The Cybersecurity and Infrastructure Security Agency (CISA) has added a Microsoft 365 security rule requiring covered federal agencies to block AI agents that Microsoft flags as high risk. The aim is to stop those agents from continuing to access cloud files and applications once they have been identified as risky.
Some agents have their own identities in Microsoft Entra, the system that manages sign-ins and access permissions. Those identities allow software to work without a person signing in for each task. CISA instructs administrators to apply the policy to all agent identities and cloud resources, blocking access when an agent is rated high risk.
The rule is included in ScubaGear 2.0.0. ScubaGear is CISA’s free tool for checking Microsoft 365 configurations against its cloud security baselines. It identifies gaps but does not change them or disable agents. Administrators must configure Microsoft’s access controls separately to enforce the rule.
How Microsoft detects risky agents
Microsoft assesses agent risk using signs such as a sudden rise in sign-ins, attempts to reach unfamiliar resources or failed attempts to access information the agent is not authorized to use. Suspicious directory searches are another signal Microsoft uses to assess agent risk. These signals help Microsoft identify behavior that may indicate an agent has been compromised or is being misused.
Microsoft currently detects these risks after the relevant activity occurs. It then evaluates access policies when issuing or refreshing an access token, the digital credential software uses to request access to a resource. Some resources support faster enforcement through Continuous Access Evaluation. Because Microsoft detects these risks after the activity occurs, the policy cannot guarantee that an agent’s first harmful action will be blocked.
Licensing and coverage limits
The blocking control uses paid Microsoft identity and agent-management features. CISA’s baseline lists Microsoft Entra ID P2 together with Microsoft Agent 365 or Microsoft 365 E7. Its setup instructions label the agent-risk condition as a preview feature. Downloading the free CISA tool does not supply the Microsoft subscriptions needed to apply the protection.
CISA marks the policy as a requirement under its federal cloud-security directive, which applies to covered federal civilian executive branch agencies. Private organizations can use the baseline voluntarily. This particular policy does not apply to Microsoft’s Government Community Cloud High or Department of Defense environments.
The policy also does not cover every AI tool an organization uses. It targets agents accessing resources through their own Entra agent identities. When an agent instead works through a signed-in employee’s permissions, Microsoft attributes risky activity to that user, requiring user-focused access controls. Microsoft also supports agents operating through dedicated user accounts, which are treated separately from agent identities in Conditional Access.