Windows Agentic OS: What IT Leaders Need to Know About MXC and Agent 365
Windows 11 is now an agentic OS. See what MXC, Agent 365 and Intune let IT control today, what is in preview, and how to restrict AI agents.
On October 7, 2026, Microsoft held a Windows event in San Francisco. Windows Latest counted the words of the presenters. They said agent, agents or agentic 100 times. They said Windows 11 three times.
Many IT administrators asked Microsoft for performance fixes. The event gave most of its time to AI agents.
For IT teams, one change is important. Windows now keeps an AI agent separate from the person who uses the device. The agent has its own sandbox, its own identity and its own policy. Microsoft calls this strategy hybrid intelligence. The result is the Windows agentic OS.
IT leaders ask one question first: can we disable these features? You can restrict more than many users think. You cannot control all of the features yet. The controls that you can use depend on your Windows edition and your Microsoft licenses.
When you disable all agent features, the risk continues. Developers already use Codex, Claude Code and OpenClaw on their laptops. These agents operate when Windows agent features are on and when they are off. This is shadow AI: AI tools that employees use without IT approval. IBM measured the cost of AI without controls in 2026.
Agent control on Windows has three layers. Each layer has a different status. Plan for all three layers.
What is the Windows agentic OS? Hybrid intelligence explained
The Windows agentic OS is Windows 11 with new functions for AI agents. The agents do tasks for you, and the operating system applies rules to them.
The Microsoft October 7 announcement gives a definition of hybrid intelligence. Agents run locally when that is the best option. They connect to the cloud when it is necessary. They operate with the security and management controls that organizations expect.
There is no Windows 12. All the new functions are for Windows 11. The Windows 11 26H2 administrative templates became available on September 29, 2026. They already contain the first agent settings.
Microsoft uses three principles for agent security:
- Containment controls the data and resources that an agent can access.
- Identity records which agent did an action. Then IT can keep agent activity separate from user activity.
- Manageability sends agent activity to Agent 365 and Intune. IT uses these tools to set policies and to monitor agents.
This model took one year. In November 2025, Pavan Davuluri wrote on X that Windows will become an agentic OS. Davuluri is the leader of Windows and Devices at Microsoft. Most replies to his post were angry.
At Ignite 2025, Microsoft kept agent features off by default. Microsoft also said that IT will get policies in Intune, Entra and Group Policy. The timeline shows the events that followed.
Windows agentic OS release status: available, in preview and announced
Microsoft gave information about three types of components. Some are available, some are in preview, and some have no date. Many news reports do not show the difference between these types.
The tracker below shows the Microsoft status for each component that is important to IT. Use the filters to find the components that you can deploy this quarter.
Containment and cloud agents are generally available now. The controls for agents on local PCs are not available yet. Microsoft announced these Intune and Entra controls, but gave no date.
Microsoft Execution Containers (MXC): how agent containment works on Windows
Microsoft Execution Containers (MXC) is a layer that runs untrusted code and agent workloads under a policy. MXC became generally available on Windows 11 on October 7, 2026. The SDK is open source under the MIT license. It has Rust, .NET and Node.js versions. You do not pay a license fee for MXC.
How MXC policy controls file, network and UI access
A developer writes a JSON policy for each agent. The policy gives the paths that the agent can read and write. It also gives the network access, the UI access and the containment level. UI access is, for example, access to the clipboard and the display.
MXC selects a backend. Then Windows applies the policy while the agent runs. The agent cannot change the policy. It cannot give itself more access.
MXC has three modes:
- Enforcement mode blocks all access that the policy does not give.
- Learning mode blocks this access and records it.
- Permissive mode lets this access occur and records it.
On Windows, Learning mode and Permissive mode make an agent activity report. Use this report to write a least-privilege policy.
Organizations will add their own rules through Intune. Microsoft said that this Intune policy will be available soon. Today, only the developer policy applies.
MXC isolation levels: from process containers to Windows 365 for Agents
The default Windows backend is a process container. It uses AppContainer and needs Windows 11 24H2 (build 26100) or later. Other backends give stronger isolation, but two Microsoft sources do not agree about their status.
The GA announcement shows session containers and WSL containers with no experimental label. The MXC README shows them as experimental. Use the README status for production plans.
AI agents that work with MXC
Microsoft names seven agents that work with MXC today. OpenAI Codex and GitHub Copilot are two of them. Nine more vendors made a commitment to add MXC support. Anthropic is one of them, for Claude Code.
If you compare AI coding assistants, ask each vendor about sandbox support.
Is MXC a security boundary?
The MXC README gives a clear answer: not yet. It says that no MXC profile is a security boundary at this time. This statement stays in the README after the GA announcement.
The Microsoft GitHub Copilot sandbox post shows two more gaps. The Copilot built-in file tools and the remote MCP servers operate outside OS isolation.
Use MXC as one layer of protection. For agents that use sensitive data or run automatically, add a stronger outer layer.
Microsoft Agent 365: agent identity, control and price for Windows agents
Agent 365 is the Microsoft control plane for AI agents. It became generally available on May 1, 2026. It puts these items in one console: an agent registry, Microsoft Entra agent identities, activity reports, and Defender and Purview protection.
How Microsoft Entra Agent ID keeps agent actions separate from user actions
Agent 365 gives each agent its own identity in Microsoft Entra. This identity is separate from all human users. The keynote security demonstration used this separation. IT-Connect reported these steps:
- A GitHub Copilot agent read malicious instructions in a web page.
- The agent tried to do the instructions.
- Microsoft Defender blocked the action.
- The agent lost access to SharePoint. The user continued to work.
On local PCs, this separation is not available yet. Microsoft said that Windows will soon let Entra identify agent activity in Agent 365. Today, the separation is available for agents in Windows 365 for Agents. There, Conditional Access applies to agent users.
If your users sign in to on-premises Active Directory, first do the move to Entra ID.
What Agent 365 does for local Windows agents today
Today, Agent 365 can find agents on local devices. Central control of local agents is not available yet. The Microsoft licensing FAQ lists four free functions for Microsoft Cloud customers:
- Agent identity
- The agent registry
- Discovery of AI on endpoints
- A block on unsanctioned local endpoint agents
Frontier program customers can also find OpenClaw on devices. They can block it with Intune policies.
Agent 365 price and license rules
Agent 365 costs $15 per user per month as a standalone product. It is also part of Microsoft 365 E7, at $99 per user per month. E7 also has E5, Microsoft 365 Copilot and the Entra Suite.
You buy Agent 365 per user. Agents do not need their own licenses. Blueprints and agent instances do not count as license units.
The standalone price has a prerequisite. Enterprise users must have one of these licenses:
- Microsoft 365 E5
- Microsoft 365 E3, or Office 365 E3 with EMS E3, plus the Defender Suite and the Purview Suite
Users with only E3 and Copilot cannot buy Agent 365. Signed contracts stay valid until renewal.
Windows 365 for Agents: when to run agents on a Cloud PC
Windows 365 for Agents gives each agent its own Cloud PC. Each Cloud PC is Entra-joined and Intune-managed. The service became generally available in the week of June 1, 2026. After that date, Microsoft added Conditional Access for agent users and an Intune security baseline.
Microsoft charges $0.40 per VM per hour, as a separate line item. You also need Agent 365, Intune and an Azure subscription.
Use Windows 365 for Agents first for these agents:
- Agents that run automatically, with no user present
- Agents with access to large quantities of data
- Agents that you do not want on an executive laptop
How to disable or restrict Windows agentic OS features with Group Policy and Intune
You can disable or restrict most native agent features in Windows today. For this, your devices must run Windows 11 Enterprise or Education.
The settings are in the WindowsAI Policy CSP for Intune. In Group Policy, they are in Windows Components > Windows AI in the 26H2 templates. If you plan to move from ConfigMgr, refer to this SCCM to Intune guide.
What Windows agent connectors are
Agent connectors are MCP servers in the Windows On-Device Agent Registry. Agents use this registry to find tools, for example File Explorer and Settings. A connector policy controls if agents can use these tools.
The default value is user in control. With this value, each user decides until you set a policy.
The Windows 11 Pro gap
The Microsoft CSP reference shows that all agent connector policies exclude Windows 11 Pro. On Pro devices, you can disable Click to Do and control Recall. You cannot force-disable connectors, allowlist MCP servers or decrease the consent duration.
The Microsoft documents also show the connector policies as Insider Preview. But the 26H2 templates contain the same settings. Test the settings on your builds before you use them in production.
If agent users have Windows 11 Pro, use one of these options:
- Upgrade the users to Windows 11 Enterprise.
- Run their agents in Windows 365 for Agents.
- Use other controls, for example App Control for Business.
Also remove local administrator rights. Only administrators can enable Experimental agentic features.
Baseline settings for production devices
Start with strict settings. Then make exceptions where they are necessary. Use this baseline for production rings this quarter.
Why an off switch for the agentic OS does not remove AI agents
When you disable connectors, agents cannot use the Windows built-in tools. But a developer can still install a coding agent. This agent runs shell commands with the rights of the user. A Microsoft GitHub Copilot post says that these commands get the access of the user account by default.
Shadow AI occurs in this gap. IBM found shadow AI in 43% of incidents in its 2026 study. MXC sandboxes, agent identity and Agent 365 discovery give you control of agents. An off switch removes that control.
Before you approve an agent, audit your endpoint security stack. Examine how the stack identifies agent activity.
Copilot hybrid intelligence: what it can access on employee PCs
Copilot will get three local functions on Copilot+ PCs: local context, local actions and local models. Microsoft said that these functions will become available in the next months. Each function operates only with the permission of the user.
IT does not have a policy for these functions yet. The Microsoft announcement gives no admin control for local context or local actions. It also does not say if the content that Copilot reads locally stays on the device.
Before these functions reach your devices, ask your Microsoft account team for a written management plan. Also ask for the data flow documents. Copilot will read local files together with SharePoint and OneDrive data. For this reason, first remove the access that users do not need.
Recall is a different function with its own policies. On managed devices, Recall is off by default. Recall saves snapshots only after each user gives permission.
The Copilot+ PC name is also less clear now. In September, Brett Ostrum of Microsoft Surface spoke to Windows Central about the new Surface devices. These devices meet the Copilot+ requirements, but they do not have the Copilot+ PC name.
The Microsoft post of October 7 still uses Copilot+ PCs as the hardware level for these functions. The published requirement is an NPU with 40+ TOPS and 16 GB of RAM.
Hardware and license costs of the Windows agentic OS
Most parts of the agentic OS operate on the hardware that you have now. MXC needs Windows 11 24H2 or later. The Copilot local functions need a Copilot+ PC. Only large local models need new hardware with a large quantity of memory.
The Microsoft MAI Code 1.1 Flash model shows the top hardware level. The quantized local version is a 53 GB mixture-of-experts model. It has 137 billion total parameters and 6.8 billion active parameters. Its peak memory use is 75.5 GB at a 256K context. Microsoft benchmarks show results that are near the results of the cloud version.
These numbers come from Microsoft, on the Microsoft runtime. Test the model with your own code before you set a hardware budget.
The Surface Laptop Ultra uses the NVIDIA RTX Spark chip, which has an Arm architecture. Its price starts at $2,599, and it ships on October 16. Because RTX Spark uses Arm, test VPN clients, security agents and drivers in Prism emulation before you buy.
License costs increase faster than hardware costs. Agent 365 seats, Windows 365 for Agents hours and usage-based Copilot functions have separate bills. One agent Cloud PC that runs all the time costs approximately $292 each month (730 hours at $0.40). Use the calculator to find your own costs.
A 30/90/180-day plan to control Windows AI agents
Do the work in the sequence of the Microsoft releases:
- Restrict the native features now.
- Test containment with developers next.
- Move to central enforcement when the Intune and Entra controls are available.
The last phase depends on the Microsoft roadmap. If the Intune policy for MXC or the Entra agent separation is late, keep the 90-day controls. Examine the release status each month.
Also put agent identities into the same review cycle as human identities. Make sure that your identity governance platform can review non-human identities.
Do you need tools to control AI agents?
Tell us about your environment. We will match you with endpoint, identity and AI security vendors that fit. Your information stays anonymous until you choose to talk, and the service is free to you.
FAQ
Can you disable agentic features in Windows 11?
Yes, you can disable most of them. On Enterprise and Education, use Group Policy or Intune to do these steps:
- Force-disable agent connectors.
- Disable the Settings agent and Click to Do.
- Remove Recall.
Experimental agentic features are off by default. Only an administrator can enable them.
Is the Windows agentic OS on by default?
No. The main agent features are off by default. Experimental agentic features are disabled, and Recall is off on managed devices. The Copilot local functions ask for the permission of the user.
Agent connectors have the default value user in control. With this value, users decide until you set a policy.
Do Windows AI agent controls work on Windows 11 Pro?
Only some controls work on Pro. The Microsoft CSP reference excludes Pro from the agent connector, consent duration and Settings agent policies. On Pro, you can control Recall and disable Click to Do.
Do you need Agent 365 to use MXC?
No. MXC is a free, open-source containment layer, and developers put it into their agents. Agent 365 is the paid control layer. Microsoft plans to let Agent 365 manage MXC containers when the on-device controls are available.
How much does Agent 365 cost?
Agent 365 costs $15 per user per month as a standalone product. It is also part of Microsoft 365 E7, at $99 per user per month. Enterprise users need an E5-class base license. Agents do not need their own licenses.
Does Windows hybrid intelligence send data to the cloud?
It can. Hybrid intelligence sends each task to a local model or to the cloud. Microsoft did not say that the content that Copilot reads locally stays on the device. The Microsoft GitHub Copilot post also says that a local model does not make a session offline.
Will Microsoft release Windows 12?
No. Microsoft announced hybrid intelligence and agent controls for Windows 11. The first agent policies are in the Windows 11 26H2 templates.
