Defender Impact
Until now, AI agents operating within enterprise environments have largely inherited broad, standing permissions — a structural least-privilege gap that existing identity and access controls were not designed to close. Microsoft’s November 2026 update introduces the first native, adaptive framework within the Microsoft stack for scoping, monitoring, and dynamically adjusting agent authority at runtime, giving defenders a concrete enforcement layer where previously only guidance existed.
Capability Overview
This release delivers three interlocking capabilities under the Secure AI banner, plus a generally available containment primitive:
Dynamic Permissions grants each AI agent permissions scoped to its current task and time-bounded to the duration of that task. Rather than agents carrying persistent, broad access, authority is provisioned on demand and expires when the task concludes. This directly addresses the standing-access problem that has made agentic workloads difficult to govern under conventional IAM frameworks.
Dynamic Agent Risk operates as a continuous behavioural assessment layer. As an agent executes its task, the system evaluates whether the agent’s actions and resource access remain consistent with its declared task scope and historical behavioural baseline. Deviations — such as accessing data stores outside the task’s expected boundary — trigger a risk signal.
Dynamic Conditional Access consumes those risk signals and responds proportionately. Depending on the assessed risk level, it can narrow the agent’s active permissions, block access to specific resources, or escalate to a human approval gate for higher-impact actions. Crucially, this is a graduated response — it does not require blunt session termination, which is operationally significant for long-running agent workflows.
Microsoft Execution Containers (MXC), now generally available, provide an OS-enforced containment boundary for local AI agents running on Windows. This is a kernel-level primitive that limits what a local agent process can access on the host — complementing the identity-layer controls above with a compute-layer enforcement point.
Taken together, these capabilities represent a layered control architecture: task-scoped identity at provisioning time, behavioural monitoring at runtime, adaptive policy enforcement as risk changes, and OS-level containment as a backstop.
Defensive Advances
- Least-privilege enforcement is now operationalisable for agents. Defenders can define permission boundaries tied to specific task contexts rather than relying on broad service account permissions or manual reviews.
- Real-time behavioural deviation detection means that an agent behaving outside its expected scope triggers an automated response — not a post-incident alert.
- Human-in-the-loop approval gates for high-impact actions provide a native control point that security teams can configure without building custom middleware.
- MXC containment reduces blast radius for local agent compromise scenarios, an underserved risk category as local AI assistants proliferate on enterprise endpoints.
Residual Gaps
Several maturity questions remain before organisations can fully realise these controls:
- Policy authoring complexity: Defining meaningful task-scoped permission boundaries requires that organisations first have precise, documented task taxonomies for their agents — most do not yet have this operational maturity.
- Cross-platform coverage: MXC is Windows-specific at GA. Organisations running AI agents on Linux-based infrastructure or in containerised cloud environments will need to rely on complementary controls until coverage expands.
- Third-party and custom agent integration: It is not yet clear how Dynamic Permissions integrates with agents built outside the Microsoft Agent 365 ecosystem. Coverage for bring-your-own-agent deployments is a key maturity question.
- Alert fidelity and tuning: Dynamic Agent Risk’s effectiveness depends on baseline quality. Organisations with limited agent operational history may face a noisy initial period requiring tuning investment.
Framework Mapping
- LLM08 (Excessive Agency): Dynamic Permissions and MXC directly address the core OWASP concern about agents being granted more capability than their tasks require.
- LLM06 (Sensitive Information Disclosure): Task-scoped access limits the data an agent can reach, reducing exfiltration surface.
- AML.T0086 (Exfiltration via AI Agent Tool Invocation) and AML.T0098 (AI Agent Tool Credential Harvesting): Dynamic Conditional Access’s ability to narrow permissions mid-session disrupts the access chains these techniques rely on.
- AML.T0080 (AI Agent Context Poisoning): Behavioural deviation detection via Dynamic Agent Risk provides a monitoring signal when an agent begins acting outside expected context.
Deployment Considerations
Organisations should sequence adoption as follows: begin with MXC for local Windows agents as a low-friction baseline containment win requiring no policy design. In parallel, conduct an agent permission audit to establish current footprints — this groundwork is prerequisite to meaningful Dynamic Permissions policy design. Entra and Intune integration should be validated in a test tenant before production rollout, particularly for Conditional Access policy interactions with existing human identity policies.
Defender Checklist
- Audit all deployed AI agents and document their current permission scopes
- Enable Microsoft Execution Containers for local Windows-based AI agent workloads
- Define task taxonomies to inform Dynamic Permissions policy design
- Configure Dynamic Conditional Access policies with graduated response thresholds
- Establish human-approval gates for agent actions with write or delete scope on critical data
- Review Dynamic Agent Risk alert outputs during initial deployment for baseline tuning
- Assess coverage gaps for non-Windows and third-party agent deployments