Microsoft adds task-scoped permissions for AI agents

Microsoft has announced a set of controls intended to limit what AI agents can do inside corporate environments, in its monthly security update published on 5 November 2026.

The centrepiece is a feature called Dynamic Permissions. According to Microsoft, it gives an agent its own permissions and authority, scoped to the task it is currently working on and lasting only as long as that task requires. A companion capability, Dynamic Agent Risk, assesses whether the agent's authority still matches its behaviour and context as it works. A third piece, Dynamic Conditional Access, can then respond by narrowing permissions, restricting access to resources, or requiring a human to approve higher-impact actions. Microsoft said the three are designed to let organisations set agent authority before an agent acts and adjust it as risk changes.

The company also said Microsoft Execution Containers, or MXC, is now generally available. Microsoft describes it as an operating system-enforced containment layer for AI agents on Windows. Rather than relying on an agent to stay within its intended boundaries, MXC applies least-privilege controls across files, networks, processes and user interactions, with extra isolation options for higher-risk scenarios. Organisations can tune and validate policies before enforcing them widely, the company said. Microsoft said planned integration with Microsoft Intune, Microsoft Entra and Microsoft Agent 365 is intended to extend governance and attribution across an enterprise.

On the detection side, Microsoft Defender's discovery of local AI agents and their configured model context protocols, the connectors that let an agent reach tools and data, is now generally available on Windows and macOS. Microsoft said Defender discovers more than 50 supported local AI agents by observing their activity, and brings together the agent, device, account and configured MCP context so security teams can see what local agents are doing in their environment.

The update also covers areas beyond agents. Microsoft Intune Endpoint Privilege Management has gained support for system settings, meaning standard users can change IPv4, IPv6 and DNS server values on their device's network adapters without broad administrator rights. Administrators decide how those changes are elevated and can require a business justification, Windows authentication, or both, before a change is applied. Microsoft said tenant onboarding has also been updated.

Microsoft Defender Experts MDR, the company's managed detection and response service, now has a consolidated overview page in the Microsoft Defender portal with updated navigation and visibility into hunts. Teams can review active and completed hunts, see findings and identify items that may need follow-up, according to the company.

For database protection, the enhanced agent for Defender for SQL Servers on machines is now generally available for resource- and subscription-level enablement in the Azure Government cloud. Microsoft said the enhanced agent uses existing SQL infrastructure, removing the need to deploy the Azure Monitor Agent for that scenario.

Finally, the Secure Now feature in Microsoft Security Exposure Management now pairs information about recent threats with focused initiatives across security domains. Microsoft said AI-enabled attacks can take advantage of familiar weaknesses, including excessive permissions, unprotected authentication flows and exposed systems, and that the update is intended to help teams identify foundational controls needing attention and prioritise work to reduce exposure.

Microsoft did not publish figures on adoption or effectiveness for any of the new agent controls in the announcement.