Microsoft Security Roundup November 2026: AI Agent Isolation, Defender Discovery and Intune EPM

The roundup is written by Microsoft's marketing team, so the details below come from Microsoft's documentation and earlier engineering posts. The availability status of each item matters, because the roundup mixes generally available features with work that is still "coming soon."

The lineup at a glance​

An independent threat-feed summary from OffSeq described the release the same way. It listed Dynamic Permissions for task-scoped agent authority, Microsoft Execution Containers for OS-enforced containment of AI agents, expanded least-privilege controls via Microsoft Intune Endpoint Privilege Management, and enhanced visibility and management of local AI agents.

Dynamic Permissions: agents stop inheriting the user's access​

The roundup says Dynamic Permissions gives each agent its own authority, limited to the task it is doing and only for as long as that task lasts. While the agent runs, Dynamic Agent Risk checks whether that authority still fits the agent's behavior and context. If it doesn't, Dynamic Conditional Access can narrow permissions, cut off resources, or require a human to approve higher-impact actions.

Microsoft's October 19 security post explains the reasoning. An agent should not automatically get all the standing access of the employee who sponsors it. It should start with no authority and receive only what the approved task needs. Organization-wide policy sets the upper limit, so an agent can never get authority its user doesn't have.

That post says Dynamic Agent Risk uses signals from identity, data, endpoints, cloud, network, runtime, and the agent's own activity, including whether its actions are drifting from what the user intended. The response is graduated, not on/off. Policy can keep read access while blocking writes, restrict network paths, shorten or revoke time-limited access, or isolate the runtime when risk is highest.

Microsoft's example is an expense-approval agent that reads a prompt injection in an outside document. Its configuration hasn't changed, but its behavior has. The system can keep its read access, remove its ability to approve payments, and require cryptographically provable human sign-off. The employee keeps working normally.

The caveat: the November roundup gives no release date, licensing tier, or setup steps for these three features. Treat them as an architecture direction until Microsoft publishes deployment documentation, which may come at Ignite.

Microsoft Execution Containers are generally available​

MXC is the Windows-specific part of this release. The roundup describes it as an operating-system-enforced containment layer that applies least-privilege controls to files, networks, processes, and user interaction. The agent itself doesn't decide what it can reach.

Microsoft's October 7 Windows Developer Blog post adds the technical detail. Developers declare which resources a workload needs in a single JSON configuration schema and use a multi-language SDK. MXC then maps those controls onto the platform's own containment backend:

• Process containers use AppContainer on Windows, Seatbelt on macOS, and Bubblewrap on Linux. They are built for low-latency jobs such as running model-generated code.
• Session containers are Windows-only. They run the agent under a separate Windows account and session, with its own desktop, clipboard, UI, and input boundaries.
• WSL containers provide hardware-enforced isolation with full Linux workload compatibility.

Microsoft says each backend has different security properties, so match the backend to how risky the workload is.

Write the policy before you enforce it. On Windows, MXC process containers support three modes:

1. Permissive: logs anything the policy would deny but lets it run, so you can see what the workload actually touches.
2. Learning: enforces the boundary and records every blocked operation in a JSON activity report.
3. Enforcement: applies the policy without producing an activity report.

The Windows team says GitHub Copilot, OpenClaw, OpenAI Codex, Replit, LM Studio, and Unsloth AI already support MXC. Anthropic's Claude Code, Perplexity, Raycast, and others have said they will add support. Windows 365 support for MXC is also generally available, so agents can run on Cloud PCs.

The management side is not finished. Intune policy for MXC process containers on Windows 11 is described as "soon," and Entra's ability to tell agent activity apart from user activity in Agent 365 is also listed as coming. Don't put those integrations into a rollout plan as if they have shipped.

Intune EPM: standard users can change their own IP and DNS settings​

This one is practical for help desks. A new elevation system settings policy in Endpoint Privilege Management lets standard users change IPv4, IPv6, and DNS server values on their network adapters without a UAC prompt and without local admin rights. Microsoft Learn gives the obvious use case: staff who move between sites and need a static IP or DNS server before the device can get online. The change works even when the device is offline.

Prerequisites: EPM must already be turned on for the device through a separate elevation settings policy. Microsoft also says the network settings feature is rolling out gradually and may not be in your tenant yet.
Admin setup, per Microsoft Learn:

1. In the Intune admin center, go to Endpoint security > Endpoint Privilege Management > Policies > Create Policy.
2. Set Platform to Windows and Profile to Elevation system settings policy.
3. On Configuration settings, select Add, then Edit instance. Name the rule, choose Network settings as the system setting, and set Elevation type to User confirmed.
4. Optionally add validation: Business justification (saved and visible in reporting), Windows authentication, or both. If you choose neither, the user only has to confirm the change.
5. Add scope tags, assign groups, then review and create.

What success looks like: after the device's next policy sync, the user opens the Windows Company Portal and goes to Help & support > System settings > Edit settings. They pick an adapter, select Edit, and choose either Automatic (DHCP) or Manual. Manual means entering an IP address or IPv6 address, a subnet mask or prefix length, a gateway, and preferred and alternate DNS servers.

If the System settings tile doesn't appear, check three things: whether the feature has reached your tenant, whether the device has an EPM elevation settings policy, and whether the device has synced since you assigned the policy. Company Portal only shows settings categories that have a policy targeted to that device.

The roundup also mentions simpler tenant onboarding for EPM but gives no details.

Defender Experts: seeing what the analysts are doing​

New Defender Experts MDR pages in the Defender portal add an overview page, updated navigation, and a view of active and completed hunts. Microsoft's September Tech Community post adds a few details:

• A homepage card and a permanent left-navigation entry for Defender Experts.
• For MDR customers, the overview combines managed responses and messages, service status, reports, and recent hunt outcomes.
• Hunts are either intelligence-based or triggered by suspicious activity. Completed hunts stay on record even when they don't produce an incident.

That last point helps when a quarter has few incidents and someone asks what the managed service is doing. Access depends on your service entitlement and portal permissions. This is a paid managed service and does not give every Defender customer human threat hunters.

Defender for SQL in Azure Government: no Azure Monitor Agent required​

The enhanced agent for Defender for SQL Servers on machines is now generally available in Azure Government at both resource and subscription level. It uses existing SQL infrastructure, so you no longer need to deploy Azure Monitor Agent. Microsoft's Defender for Cloud release notes say Government customers now get the same onboarding experience as commercial Azure. The plan covers SQL Server on Azure VMs and on Azure Arc-enabled machines connected to the Government cloud.

The release notes also list two things to act on:

• Existing customers: if you enabled the plan before April 2026, you need to update the plan configuration and then check that each SQL Server instance shows as protected.
• Billing: your bill may go up if the enhanced agent finds and protects SQL Server instances that weren't covered before.

There is also a related change from the November 4 release notes, which isn't specific to Azure Government: Defender for SQL Servers on machines now supports Arc SQL Server instances with Arc proxy enabled, starting with Defender for SQL extension version 2.0.3585.403. That helps organizations whose servers can't reach the internet directly.

Defender now finds local AI agents and their MCP servers​

The roundup says Defender discovers more than 50 supported local AI agents on Windows and macOS by watching their activity. It shows each agent together with its device, account, and configured MCP context.

Microsoft Learn's documentation describes how this behaves in practice:

• An inventory entry is one agent type for one user on one device. Claude Code running in 15 project folders shows up once.
• Supported types include command-line agents, desktop apps, agentic IDEs, VS Code extensions, and Claw-based implementations.
• Process-based detection only needs the process to run. An entry doesn't prove the agent was used or that it reached an AI service.
• MCP server configuration discovery requires antivirus active mode and real-time protection. If MCP data is missing, check those first.
• Results feed an exposure map and are available in KQL advanced hunting.

Check macOS status: the roundup calls discovery on Windows and macOS generally available, but Microsoft's Learn documentation sends readers to a support matrix where some entries are still labeled preview. Check that matrix before you tell your CISO the Mac fleet is fully covered.

Secure Now and the agent-security guide​

Secure Now, part of Security Exposure Management, now links recent threat information to specific remediation initiatives. The idea is that a pattern such as excessive permissions or unprotected authentication flows leads directly to recommended controls. Microsoft's September 17 post says Secure Now first launched in May 2026. That post's example campaigns included device-code phishing delivered through manipulated hotel networks and fake IT support calls over Teams. In those cases the recommended fixes were basics: phishing-resistant MFA, blocking device-code flow where it isn't needed, and tightening WinRM and remote-support tools.

Microsoft also released a guide called "Don't Leave AI Exposed." It covers agent inventory, ownership, access, monitoring, and runtime protection, and it is lead-generation content as much as engineering documentation.

Analysis: a lot of announcements, uneven readiness​

Taken together, the releases describe one model. Discovery finds the agent, identity attaches it to a policy, MXC limits what it can reach on the device, and Dynamic Permissions limits what it is allowed to do. It's a sound design. Outside security research has backed it for years: don't let the model decide what it's allowed to touch.

Readiness varies by piece, though. MXC, SQL in Azure Government, and agent discovery have shipped. EPM network settings are still rolling out. The agent-permission controls have no release date. The Intune management needed to run MXC across a fleet is "soon." Microsoft Ignite runs in San Francisco from November 17 to 20, 2026, or online, and the opening keynote is Tuesday, November 17, 2026, from 10:00 AM PT to 12:00 PM PT. Expect several of these gaps to get dates there, and possibly prices.

This month's checklist:

• Pilot EPM network settings with traveling staff once the feature reaches your tenant.
• Review the Defender agent inventory for unapproved AI agents, and confirm devices run antivirus in active mode so MCP data shows up.
• If you build or approve internal agents, test MXC in Permissive or Learning mode now, before Intune enforcement arrives.
• Azure Government SQL customers should update older plan configurations, verify protection, and check for billing changes.
• Wait for actual documentation of Dynamic Permissions before planning around it.

On WindowsForum, this connects to our ongoing Intune least-privilege threads, Defender for Endpoint deployment discussions, and coverage of Patch Tuesday and the Windows 11 23H2 end of updates.