The agent action gate
The fictional bank records the exact action and approver.
Coming
See every demonstrationWINDOWS 365 FOR AGENTS
Decide whether a computer-using agent may run in a Cloud PC you control.
An agent that drives a desktop can open any application the session can reach, and Cloud PC isolation does not by itself make its business actions approved. In two weeks we threat-model your agent scenarios, map the identity, provisioning and data flows, write the reference architecture and security baseline, and give you a pilot test plan with the human approval seams and the failure cases written in.
01 Source02 Boundary03 Human decision04 Evidence
HOW IT WORKS
The control path in practice.
- Week one: use-case intake, threat modeling, identity and provisioning review, data-flow mapping, and the licensing and service prerequisites.
- Week two: security baseline mapped to your policy, pilot architecture, lab validation plan, operating runbook and the executive decision.
- Every production action sits behind a named human approval seam, with rejection, timeout and failure cases in the test plan.
- You receive the threat model, the reference architecture, the baseline and exception register, the pilot test plan and the findings report.
THE PROBLEM
Why is a Cloud PC not an approval?
Because isolation says where the agent runs, not what it may do. A computer-using agent in a session can reach every application the session can, and the question that matters is which actions are information requests, which trigger a model-led review, and which need an enforced human approval before they happen.
The assessment separates those three classes for each of your scenarios and writes the rejection, timeout and failure cases into the pilot test plan, so the first production action waits at a seam somebody named.
THE MICROSOFT INSIGHT
What identity does the agent act under?
Its own: Microsoft Entra Agent ID is generally available and gives each agent its own identity with owners and sponsors, Conditional Access templates for autonomous and on-behalf-of agents, and sponsor lifecycle workflows, with the agent security features licensed through Microsoft Agent 365.
Microsoft Entra Agent ID is generally available to every Microsoft Entra customer and gives each AI agent its own identity with owners and sponsors, Conditional Access templates for high-risk, autonomous and on-behalf-of agents, and sponsor lifecycle workflows; extending Entra security features to agents needs a Microsoft Agent 365 license, and the admin center creation wizard and agent user accounts remain in preview. (Microsoft Learn, checked Nov 4, 2026)
Give the agent its own identity and the session log names the agent. Let it borrow a person's login and the log names the person, who was at lunch.
THE METHOD
What happens in the two weeks?
Intake and threat model first, then architecture, baseline, test plan and decision.
- Week 1: use-case intake, threat modeling, identity and provisioning review, data-flow mapping, licensing and service prerequisites.
- Week 2: security-baseline mapping to your policy, pilot architecture, lab validation planning, operating runbook, executive decision.
- Throughout: discovery is read-only; active validation runs in a lab you approve with synthetic data and no production credentials.
THE GATE
Can an agent's action be stopped before it runs?
At the tool call: Microsoft Defender real-time protection evaluates Agent 365 tool invocations made through Work IQ MCP before they run, with an audit default and custom rules that can block, and the architecture places production actions behind that gate and a named human seam.
Microsoft Defender real-time protection evaluates Agent 365 tool invocations made through Work IQ MCP before they run; the default rule audits and custom rules can block matching actions. (Microsoft Learn, checked Oct 31, 2026)
Write the seam and the blocking rule into the architecture and the pilot proves them. Leave them out and the first incident report describes an agent that did exactly what it was told.
WHAT IT IS NOT
Does the assessment provision Cloud PCs or run agents in production?
No. Production Cloud PC provisioning, license purchase, production credential use and unattended production execution are excluded, as are general Azure Virtual Desktop work and employee Windows 365 migration. It covers one tenant and up to three prioritized agent scenarios.
You confirm the Windows 365 for Agents and Agent 365 prerequisites, name the endpoint, identity, security, AI platform, network and application owners, and provide the approved lab. Access is limited to thirty days. The Secure Azure Virtual Desktop service for human workspaces and the broader Agent 365 readiness assessment are scoped separately, and the accepted agent inventory is reused.
AFTER TWO WEEKS
What will be working after two weeks?
- You hold a computer-using agent threat model and risk register for your scenarios.
- You hold the Windows 365 for Agents reference architecture: provisioning, isolation, Entra ID, Intune, Defender, network, session, logging and teardown.
- You hold the security baseline and exception register mapped to your policy, and the pilot test plan with the human approval seams and the failure cases.
- You hold the two-week findings report, the implementation backlog and a sixty-minute executive readout.
The work is delivered remotely inside your own Microsoft tenant, wherever your business is, and on site only when the work needs it.
HONEST ABOUT LIMITS
What this does not do yet
It does not inspect what a local agent does on the endpoint with a generally available control today. Microsoft Defender for Endpoint local AI agent runtime protection, in public preview since June 2026, inspects the prompts, tool calls and tool responses of local agents on Windows endpoints and can block risky activity; Codex CLI and the GitHub Copilot app have been covered since July 2026. (Microsoft Learn, checked Nov 4, 2026, preview) Microsoft Defender for Endpoint local AI agent runtime protection, which inspects prompts, tool calls and tool responses and can block risky activity, is in public preview; the architecture names it as a candidate for the next review and relies on the approval seam and the Agent 365 gate meanwhile.
It does not provision production Cloud PCs or run an agent unattended in production.
It does not buy licenses; the prerequisites are confirmed before the assessment starts.
THE ONE THING TO REMEMBER
Isolation is where the agent runs; approval is what it may do. Write both down.
Said another way: threat model, identity, seam, test plan, decision.
Said a third way: an agent with a desktop and no seam is an employee with no manager.
SHOW YOUR WORK
See the control path on a fictional bank.
DIRECT ANSWERS
Questions before you decide.
How many scenarios does it cover?
One Microsoft 365 tenant and up to three prioritized computer-using agent scenarios in two weeks. The accepted agent inventory is reused by the Agent 365 readiness work if that follows.
What do we provide?
Confirmation of the Windows 365 for Agents and Agent 365 prerequisites, named owners for endpoint, identity, security, AI platform, network and applications, and a lab you approve with synthetic data and no production credentials.
What is excluded?
Production Cloud PC provisioning, license purchase, production credentials, unattended production execution, general Azure Virtual Desktop work, employee Windows 365 migration, and any deployable VM or application product. No software subscription is included.
How do we start?
A scoping call confirms fit, schedule, scope and the service fee before any agreement; delivery is remote and Microsoft licenses and consumption are separate. The Microsoft Marketplace listing is pending; until it is live the engagement is quoted directly. No price appears on this site.
NEXT STEP
Start with a boundary you can explain.
Choose a focused check, or speak with the team about the workflow you need to improve.