Microsoft Enhances AI Security and Endpoint Management in November Updates
Microsoft's November security updates introduce Dynamic Permissions and Execution Containers to control AI agents, alongside Intune Endpoint Privilege Management enhancements.
Microsoft has released its November 2026 security updates, focusing on critical areas of AI agent security and advanced endpoint management. The updates aim to provide organizations with greater control over artificial intelligence agents accessing sensitive business data and tools, while also expanding the capabilities for standard users to manage their devices.
Central to the AI security enhancements are Dynamic Permissions and Microsoft Execution Containers (MXC). Dynamic Permissions allows organizations to grant AI agents task-specific authority that is scoped to the current task and only lasts for its duration. This is complemented by Dynamic Agent Risk assessment, which monitors an agent's behavior and context, enabling Dynamic Conditional Access to adjust permissions or require human approval for high-impact actions. This layered approach helps tailor agent authority before execution and adapt it as risks evolve.
Microsoft Execution Containers (MXC), now generally available, offer an operating system-enforced containment layer for AI agents. MXC applies least-privilege controls across files, networks, processes, and user interactions, providing an additional layer of isolation for higher-risk scenarios. This feature moves beyond relying on an agent's adherence to intended boundaries, instead enforcing strict controls and allowing organizations to validate policies before broad enforcement. Future integrations with Intune and Entra are expected to extend governance across the enterprise.
In endpoint management, Microsoft Intune Endpoint Privilege Management has been expanded to support new system settings. Standard users can now change network adapter settings, such as IPv4, IPv6, and DNS server values, without requiring administrator rights. Administrators can configure these elevations to require business justification or Windows authentication, supporting a least-privilege model for routine tasks.
Security operations are also streamlined with new Microsoft Defender Experts MDR experiences. A consolidated overview page in the Microsoft Defender portal provides security teams with a clearer view of ongoing expert-led threat investigations, including active and completed hunts and identified findings requiring follow-up. This aims to help teams quickly understand critical threats and prioritize actions.
Further enhancing endpoint security, Microsoft Defender now offers broader discovery capabilities for local AI agents and their configured Model Context Protocols (MCPs) on Windows and macOS. This feature, now generally available, observes agent activity to identify over 50 supported local AI agents, consolidating context about the agent, device, account, and MCP to provide security teams with better visibility into AI agent activity.
Finally, Microsoft Security Exposure Management's Secure Now feature has been updated to help organizations prioritize foundational security controls. By pairing information about recent threats with focused initiatives across security domains, teams can identify and address weaknesses such as excessive permissions or unprotected authentication flows, thereby reducing their overall exposure.
These updates collectively underscore Microsoft's commitment to addressing the evolving threat landscape, particularly concerning the integration of AI into business operations and the ongoing need for robust endpoint security and management.