Microsoft scopes AI agent access to the current task

Microsoft said on November 5 that Dynamic Permissions gives each AI agent its own authority, limited to the current task and only for as long as that task requires. The post does not call Dynamic Permissions generally available, and it names no price.

Dynamic Permissions provides an agent its own permissions and authority, scoped to its current task and for only as long as the task requires. Microsoft said Dynamic Agent Risk checks whether that authority still fits the agent's behavior and context. Dynamic Conditional Access can then narrow permissions, restrict resources, or require human approval for higher-impact actions. The company said the tools are designed to set limits before an agent acts and to adjust access as risk changes.

A separate containment layer is marked generally available. Microsoft Execution Containers, for AI agents on Windows, applies least-privilege controls across files, networks, processes, and user interactions. Microsoft said organizations can test policies before enforcing them broadly. Integration with Intune, Entra, and Agent 365 is described as upcoming, not as shipping in this note.

Defender's local-agent discovery is also generally available. Microsoft said Defender can now find more than 50 supported local AI agents and their configured model context protocols on Windows and macOS, by watching their activity. It also said an enhanced agent for Defender for SQL Servers on machines is generally available for resource- and subscription-level enablement in Azure Government, and that this scenario no longer needs the Azure Monitor Agent.

The same note adds a narrower admin change. In Intune Endpoint Privilege Management, standard users can change IPv4, IPv6, and DNS server values on a device's network adapters, with administrators deciding how that change is elevated. For user-confirmed changes, administrators can require a business justification, Windows authentication, or both. The post does not say Dynamic Permissions is on by default.