Microsoft Ships Dynamic Permissions and Execution Containers for AI Agents
Microsoft's November 2026 Security update introduces Dynamic Permissions, Dynamic Agent Risk, Dynamic Conditional Access, and Microsoft Execution Containers — a layered set of controls designed to constrain AI agent authority at runtime and at the OS level. These capabilities close a significant gap for defenders: the absence of native, adaptive least-privilege enforcement for AI agents operating across business data and tools. Residual maturity questions remain around policy authoring complexity, cross-platform agent coverage beyond Windows, and the operational readiness of teams to define task-scoped permission boundaries at scale.