should evaluate Dynamic Permissions/Risk/Conditional Access when inventorying agents and mapping entitlement, and pilot Entra Agent ID for agent identity governance; watch rollout status as several components remain in preview.