TL;DR
Get business pricing on monitors, keyboards and dev gear
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
Microsoft has announced general availability of Microsoft Execution Containers (MXC), a policy-driven execution layer for containing agents and other untrusted workloads. It lets developers define resource access, such as files and network destinations, and applies those limits through platform-specific containment backends. Some features are Windows-only, and the MicroVM option is experimental.
Microsoft announced on October 7, 2026 that Microsoft Execution Containers (MXC) is generally available, giving developers and IT administrators a policy-based way to limit what AI agents and other workloads can access. Microsoft says MXC applies declared permissions at runtime through platform-specific containers, aiming to keep an agent’s authority within boundaries set outside the agent itself.
With MXC, developers specify required resources, including files and network destinations, in a unified JSON configuration and use a multi-language SDK. Microsoft says MXC maps those requirements to a suitable containment backend on Windows, macOS or Linux. The intended separation is between the workload’s needs and the platform-specific mechanisms enforcing them.
Microsoft describes MXC as usable for containing different parts of an agent system: model-generated output, plugins, tools, an agent harness or the entire agent. The company says policies remain outside the workload’s control, so code running inside the boundary cannot authorize itself to obtain additional access. The blog frames this as a way to reduce the scope of potential harm if untrusted code or an agent behaves unexpectedly.
The options vary by platform and isolation level. A process container is available on Windows 11, macOS and Linux. Windows 11 also supports a session container, which runs in a separate account and session with its own desktop and boundaries for clipboard, interface and input. A Windows Subsystem for Linux container is also Windows 11-only. A MicroVM is listed for Windows 11 and Linux, but Microsoft labels it experimental. The company says MXC support for Windows 365 is generally available, allowing agents to run on Cloud PCs.
Setting Limits Around Agent Access
Agents can work across files, networks and applications, which can make them useful but also gives them the opportunity to affect resources beyond a specific task. MXC matters because it provides a way for an organization or developer to set an execution boundary independently of the agent. In Microsoft’s example, a coding agent may need to edit a repository and read server configuration, but should not be able to change that configuration.
That distinction is important for teams testing or deploying agents with access to development tools and business data. If permissions are enforced outside the agent workload, the agent’s interpretation of a request does not itself expand the access it was granted. However, MXC is a containment mechanism, not a guarantee that an agent will produce correct results or that every risk is eliminated. Microsoft says the available backends have different security properties; organizations must assess which level fits each workload.
Microsoft Execution Containers software
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
Microsoft’s Wider Agent Controls
MXC is one part of a broader set of Windows platform capabilities Microsoft says it is building for agent management. The company groups the effort around containment, identity and manageability: limiting what agents can do, distinguishing agent activity from a person’s activity, and providing organizational tools to govern and monitor that activity.
The October 7 blog says Windows will soon enable Microsoft Entra to help distinguish agent actions from user actions. It also says Microsoft plans to extend Agent 365 controls to local, on-device agents, so IT teams can manage MXC containers, apply policies and monitor activity. Those capabilities are described as upcoming, rather than as features already generally available. MXC itself is the containment layer in this plan; the announcement does not say it replaces identity or monitoring controls.
The product supports several execution models rather than one uniform sandbox. Microsoft lists process containment across three operating systems, while session and WSL containers are limited to Windows 11. The experimental MicroVM option is listed for Windows 11 and Linux. That platform variation means teams should check the specific backend and its availability before relying on a particular configuration.
“An agent cannot be its own security authority.”
— Microsoft, in the Windows Developer Blog announcement
As an affiliate, we earn on qualifying purchases.
Limits and Availability Still Vary
The announcement does not provide independent security testing, comparative performance figures or a detailed account of the limits of each backend. It says their security properties differ and that workloads should be evaluated for fit, but does not quantify how much protection each configuration provides. The MicroVM backend remains explicitly experimental.
Some parts of Microsoft’s wider agent-management plan are also not yet available according to the blog. The timing and full feature set for the planned Microsoft Entra identity support and Agent 365 controls for local agents are not specified. The announcement describes MXC as generally available but does not include pricing, licensing details or a full deployment guide in the supplied material.
Windows container management software
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
More Windows Agent Governance
Microsoft says Windows will soon enable Microsoft Entra to distinguish agent activity from user activity and plans to extend Agent 365 controls to local agents. The company has not provided a release date for those additions in the announcement. Developers and IT administrators can evaluate MXC against their workloads, taking account of which operating systems and containment backends are supported and whether the experimental MicroVM option is appropriate.
As an affiliate, we earn on qualifying purchases.
Key Questions
What is Microsoft Execution Containers?
MXC is a policy-driven execution layer for containing agent workloads and other untrusted or dynamically generated code. Developers declare resources such as files and network destinations, and MXC applies the resulting limits through a platform-specific backend.
Which platforms does MXC support?
Microsoft lists process containers for Windows 11, macOS and Linux. Session containers and WSL containers are listed for Windows 11 only. MicroVM support is listed for Windows 11 and Linux and is marked experimental.
Does MXC prevent agents from making mistakes?
MXC is intended to restrict access to resources beyond the permissions defined for a workload; it does not establish that an agent will behave correctly or eliminate all security risks. Microsoft says backend security properties differ and should be evaluated for each workload.
Are Microsoft Entra and Agent 365 controls available for local agents now?
The blog describes those capabilities as coming soon. It does not give a release date. The announcement says MXC is generally available, while the planned identity and Agent 365 extensions are future Windows capabilities.
Source: hn
Fall Picks
fall essentials
As an affiliate, we earn on qualifying purchases.
