Microsoft has pushed a fresh Windows 11 preview to Insiders in both the Dev and Beta channels — build 26220.7262, delivered via cumulative update KB5070303 — that begins to expose a new set of
agentic capabilities alongside incremental accessibility and UI refinements. The release adds an experimental toggle in AI Components that governs whether AI agents may use new, sandboxed Windows “agent workspaces”; introduces higher-fidelity on-device voices for Narrator and Magnifier (U.S. English only for now); brings structured math reading to Narrator when viewing equations in Microsoft 365 desktop apps; and polishes the Click to Do context experience. At the same time, Microsoft is temporarily disabling Image Object Selection and reconfiguring certain AI Actions features, meaning some functionality will be limited while the company tunes security and rollout policies.
Background / Overview
This preview release continues the 25H2-based preview stream distributed simultaneously to the Dev and Beta channels while Microsoft stabilizes that branch. The build number —
26220.7262 — and cumulative package
KB5070303 are the identifiers Insiders will see in Windows Update. The most consequential changes in this drop are not cosmetic: they are early platform plumbing for the “agentic” OS vision Microsoft has been describing — where trusted software agents can perform multi-step tasks on a user’s behalf by interacting with local apps and files inside guarded runtime boundaries.
The update can be viewed as two parallel efforts:
- Enabling agentic experiences in a way that provides meaningful productivity improvements while creating explicit user controls and isolation boundaries; and
- Continuing the multi‑month accessibility and usability work (Narrator improvements, contextual menus, Click to Do) that benefits a broader set of users today.
What’s important for readers to understand is that these agentic features are intentionally experimental, gated, and opt‑in. Microsoft’s design emphasis in this phase is on transparency, least privilege, and administrative control.
What’s new in build 26220.7262 (KB5070303)
Experimental agentic features toggle (AI Components settings)
A new toggle appears under Settings → System → AI components (Agent tools / Experimental agentic features). This single control enables or disables whether AI agents can use the newer Windows agentic features — specifically agent workspaces and the runtime-level agent tooling Microsoft is beginning to surface.
- The toggle is off by default; enabling it is required for agents to be provisioned and run.
- When enabled, agents operate under separate standard Windows accounts and inside agent workspaces — contained child sessions designed to isolate agent activity from a user’s primary desktop.
- Agents must request explicit access to known folders (e.g., Documents, Downloads, Desktop, Pictures) and any additional permissions must be granted by the user.
Why this matters: the toggle is the user-facing gate for the experimental agentic runtime. It lets Insiders try agent functionality without flipping it on for everyone, and it’s the first logical control administrators will look to manage at scale.
Agent workspace: the isolation model
The release continues to expose the architectural model that will underpin Copilot Actions and agentic apps:
- Agents run in agent workspaces — contained environments that appear as separate desktops to users.
- Agent activity is associated with distinct agent accounts rather than the signed‑in user account.
- The model relies on scoped permissions (initially limited to common “known folders”) plus signing and revocation mechanisms to control which agents are trusted.
These workspaces are implemented to be lighter-weight than full virtual machines while providing the isolation necessary for security and user transparency. The preview explicitly treats this as a phased rollout: Microsoft will refine permission granularity, monitoring, and revocation tooling during the trial.
HD Voices in Narrator and Magnifier (U.S. English)
Insiders with U.S. English configured can now select new
high-definition voices in Narrator and Magnifier. These voices are powered by on-device, higher-capacity speech models derived from cloud neural TTS research and optimized to run locally.
- Initially available: one male and one female HD voice in this preview.
- The voices use more advanced on-device models to produce clearer, more natural pronunciation and prosody.
- This work aims to bring the quality of cloud neural TTS to local accessibility tools, reducing latency and improving privacy since audio generation happens on-device.
Important caveats: for now this capability is region- and language-limited (U.S. English) and is being rolled out gradually. Expect model and language expansion over time.
Math in Narrator
Narrator has been updated in this preview to
read math in a structured way when encountering equations in Microsoft 365 desktop apps such as Word.
- Equations are parsed and read with an emphasis on structure and semantics so listeners get a more meaningful representation of complex expressions.
- The feature targets education and professional users in STEM fields who rely on screen readers to understand mathematical content.
- This initial release covers Microsoft 365 desktop apps; expansion to other formats and experiences is planned.
Accessibility impact: structured math reading significantly improves comprehension for screen-reader users when working with formulas, and is a notable advancement over simple linear or unstructured text-to-speech reading of math markup.
Click to Do improvements
The Click to Do experience (an on-screen contextual assistant menu for Copilot+ features) is getting usability polish:
- Frequently-used actions (Copy, Save, Share, Open) are now surfaced directly in the primary context menu so they are easier to reach.
- The context menu will now automatically appear when a large image or table is detected on-screen, streamlining interactions like extracting data or performing conversions.
- Overall behavior has been simplified so essential actions require fewer clicks.
This refinement is focused on reducing friction in common workflows where a contextual, assistant-driven action can add real value.
Other improvements and temporary reconfigurations
The build also contains a number of smaller changes and temporary reversions while Microsoft stabilizes the pipeline:
- Image Object Selection has been turned off temporarily while Microsoft addresses edge-case behavior and privacy considerations related to on-screen object analysis.
- Teaching Tips and Pen Input received small quality-of-life improvements.
- The AI Actions feature has been “reconfigured” for the preview; some previously-available functionality may be reduced or not available until the feature is fully stabilized.
- A suite of reliability and accessibility fixes are included in the cumulative update.
These moves reflect a conservative rollout strategy: when a feature's interaction model or security posture needs tuning, Microsoft will revert or restrict it rather than risk a broad release.
Verification and what’s confirmed vs. what remains provisional
The following technical facts are verifiable in official product documentation and public Windows communications:
- The build identifier 26220.7262 and associated cumulative update KB5070303 are the published preview package for the Dev and Beta channels in this wave.
- The Experimental agentic features toggle exists in the Settings app under AI Components and is off by default.
- Agent workspaces run agents under separate standard accounts and use a contained desktop session model to limit visibility and privilege.
- Narrator has gained structured math reading in Microsoft 365 desktop apps in this preview.
- HD Voices are being introduced for Narrator and Magnifier in U.S. English and are implemented as higher-fidelity on-device models.
Caveats and provisional items:
- The rollout is controlled and phased; some items (for example, Image Object Selection, certain AI Actions capabilities) are intentionally temporary or limited during the preview.
- Model coverage for on-device HD voices is currently narrow (only U.S. English with two voices) and will expand over time.
- Exact enterprise deployment behavior (e.g., interaction with third-party agents, enterprise signing and vetting workflows) is subject to additional policy and tooling that Microsoft plans to publish during the preview.
Where definitive behavior or configuration is not yet fully documented, the language of the preview and Microsoft’s communications emphasize
continual refinement and additional admin controls to be added as the preview progresses. Treat any claim about complete functionality or broad availability as provisional until the feature moves out of preview.
Security, privacy, and enterprise controls — what IT professionals need to know
The introduction of agentic features changes threat models and administrative controls in significant ways. Microsoft is addressing this with a multi-layered approach; IT pros should be prepared to adapt policies and operational practices.
Key elements of Microsoft’s agentic security model:
- Agents run under separate standard Windows accounts (agent accounts). This separation enables auditing, access control, and clearer policy application.
- Agent workspaces are contained environments (child desktop sessions) that limit an agent’s visibility into the user’s primary session.
- Agents are expected to be cryptographically signed; Microsoft plans ability to revoke or block compromised agent certificates.
- Agents begin with narrow, scoped permissions (known folders like Documents, Downloads, Desktop, Pictures) and require explicit elevation to access more resources.
- The experimental toggle is off by default and must be activated per-device or by the end user.
Administrative controls available or coming:
- Mobile Device Management / Policy options to manage agentic behavior exist and can be used to disable or limit agent-related experiences centrally.
- Group Policy or ADMX settings will map to configuration keys so organizations can disable Settings agentic search experiences or prevent agent provisioning.
- Registry and policy keys provide machine-level control for enterprise deployments where administrators must lock down agentic capabilities.
Practical guidance for IT admins:
- Treat agentic features like a new runtime for untrusted code until you have a validated signing and vetting process.
- Test in a segmented lab environment before any broad deployment. Use the preview to validate your auditing, revocation, and ACL workflows.
- Use policy controls (ADMX/MDM) to keep the feature off by default in production until you have a clear security posture and operational plan.
- Ensure endpoint protection tooling is aware of agent accounts and child workspace processes so antivirus and EDR solutions can appropriately monitor and enforce policies.
- Educate users about explicit permission prompts and the limited scope of agent access in the preview so inadvertent over-privileging is avoided.
These are practical steps for risk mitigation while preserving the optional productivity benefits that agents promise.
Accessibility implications: Narrator improvements explained
The Narrator changes in this build deserve close attention from accessibility practitioners and users:
- Structured math reading: Narrator now attempts to parse and vocalize mathematical expressions with structure. Rather than reading a long, unstructured string, the reader will articulate exponents, fractions, and operator relationships in a way that mirrors how math is conceptually represented.
- Benefit: drastically better comprehension for screen-reader users working with STEM documents.
- Limitations: initial coverage is for Microsoft 365 desktop apps; non‑M365 files or complex embedded formats might not be fully supported yet.
- HD Voices for Narrator and Magnifier: By moving higher-quality TTS models to local, on-device implementations, Windows reduces latency and potential privacy exposure from cloud processing. The voices offer richer intonation and clearer articulation — particularly helpful for sustained reading sessions and complex content.
Accessibility considerations to watch:
- Voice selection and language availability are limited early on; reliance on US English voices will affect multi-lingual users until more languages are supported.
- Test math rendering and TTS quality with real courseware, published papers, and STEM content to evaluate fidelity and identify edge cases.
- Provide feedback through the platform’s feedback channels when equations render or read incorrectly; the preview phase is intentionally for iterative improvement.
Developer and power‑user considerations
Developers building agentic experiences, or software that may interact with agents, should plan for:
- Agent account lifecycle: understand how agent accounts are provisioned, signed, and revoked.
- Application manifest and signing requirements, including the operational trust framework and certificate revocation flows.
- Scoped permission UX: design for explicit user consent with clear explanations of which folders or resources are accessed.
- Telemetry and auditing: instrument agent operations so administrators can trace actions back to agent accounts and sessions.
- Graceful degradation: account for users who disable Experimental agentic features or environments where agent workspaces are blocked by policy.
Power users and Insiders can experiment with the agent toggle and new Narrator features now, but should expect occasional regressions and temporary disabling of experimental elements.
What users should do now (practical steps)
For Insiders who want to explore these features:
- Ensure Windows Update shows Build 26220.7262 (KB5070303) and install the cumulative update from Settings → Windows Update.
- To try agentic features: open Settings → System → AI components → Agent tools and enable the Experimental agentic features toggle. Be prepared to grant folder permissions to any agent you authorize.
- Try Narrator math: open a Microsoft 365 Word document that contains equations, start Narrator (Win + Ctrl + Enter), and use standard reading commands to hear how equations are read.
- To test HD Voices: open Narrator or Magnifier voice settings (U.S. English) and switch to the new HD voices; compare quality to your existing TTS selections.
- Provide feedback: use the Feedback Hub to report misreads, TTS quality issues, or unexpected agent behavior so Microsoft can iterate during preview.
For IT administrators:
- Evaluate policy controls and determine a default posture. Consider disabling agentic features until you have a controlled pilot group and monitoring in place.
- Confirm your MDM/Group Policy templates are up-to-date and that you can target the WindowsAI-related settings needed to manage agents (for example, disabling Settings agentic search or blocking agent provisioning).
- Update endpoint detection rules and process whitelists to cover agent account processes and agent workspace sessions.
- Pilot with a trusted set of users and document the change management plan before opening the feature more broadly.
Strengths, opportunities, and risks — critical analysis
Strengths
- Productivity potential: Agentic capabilities like Copilot Actions can automate repetitive, multi-step tasks (organizing files, synthesizing content, batch edits) in ways classic helpers cannot.
- Thoughtful isolation model: Running agents under separate accounts and in contained workspaces addresses several classic attack vectors that would otherwise make such agents risky.
- User control and opt-in model: The default‑off toggle and explicit permission model respect user agency and make staged deployment possible.
- Accessibility advances: Structured math reading and higher‑quality on-device TTS materially improve experiences for screen-reader users, with privacy and latency benefits from local models.
Risks and unknowns
- Privileged agent misuse: Any system that allows software to act on a user’s behalf must be highly robust against misconfiguration and social engineering. Poorly designed agent consent dialogs or confusing UX could result in over-privileging.
- Supply‑chain and signing reliance: The trust model leans heavily on signing and revocation. If certificate management or revocation lacks speed or coverage, compromised agents could persist.
- Enterprise policy complexity: Organizations must adapt policies across MDM, ADMX, and endpoint protection — a nontrivial administrative burden.
- Privacy edge cases: Agents may process or access local content; even with scoped folders, inadvertent exposure is possible unless users and admins are careful.
- Feature churn during preview: Microsoft is actively restricting or temporarily disabling certain features (Image Object Selection, AI Actions reconfiguration). Insiders should expect changes that may break dependent workflows.
Risk mitigation strategies
- Keep agentic features off in production environments until signing and revocation systems are proven.
- Use ACLs and folder-level restrictions aggressively; teach users to avoid granting blanket access.
- Maintain strict development and release controls for internal agent tooling and require code signing with central key management.
- Monitor telemetry and establish alerts for unusual agent activity tied to agent accounts.
The bigger picture: Windows as an “agentic OS”
This preview is a concrete step toward a more agent‑driven Windows. The architecture shows Microsoft thinking beyond simple assistant UIs and toward agents that can act with controlled autonomy. The cross-team reorganization and published security principles indicate this is more than experimentation — it’s a strategic platform direction.
That said, turning Windows into a platform for acting agents raises complex questions about user expectations, regulatory compliance, enterprise governance, and developer responsibility. The preview’s phased model and explicit guardrails are the correct early response, but the success of agentic features will depend on:
- Transparent, usable consent models;
- Enterprise controls that map cleanly to existing device management workflows;
- Rapid, reliable revocation and supply-chain defenses; and
- Clear accessibility and privacy guarantees.
If Microsoft can deliver on those points, agentic features could substantially boost productivity without sacrificing security. If any of those elements lag, enterprises and users will be wise to proceed cautiously.
Conclusion
Build 26220.7262 (KB5070303) is a preview that matters because it begins to operationalize the agentic OS vision while delivering practical accessibility improvements in the near term. The new Experimental agentic features toggle and agent workspace model add real capability to enable assistants that act, not just advise — but they do so with deliberate, conservative defaults and a suite of isolation mechanisms. Accessibility gains — structured math reading and HD on‑device voices — are meaningful improvements for anyone who depends on screen readers or richer TTS.
For Insiders and power users, this build is an invitation to explore and provide feedback. For IT administrators, it’s an early call to plan policy, testing, and telemetry. The features are experimental, and Microsoft is rightly taking a careful, iterative approach. The coming months will be critical: will the company’s security tooling, policy controls, and UX be convincing enough for enterprise adoption while still delivering the productivity benefits agentic AI promises? This preview is where those questions begin to get answered.
Source: Thurrott.com
New Dev and Beta Build Enables New Agentic Features