Microsoft has rolled out several new security features in November 2026, focusing on managing AI agent risks and enhancing endpoint protection. The updates include Dynamic Permissions, which allows organizations to limit AI agent authority to specific tasks and adjust access as risk changes. This feature assesses agent behavior and context to narrow permissions or require human approval when necessary.
Microsoft Execution Containers (MXC), now generally available, provides an operating system-enforced containment layer for AI agents. It applies least-privilege controls across files, networks, processes, and user interactions, with additional isolation options for higher-risk scenarios. Organizations can tune and validate policies before enforcing them broadly.
The company has also expanded Microsoft Intune Endpoint Privilege Management, allowing standard users to change network settings like IPv4, IPv6, and DNS server values without broad administrator rights. Administrators can require business justifications or Windows authentication for these changes.
New Microsoft Defender Experts experiences in the Microsoft Defender portal offer a consolidated overview of ongoing expert investigations. Security teams can review active and completed hunts, findings, and items requiring follow-up. Additionally, the enhanced agent for Defender for SQL Servers is now available in Azure Government cloud, simplifying deployment and expanding protection.
Microsoft Defender is extending discovery capabilities for local AI agents and their configured model context protocols (MCPs) across Windows and macOS. The update helps security teams understand local AI agent activity in their environment.
The Microsoft Security Exposure Management update pairs information about recent threats with focused initiatives to prioritize foundational security controls. The company also released a guide titled “Don’t Leave AI Exposed,” providing actionable guidance on managing AI agent risk across the lifecycle.