Quick Take
- What: Microsoft announced Dynamic Permissions, a capability that gives AI agents task-scoped authority and adapts access as risk changes, alongside Microsoft Execution Containers for agent containment.
- Who is affected: Organizations deploying AI agents with access to business data and tools, Windows and macOS endpoints running local AI agents.
- Platform updates: Microsoft Defender now discovers more than 50 supported local AI agents and their configured model context protocols (MCPs) on Windows and macOS.
- Availability: Microsoft Execution Containers is now generally available; Defender agent discovery for local AI agents is generally available.
- Additional features: Enhanced agent for Defender for SQL Servers is generally available in Azure Government cloud; new Defender Experts MDR experiences consolidate threat investigation visibility.
In plain English
Microsoft released new security features in November 2026 to help organizations control what AI agents can do. Dynamic Permissions gives each agent only the access it needs for its current task and can automatically restrict that access if the agent’s behavior changes or becomes risky. Microsoft Execution Containers adds operating system-level boundaries to limit what AI agents running on Windows can access, such as files and networks. Microsoft Defender can now find and track more than 50 types of local AI agents on Windows and Mac computers.
What you should do: If you use AI agents in your organization, these features help ensure agents cannot access more data or systems than they should. Regular users do not need to take any action.
What happened
Microsoft announced a suite of AI agent security capabilities in its November 2026 security update, published on November 5, 2026. The centerpiece is Dynamic Permissions, which provides agents with permissions scoped to their current task and only for as long as the task requires. The system uses Dynamic Agent Risk to assess whether an agent’s authority aligns with its changing behavior and context. Dynamic Conditional Access can then respond by narrowing permissions, restricting access to resources, or requiring human approval for higher-impact actions.
Microsoft Execution Containers (MXC), now generally available, provides an operating system-enforced containment layer for AI agents on Windows. MXC applies least-privilege controls across files, networks, processes, and user interactions, with additional isolation options for higher-risk scenarios. Organizations can tune and validate policies before enforcing them broadly. Upcoming integration with Microsoft Intune, Microsoft Entra, and Microsoft Agent 365 is intended to extend governance and attribution across the enterprise.
Microsoft Defender extended its discovery capabilities for local AI agents and their configured model context protocols (MCPs) across Windows and macOS. Now generally available, Defender discovers more than 50 supported local AI agents by observing their activity and brings the agent, device, account, and configured MCP context together.
Microsoft Intune Endpoint Privilege Management added new system settings support, allowing standard users to change IPv4, IPv6, and DNS server values on their device’s network adapters through Endpoint Privilege Management. Administrators can require a business justification, Windows authentication, or both before changes are applied.
The enhanced agent for Defender for SQL Servers on machines is now generally available for resource and subscription-level enablement in Azure Government cloud. The enhanced agent uses existing SQL infrastructure, eliminating the need to deploy the Azure Monitor Agent.
Microsoft Defender Experts MDR introduced new experiences in the Microsoft Defender portal with a consolidated overview page, updated navigation, and visibility into hunts. Teams can review active and completed hunts, see findings from Defender Experts, and identify items that may require follow-up.
Microsoft Security Exposure Management introduced Secure Now, which pairs information about recent threats with focused initiatives across security domains. The update helps connect information about observed attack patterns to foundational controls that need attention.
What it means
These updates represent Microsoft’s approach to managing security risks as AI agents gain broader access to business data and tools. Dynamic Permissions addresses the challenge of granting agents appropriate authority without over-provisioning access. By scoping permissions to specific tasks and adapting access based on risk assessment, organizations can limit the potential damage from compromised or misbehaving agents.
Microsoft Execution Containers provides defense-in-depth by adding operating system-level enforcement to agent containment, rather than relying solely on the agent to respect intended boundaries. This approach applies least-privilege principles at the OS level, limiting what an agent can access even if the agent itself is compromised.
The discovery capabilities in Microsoft Defender address visibility gaps as organizations deploy local AI agents. By identifying agents and their configured MCPs, security teams can understand what AI capabilities are active in their environment and what data sources or tools those agents can access.
The Endpoint Privilege Management updates continue Microsoft’s effort to reduce the need for broad administrator rights on endpoints, allowing standard users to perform necessary tasks while maintaining security controls.
