Microsoft Expands Agent Discovery and Proposes Task-Scoped Access

Microsoft says it is expanding discovery to 60 types of local AI agents, including Claude Code, OpenAI Codex and GitHub Copilot, and describes new identity and task-scoped access controls. The new coverage adds 35 supported types. Those numbers refer to agent types; enumerate the installations and credentials in your own environment.

An expense-approval assistant illustrates the problem. It needs to read claims and approve routine reimbursements. An untrusted document can change the action it attempts mid-task, while inherited employee permissions may let it act well beyond that workflow. Microsoft proposes distinct Entra Agent ID identities, Dynamic Permissions and risk-responsive Conditional Access to restrict writes or require human approval as risk changes. Confirm which controls are actually enforcing calls in your environment before depending on them.

For agents that can change business records, identify the owner, separate identity, tool destinations, write grants and grant duration. Remove unrelated standing grants and require a human decision for consequential writes. At the tool-call boundary, capture the agent identity, requested action and policy decision where your instrumentation supports it. Correlate locally installed agents with their tool credentials and the policy decisions recorded on their calls; use your own enforcement telemetry for recognition.

In a controlled non-production expense workflow, try a permitted read and an out-of-scope approval. The intended result is a successful read and a denied approval recorded under the agent’s identity. An alternate path using the employee’s broad credential calls for another access change.