There is a familiar rhythm to vendor security announcements: a capability appears in the product because enough customers have discovered they have a problem they cannot measure. Microsoft's September security update leads with discovering and controlling local AI agents, extending Zero Trust to agent traffic, and shoring up SOC foundations. Read that ordering as a diagnosis rather than a roadmap. Agents are already on endpoints inside most estates, and very few organisations can produce a list of them.
Shadow IT grew a runtime
The last decade of shadow IT was mostly about people signing up for SaaS with a corporate card and a work email address. Unpleasant, but tractable — the traffic went somewhere, the vendor had a domain, and a CASB or a conditional access policy could eventually corral it. Local AI agents break that model in a way worth being precise about. They run on the device. They inherit the signed-in user's context. They can read local files, call internal APIs and drive applications, and much of that activity never crosses a boundary where a network control could see it.
That is a materially different containment problem. An agent is not a browser tab you can block; it is a process with the user's permissions and an instruction set someone else wrote. If your model of endpoint control is "we manage the apps in the catalogue and the rest doesn't matter much", agents are the thing that breaks it, because the interesting behaviour happens after installation and depends on what the agent is told to do that week.
Discovery before control, always
Microsoft putting discovery first is the right order, and I would argue it is the only order. You cannot write a sensible policy for a population you have not enumerated. Before any of this becomes a licensing conversation, the practical question for an infrastructure team is: what telemetry do we already hold that would reveal an agent running locally?
In most Microsoft-centric estates that means endpoint process telemetry, application inventory from Intune or Configuration Manager, outbound connections to model-hosting endpoints, and — often the most revealing source — the OAuth consent grants and app registrations in Entra ID. An agent that does anything useful against corporate data usually needs a token from somewhere. Consent grants are where that shows up, and they are reviewable today without buying anything.
Zero Trust for non-human callers
Extending Zero Trust to agent traffic sounds like a slogan until you work out what it actually demands. The Zero Trust model assumes a verifiable identity, a device posture signal and a policy decision point that can say no. Agents strain two of those three. The identity is frequently the user's, borrowed, which destroys the audit trail. And the policy decision point has no useful way to distinguish "the user clicked this" from "something acting for the user decided to do this at three in the morning".
The fix is structural rather than clever. Agents need their own identities — service principals, workload identities, managed identities, whatever your platform calls them — with their own scoped permissions, their own lifecycle and their own conditional access treatment. The moment an agent authenticates as itself rather than impersonating a human, most of the hard problems become ordinary problems: least privilege, credential rotation, access review, revocation. That migration is unglamorous and will take longer than anyone's slide deck suggests.
- Enumerate what agents exist, using endpoint inventory and Entra consent grants as the starting points.
- Separate identity so agents authenticate as workloads, not as the user who installed them.
- Scope permissions to the narrowest set the agent genuinely needs, and review them on a schedule.
- Log the actions, not just the authentications — an agent's audit value is in what it did, not that it signed in.
- Define revocation before deployment: who kills an agent at 2am, and how fast.
Strengthening SOC foundations is the quiet item
The third strand — SOC foundations — is the one that will get the least attention and matters the most. Every agentic capability a vendor ships assumes the underlying data is there: complete log coverage, reliable identity signals, tuned detections, and an analyst population that trusts the output enough to act on it. An estate with patchy endpoint onboarding and three years of unreviewed detection rules does not get better because a new agent-aware feature appears in the portal. It gets a new category of alert it cannot triage.
If there is a single unglamorous priority this quarter, it is coverage. Which devices report to your EDR and which quietly fell off. Which log sources stopped ingesting and nobody noticed because the dashboard still had data from the others. Whether privileged accounts are actually separated. None of that is new advice, but agent activity amplifies the cost of getting it wrong, because an agent can act far faster than a human attacker typing commands.
What I would do with this announcement
Treat it as a prompt to run a discovery exercise rather than a reason to open a procurement conversation. Spend a fortnight establishing what agents already run in your estate, which identities they use, and what data they can reach. That inventory will be useful whatever products you eventually buy, and it has a habit of producing uncomfortable findings that justify the rest of the programme.
[AUTHOR: add a real example from your own work here — e.g. a discovery exercise or consent-grant review and what it surfaced.]
Then check the detail of what Microsoft has actually shipped against what you need, because the gap between a capability being announced and it being available in your tenant, your licensing tier and your region is where most delivery plans go wrong. Verify availability in the Microsoft 365 roadmap and your own admin centre before anything goes into a project plan.
The pattern underneath
Every wave of new technology arrives in enterprises the same way: informally, through enthusiastic individuals, ahead of policy. Agents are following that script precisely. The organisations that cope well will not be the ones with the most restrictive policy — they will be the ones who found out what was running before they tried to govern it.