Microsoft introduced Guardian Agents and new Defender controls to help enterprises monitor workplace AI agents, manage access and require approval for risky actions.
Microsoft announced new enterprise security features on October 19, 2026, aimed at monitoring and controlling AI agents used at work. The additions include Guardian Agents, a capability intended to oversee an organization’s agents, and new agent-detection and permission controls in Microsoft Defender.
Guardian Agents are part of Project Perception, which Microsoft introduced in June. The earlier project used three agent roles for security work: a red team to simulate attacks, a blue team to detect and assess vulnerabilities, and a green team to address issues. The new monitoring capability reflects a broader concern raised by Microsoft leaders: risks may come not only from outside attackers, but also from agents that employees authorize to access company systems.
Microsoft says its Defender feature can identify as many as 60 types of agents employees bring into the workplace, including Claude Code, Codex and OpenClaw. Additional controls can limit agent access to data and systems, adjust permissions according to the task, and require human approval when an agent appears to be making a risky decision.
The company’s argument is that agents can be given access to sensitive information and the ability to take consequential actions, while their behavior may not reliably match an organization’s norms or judgment. Microsoft security chief Hayete Gallot described frontier models as unpredictable; her warning was about the need for oversight, not a claim that every model is malicious or easily compromised.
The approach also puts Microsoft in the role of selling tools to govern agents made by other providers, including companies with which it has business relationships. The security features are intended to place monitoring and control with the enterprise rather than relying solely on assurances from the model provider. For organizations adopting agents, the practical focus is on visibility, least-necessary access and a human checkpoint for actions flagged as risky.