Microsoft has announced new security controls for AI agents, including task-scoped permissions, risk assessment while an agent is working and operating-system-enforced containment. Its Defender tools will also discover more than 50 supported local AI agents and their configured MCPs across Windows and macOS.
Microsoft AI Watch analysis
What happened
In its November security update, Microsoft describes three controls designed to work together: Dynamic Permissions gives an agent authority limited to its current task and the time needed to complete it; Dynamic Agent Risk assesses whether that authority still fits the agent’s behaviour and context; and Dynamic Conditional Access can narrow access, restrict resources or require human approval for higher-impact actions.
Microsoft also says Microsoft Execution Containers is now generally available. The feature applies operating-system-enforced controls across files, networks, processes and user interactions, rather than relying on an agent to stay within intended boundaries. Administrators can tune and validate policies before enforcing them broadly. The update also makes local-agent discovery generally available in Defender for supported agents on Windows and macOS, bringing the agent, device, account and configured MCP context together.
Why it matters
AI agents need access to tools and business data to do useful work. That makes permissions, monitoring and containment practical deployment questions, not decorative security settings. Microsoft’s approach puts controls around the agent as well as within the task: limit what it can do, reassess risk as it operates, and provide a way to contain its activity.
The discovery update gives security teams a broader inventory of supported local agents and their configured connections. That is a useful starting point for governance, though an inventory alone does not establish who owns each agent or whether its access is appropriate.
Our read
The notable shift is from treating agent security as a one-time permission decision to adjusting controls as an agent works. The pieces are designed to give administrators more than a stern reminder to keep an eye on things. Organisations evaluating these tools should look closely at which agents and integrations are covered, and how approval and containment behave in their own environments.
What to watch
- Which supported agents and MCP configurations Defender can discover in practice.
- How Dynamic Agent Risk determines when an agent’s behaviour warrants a response.
- When the planned integrations with Intune, Entra and Agent 365 arrive.
- How organisations tune and validate Execution Container policies before wider enforcement.
Discussion spark: Should AI agents have their access reassessed continuously as they work, or should a carefully scoped permission set be enough?
Sources and evidence
- What’s new in Microsoft Security: November 2026 – Microsoft (5 November 2026, 17:00 UTC)
not affiliated with or endorsed by Microsoft