1. Executive summary
Microsoft's November 2026 security update is a product release, not a vulnerability disclosure: it announces new and generally available controls across Intune, Defender and Secure AI, including Microsoft Execution Containers (MXC) for AI agent containment, Dynamic Permissions with Dynamic Agent Risk and Dynamic Conditional Access, Intune Endpoint Privilege Management support for network adapter settings, Defender discovery of more than 50 local AI agents and their MCP configurations, and the enhanced Defender for SQL Servers agent in Azure Government. No CVE, CVSS score, exploitation state or fixed version is given in the announcement, and no threat actor is named. The relevance to EMEA financial services is governance and configuration, not incident response: firms running Microsoft 365, Intune, Defender or AI agents on managed endpoints have new controls available and new defaults to decide on. There is no exploitation to contain and no patch deadline to meet from this item.
2. Regulatory framing
No specific DORA/NIS2 article is directly engaged by this item.
3. Technical analysis & attack chain
This item is a vendor capability announcement. It contains no attack chain, no exploited component, no CVE and no victim. The technical content that matters to a defender is the set of controls Microsoft has shipped or made generally available, and what each one changes in a Microsoft estate.
AI agent containment and permissions. Microsoft Execution Containers (MXC) is now generally available. It is an operating system-enforced containment layer for AI agents that applies least-privilege controls across files, networks, processes and user interactions, with additional isolation options for higher-risk scenarios. Policies can be tuned and validated before broad enforcement. Integration with Microsoft Intune, Microsoft Entra and Microsoft Agent 365 is described as upcoming, not shipped, so governance and attribution across the enterprise are not available from MXC today.
Dynamic Permissions gives an agent its own permissions and authority, scoped to its current task and only for as long as the task requires. Dynamic Agent Risk assesses whether the agent's authority aligns with its changing behaviour and context. Dynamic Conditional Access can then narrow permissions, restrict access to resources, or require human approval for higher-impact actions. The announcement does not state which licences or product tiers are required, nor a general-availability date for these three capabilities.
Endpoint privilege. Microsoft Intune Endpoint Privilege Management adds system settings support: standard users can change IPv4, IPv6 and DNS server values on their device's network adapters through Endpoint Privilege Management, with administrators deciding how those changes are elevated. For user-confirmed changes, administrators can require a business justification, Windows authentication, or both before the change is applied. Tenant onboarding updates are also included.
Defender coverage. Microsoft Defender extends discovery to supported local AI agents and their configured model context protocols (MCPs) across Windows and macOS, now generally available. Defender discovers more than 50 supported local AI agents by observing their activity and correlates the agent, device, account and configured MCP context. The enhanced agent for Defender for SQL Servers on machines is generally available for resource- and subscription-level enablement in Azure Government cloud; it uses existing SQL infrastructure and removes the need to deploy the Azure Monitor Agent for that scenario. New Defender Experts MDR experiences in the Defender portal add a consolidated overview page, updated navigation and visibility into active and completed hunts.
Exposure management. A Secure Now update in Microsoft Security Exposure Management pairs information about recent threats with focused initiatives across security domains, so teams can identify foundational controls needing attention and review recommended actions. The announcement names excessive permissions, unprotected authentication flows and exposed systems as weaknesses AI-enabled attacks use, but gives no specific campaign, actor or indicator.
Assessment. The announcement does not state which agent platforms MXC supports, whether Dynamic Permissions applies to non-Microsoft agents, or what telemetry the local agent discovery produces. Adverse Trace assesses that the operational value of these controls depends on inventory and ownership data that most firms do not yet hold for their agent estate; that is an assessment, not a finding in the source. The related SecurityWeek and Help Net Security coverage describes the same Dynamic Permissions, Dynamic Agent Risk, Dynamic Conditional Access and Guardian Agents programme, including Microsoft's position that agents should be treated as insiders and that discovery now covers 60 types of local agents including Claude Code, OpenAI Codex and GitHub Copilot. Those figures come from that coverage and are not in Microsoft's own post, which states more than 50 supported local AI agents; treat the 60 figure as single-sourced to SecurityWeek and Help Net Security.
4. Mitigation & containment
There is no vulnerability to patch in this item. The actions below are configuration and governance steps drawn from the announcement.
P1 within 24h
- Confirm whether MXC is enabled or planned in your tenant, and if so record which agents run under it and which files, network destinations, processes and user interactions each policy permits. MXC is generally available, so the policy set can be reviewed now.
- Inventory local AI agents and MCP configurations on managed Windows and macOS endpoints using Defender's local agent discovery (generally available, more than 50 supported agents), and record agent, device, account and MCP context for each.
- If you run SQL Server on machines in Azure Government, evaluate the enhanced Defender for SQL Servers agent at resource or subscription level, which removes the need to deploy the Azure Monitor Agent for that scenario.
P2 within 72h
- Decide whether Dynamic Permissions, Dynamic Agent Risk and Dynamic Conditional Access are in scope for your tenant, and identify which high-impact agent actions will require human approval. The announcement does not state licensing or availability dates, so confirm these with your Microsoft account team before committing.
- Review Intune Endpoint Privilege Management elevation rules for network adapter changes: decide whether IPv4, IPv6 and DNS server changes by standard users require a business justification, Windows authentication, or both.
P3 within 7 days
- Adopt the Secure Now initiatives in Microsoft Security Exposure Management that map recent threats to foundational controls, and assign owners to the excessive-permission, authentication-flow and exposed-system items the announcement names.
- Review the Defender Experts MDR overview page for active and completed hunts and any findings requiring follow-up.
- Note that MXC integration with Intune, Entra and Microsoft Agent 365 is described as upcoming; plan for it but do not assume it is available.
5. Indicators of compromise
No indicators of compromise available in the source material.
6. Detection
Insufficient indicators to author detection rules.
7. Sources
- Microsoft Security Blog, "What's new in Microsoft Security: November 2026", https://www.microsoft.com/en-us/security/blog/2026/11/05/whats-new-in-microsoft-security-november-2026/, 2026-11-05
- SecurityWeek, "Microsoft Targets Rogue AI Agents With Dynamic Permissions, Risk Scoring", https://www.securityweek.com/microsoft-targets-rogue-ai-agents-with-dynamic-permissions-risk-scoring/
- Help Net Security, "Microsoft wants to limit AI agents' permissions when they stray from the job", https://www.helpnetsecurity.com/2026/10/20/microsofts-ai-agents-threats-guardian-agents/, 2026-10-20
8. Adverse Trace position
Adverse Trace assesses this item as informational: no CVE, no exploitation and no named actor, so it carries no incident-response urgency for EMEA financial services clients. The client impact is governance. Firms deploying AI agents on Microsoft platforms now have an operating-system containment layer (MXC) and task-scoped permission controls available, and firms that do not yet know which agents and MCP servers run on their endpoints can start that inventory with Defender's local agent discovery. The 60-agent discovery figure and the Guardian Agents detail rest on SecurityWeek and Help Net Security coverage rather than Microsoft's own post; verify against your tenant before relying on them. We will track Microsoft's stated upcoming MXC integration with Intune, Entra and Agent 365, and will issue a follow-up if Microsoft publishes licensing, availability or support details that change the deployment picture. Clients who want help scoping agent inventory or MXC policy review should contact their Adverse Trace account lead.
Published via PulseTrace — Adverse Trace threat intelligence.