Windows 11 limits what AI agents can access
4 min read
Microsoft Execution Containers have been generally available on Windows 11 since 7 October. They let companies define which files and networks AI agents can access. Windows enforces these rules during execution. Microsoft has only announced central management through Entra, Agent 365 and Intune.
Key takeaways
- The execution environment for AI agents is ready to use. Microsoft Execution Containers enforce which files and networks an agent can use at runtime.
- Integration with Entra, Agent 365 and Intune is pending. Microsoft says it is coming soon. Support in Windows 365 is already generally available.
- Several AI agent providers already support the containers. OpenAI’s Codex and GitHub Copilot are already compatible. Anthropic has announced support for Claude Code.
Related:Bitkom: 90 percent of companies want General Data Protection Regulation (GDPR) reform / Germany’s Mittelstand cannot find successors for thousands of businesses
Runtime rules for agents
What is MXC? MXC stands for Microsoft Execution Containers, a Windows 11 feature for AI agents generally available since 7 October 2026. Organisations use policies to define which files and networks an agent can access. Windows enforces these rules at runtime. The agent runs in one of four isolated environment types.
Four environments and three modes
MXC offers four execution environments for isolation: process containers, session containers, WSL containers and experimental MicroVMs. In a session container, the agent works under its own Windows account in a separate session. WSL stands for Windows Subsystem for Linux, a Linux environment within Windows. MicroVMs are particularly lightweight virtual machines, computers emulated in software.
Three modes govern what happens when access falls outside the policy. Enforcement enforces the boundary without producing a report. Learning blocks access and logs it. Permissive allows access and logs it.
According to heise online, agents on Windows are set to run as separate users with their own access restrictions. An agent using its own account would then be denied access to SharePoint content that the user can open, for example. SharePoint is Microsoft’s platform for corporate documents and intranets. The required Microsoft Entra integration is expected soon.
Central management only announced
The execution environment is ready to use. Microsoft has announced central management integration as coming soon. Three components are pending:
| Component | Status |
|---|---|
| Microsoft Execution Containers on Windows 11 | generally available |
| MXC support in Windows 365 | generally available |
| Distinguishing agent and user activity with Microsoft Entra | announced as coming soon |
| Agent 365 controls for local agents | announced as coming soon |
| Intune policies for MXC process containers | announced as coming soon |
Microsoft Entra, the identity and access management service, is intended to distinguish agent activity from user activity. Agent 365, Microsoft’s AI agent management platform, is set to extend to local agents. Intune, the corporate device management service, is set to gain policies for MXC process containers.
MXC support is already generally available in Windows 365, the cloud-based Windows PC.
Microsoft also qualifies its announcement. Governance at scale may require additional services. This refers to the rules and controls a company uses to manage its agents. Feature availability and timing also vary by device, market and chip platform.
Support from agent providers
OpenAI’s Codex and GitHub Copilot already support the containers. Anthropic has announced support for Claude Code. The table shows the full list.
| Status | Providers |
|---|---|
| already support MXC | Codex (OpenAI), GitHub Copilot, OpenClaw, Replit, LM Studio, OpenShell (NVIDIA), Unsloth AI |
| support announced | Claude Code (Anthropic), Box, Egnyte, Heidi Health, Hermes Agent (Nous Research), Manus, Perplexity, Raycast, Simular |
| native app with MXC integration | Muse for Windows (Meta) |
Box and Egnyte bring two enterprise file storage providers into the mix. Meta’s personal agent Muse for Windows comes as a native Windows app with MXC integration.
Frequently asked questions
Do Execution Containers run only on Windows?
Process containers also run on macOS and Linux. Experimental MicroVMs also run on Linux. Session containers and WSL containers are available only on Windows 11.
How do the three modes differ?
Enforcement enforces the policy without producing a report. Learning blocks access outside the policy and logs it. Permissive allows such access and logs it too. Activity reporting is available only on Windows.
Can companies manage the containers centrally yet?
Support in Windows 365 is generally available. Microsoft has only announced integration with Entra, Agent 365 and Intune. Intune policies for process containers are expected to follow.
Read more on MyBusinessFuture
MyBusinessFutureIndustry in August: large orders vanish, core business holds upMyBusinessFutureOne year of mandatory electronic patient records (ePA): connected but barely usedMyBusinessFutureNeuralink restores the voice of a patient with amyotrophic lateral sclerosis (ALS)More from the MBF Media Network
cloudmagazinKubermatic CEO Scheele: Run AI models like softwareDigital ChiefsGoogle pays publishers for AI answersSecurityTodayCyber insurance: lack of evidence puts the policy at riskImage credit: AI-generated (October 2026)
Image source: AI-generated (October 2026)
Translated from the German original using artificial intelligence. The German version is authoritative.
Also available in
