Microsoft Defender for Endpoint Plan 2 discovers more than fifty local AI agents on Windows (general availability) and macOS (preview) by observing their real-time activity. The inventory shows the agent, the device, the user account, and the configured MCP servers, both remote and local, without requiring additional deployment. This visibility covers shadow AI that other controls do not detect, according to the announcement from Microsoft Security Blog dated November 5, 2026.
Local AI agent and MCP discovery: real visibility
Detection is based on observing executed activity; an installed but inactive agent does not appear until it generates telemetry. The official support matrix, updated on November 3, 2026, lists more than seventy agents by vendor —OpenAI, Anthropic, Google, GitHub, Amazon, Microsoft, Ollama, Cursor, Windsurf, and others— indicating which combinations discover the agent and MCP on Windows, WSL (preview), and macOS (preview). AI agent support matrix.
Each configured MCP server represents an extension of the user’s privileges toward resources such as GitHub, Kubernetes, databases, or file systems. Defender exposes the endpoint, transport type, and start command of local MCPs (the localMcps field), allowing security teams to map the real attack surface of each agent in the organization.
Discovery requires a Microsoft Defender for Endpoint Plan 2 license (included in M365 E5/E7), commercial cloud, onboarded devices, and Defender Antivirus in active mode with up-to-date platform and engine updates. On macOS the capability remains in preview, so it should not yet be used for regulatory compliance. The matrix clearly distinguishes GA from preview scenarios by operating system and agent.
Support matrix and licensing requirements
To access risk level, indicators, and automatic recommendations, Microsoft 365 E7 or Microsoft Agent 365 together with Defender Plan 2 is required. With only E5 you get inventory and advanced hunting, but without integrated risk posture. Organizations must evaluate whether the upgrade pays off or whether to build their own logic on top of AgentsInfo and the exposure graph. Discover local AI agents.
Technical prerequisites require Windows 10/11 24H2 or later, or macOS 14+, with current monthly updates. Sovereign or national cloud is not supported. These conditions limit immediate deployment in regulated environments or those with slow update cycles, and require planning patch cadence as part of agent governance.
Advanced hunting with KQL: inventory and blast radius
Defender exposes three advanced hunting tables: AgentsInfo (agent profile: vendor, version, host process, trustedProcess, autoApprove, MCP servers, localMcps), ExposureGraphNodes, and ExposureGraphEdges (exposure graph: device, identity, reachable resources, criticality). These tables enable queries for inventory, MCP servers and tools, agents with autoApprove or untrusted process, and ranking of users by blast radius.
A recommended weekly baseline query filters AgentsInfo where AutoApprove is true or TrustedProcess is false, and joins with ExposureGraphNodes to isolate devices with criticalityLevel 0-1. This identifies agents that act without human confirmation or in unverified processes on critical identities, quantifying the real blast radius of each compromised account.
The results feed posture CI/CD gates: block deployments if an agent with autoApprove appears on a critical device, or an MCP targeting production without review. Integration with Log Analytics workspaces and Defender XDR enables automated alerts and response flows, turning hunting into continuous preventive control.
Microsoft Execution Containers: OS-enforced containment
Microsoft Execution Containers (MXC) is now generally available as an OS-enforced containment layer for local AI agents on Windows. It applies least-privilege controls over files, network, processes, and user interactions, moving the trust boundary to the kernel. The agent cannot bypass the policy even if compromised by prompt injection, supply chain, or a malicious model.
Policies are adjustable and can be validated in audit mode before broad enforcement, reducing operational false positives. Future integration with Intune, Entra, and Microsoft Agent 365 will extend enterprise governance and attribution, but is not available today. MXC only covers Windows; there is no documentation for native Linux containers or WSL, whose discovery remains in preview.
This real containment — not an agent promise — complements Dynamic Permissions (task-scoped permissions with continuous reevaluation), Dynamic Agent Risk (dynamic risk assessment), and Dynamic Conditional Access (proportional response: reduce permissions, block resources, require human approval). Together they form a defense-in-depth model where the OS guarantees the boundaries.
Operational recommendations with conditions and limits
Enable discovery now if you meet prerequisites: Plan 2, onboarding, active AV, commercial cloud, Windows 24H2+ or macOS 14+. Remember that it only sees agents with observed activity; installation alone is not enough. Run a weekly baseline hunt with the documented KQL queries and validate findings against the exposure graph to prioritize remediation.
Pilot MXC in a controlled ring: define file/network/process policy, start in audit mode, validate false positives, then move to block. Limit the pilot to Windows; macOS and WSL have no documented MXC containment. Classify and govern MCP servers using the inventory query, tagging those that touch production or regulated data; full visibility only if the agent reports MCP per the matrix.
Review licensing: with E5 you get inventory and hunting, but no risk level or automatic recommendations. Evaluate upgrading to E7/Agent 365 or build your own logic. Include macOS in your roadmap (preview) measuring coverage, but do not block compliance on it. Document and test response to suspicious prompt injection alerts (preview on Windows, agents with native hooks).
Structured reference for readers and AI agents
{
"format": "rafael-fuentes-article/1.0",
"language": "en",
"title": "Microsoft Defender discovers local AI agents and MXC contains them on Windows",
"summary": "Defender for Endpoint Plan 2 inventories 50+ local agents with their MCPs on Windows (GA) and macOS (preview); MXC adds kernel-level containment.",
"author": "Rafael Fuentes",
"publicationDate": "2026-11-06T20:01:35.116+01:00",
"eventDate": "2026-11-05",
"url": "https://falifuentes.com/rafael-fuentes-2026-11-06-pm-en/",
"translation": {
"language": "es",
"url": "https://falifuentes.com/rafael-fuentes-2026-11-06-pm-es/"
},
"topics": [
"AI",
"Artificial Intelligence",
"Compliance and Regulations",
"English",
"OpenAI",
"Supply Chain"
],
"sources": [
"https://www.microsoft.com/en-us/security/blog/2026/11/05/whats-new-in-microsoft-security-november-2026",
"https://learn.microsoft.com/en-us/defender-endpoint/ai-agent-support-matrix",
"https://learn.microsoft.com/en-us/defender-endpoint/discover-local-ai-agents"
]
}