Microsoft Announces November Security Updates for AI Agents, Intune, and Defender
Summary
Microsoft’s November security updates add task-scoped AI agent permissions, Windows agent containment, Intune privilege controls, Defender agent discovery and MDR visibility, and simplified SQL Server protection in Azure Government.
Key points
- Dynamic Permissions scopes an AI agent’s authority to its task; Dynamic Agent Risk and Conditional Access can adjust access as behavior and context change.
- Microsoft Execution Containers is generally available, using OS-enforced least-privilege controls to limit local AI agents’ access to files, networks, processes, and user interactions.
- Intune Endpoint Privilege Management adds controlled elevation for standard users changing IPv4, IPv6, and DNS settings on network adapters.
- A new Defender Experts MDR portal experience consolidates active and completed hunts, findings, and items that may need follow-up.
- The enhanced Defender for SQL Servers on machines agent is generally available for resource- and subscription-level enablement in Azure Government and removes the need for Azure Monitor Agent in this scenario.
- Microsoft Defender now discovers more than 50 supported local AI agents and their configured MCPs on Windows and macOS.
- Secure Now connects information about recent threats with recommended initiatives to help teams prioritize foundational security controls.
Article Details
- Event Type
- Microsoft security product and capability announcements
- Impact
- The announced updates are intended to help organizations scope and adjust AI-agent permissions, contain local agents, manage endpoint privilege elevation, and improve visibility into Defender Experts investigations and local AI-agent activity. Microsoft also announced simpler deployment of Defender for SQL Servers on machines in Azure Government and Secure Now initiatives that connect recent threat information with recommended security controls.
Vendors
Products
Defender Experts MDRNew Microsoft Defender Experts MDR experiences in the Microsoft Defender portal bring ongoing expert work into focus with a consolidated overview page with updated navigation and visibility into hunts.Defender for SQL Servers on machinesThe enhanced agent for Defender for SQL Servers on machines is now generally available for resource- and subscription-level enablement in Azure Government cloud.Microsoft Agent 365enforcing them broadly, while upcoming integration with Microsoft Intune, Microsoft Entra, and Microsoft Agent 365 is intended to extend governance and attribution across the enterprise.Microsoft Defender Antimalware PlatformThis month’s Microsoft Intune and Microsoft Defender updates introduce capabilities across these areas, alongside new Secure AI capabilities for agent access.Microsoft Entravalidate policies before enforcing them broadly, while upcoming integration with Microsoft Intune, Microsoft Entra, and Microsoft Agent 365 is intended to extend governance and attribution across the enterprise.Microsoft Execution ContainersContain local AI agents with Microsoft Execution ContainersMicrosoft IntuneThis month’s Microsoft Intune and Microsoft Defender updates introduce capabilities across these areas, alongside new Secure AI capabilities for agent access.Microsoft Security Exposure ManagementA recent Secure Now update in Microsoft Security Exposure Management also connects information on recent threats to focused initiatives for reducing exposure.