Local coding agents can access repositories, launch tools and use Model Context Protocol (MCP) servers without appearing in the traditional software inventory. Microsoft Defender for Endpoint can now list them on Windows and macOS, but risk assessment and runtime protection follow different licences and availability statuses.
What has been available since October 2026
The Microsoft Defender for Endpoint what's new documentation confirms that local AI agent discovery has been generally available since October 2026 on Windows and macOS. It requires Defender antivirus platform 4.18.26090.9 or later on Windows, and Microsoft Defender for Endpoint 101.26072.0017 or later on macOS.
Discovery in Windows Subsystem for Linux (WSL) remains in preview. This status must appear explicitly in the acceptance criteria if development teams run their agents in WSL.
July 2026
Risk assessment in preview
Microsoft introduces an assessment based on configuration, access, activity, device and user context, and active alerts.
October 2026
Discovery generally available
The local agent inventory reaches general availability on Windows and macOS. WSL remains in preview.
November 5, 2026
Coverage extended to more than 50 agents
Microsoft announces that Microsoft Defender for Endpoint now recognises more than 50 local AI agents by observing their activity.
The first announcements in June 2026 mentioned between 20 and 25 agents. That estimate is now outdated, according to the Microsoft Security roundup for November 2026.
What Microsoft Defender for Endpoint actually observes
Discovery does not rely solely on the presence of an executable. Microsoft Defender for Endpoint must observe the agent's activity before creating the corresponding entry. A tool that is installed but never used may therefore remain absent from the inventory.
The documented path in the portal is Assets > AI agents > Local agents tab. The record links the agent to its device, the observed account and the configured MCP servers. It also shows the vendor, the host process, whether that process is approved or not, and the autoApprove option.
Installation alone does not trigger inventory
After installation, the agent must perform benign, observable activity. Reporting MCP configurations additionally requires Microsoft Defender Antivirus to run in active mode with real-time protection.
Discovery does not require enabling agent runtime protection. Some Visual Studio Code extensions can also be inventoried without active antivirus mode. This exception does not extend to the detection of MCP configurations.
This separation is structural: the inventory answers the question "which agents are in use?" It does not prove that their actions are controlled, or that their permissions are appropriate.
Licences and prerequisites to check before testing
Microsoft Defender for Endpoint Plan 2 is enough to display the inventory and query the AgentsInfo table in Advanced Hunting. It does not give access to the risk level, the associated indicators or the recommendations.
These assessment features require Microsoft 365 E7, or Agent 365 combined with Microsoft Defender for Endpoint Plan 2. Without this licence, the record and its relationships remain visible, but risk analysis cannot serve as a validation criterion.
| Capability | Defender for Endpoint Plan 2 | Microsoft 365 E7 | Agent 365 with Plan 2 |
|---|---|---|---|
| Local agent inventory | âś“ Included | âś“ Included | âś“ Included |
| AgentsInfo table | âś“ Included | âś“ Included | âś“ Included |
| Device, account and MCP servers | âś“ Included | âś“ Included | âś“ Included |
| Risk level and indicators | âś— Not included | âś“ Included | âś“ Included |
| Risk-related recommendations | âś— Not included | âś“ Included | âś“ Included |
Prepare the test machine
- Use a Windows or macOS device onboarded to Microsoft Defender for Endpoint
- Check Defender antivirus platform
4.18.26090.9or later on Windows - Check Microsoft Defender for Endpoint
101.26072.0017or later on macOS - Enable active antivirus mode and real-time protection if MCP configurations must be discovered
- Confirm Microsoft Defender for Endpoint Plan 2 is present for the inventory
- Confirm Microsoft 365 E7, or Agent 365 with Plan 2, before testing risk assessment
- Grant only the RBAC permissions needed to view
Assetsand use Advanced Hunting
Implementation: validate an agent in a test tenant
No PowerShell module is required. The check is done in the Microsoft Defender portal and produces two results: a record in the local agent inventory and observations in AgentsInfo.
The scenario can use an isolated development machine, a test account and a repository free of secrets. If the assessment later includes runtime protection, Microsoft documents Claude Code, GitHub Copilot CLI, Codex CLI and OpenClaw, among others, as supported agents.
Check the machine's telemetry
Confirm the machine's onboarding, the minimum versions and the antivirus mode. For an MCP test, also check real-time protection before installing the agent.
Install an authorised coding agent
Use the vendor's procedure and an agent approved for the lab. Do not reuse a production account or a repository containing tokens, certificates or sensitive environment variables.
Generate low-risk activity
Ask the agent to read a README file, explain a function or analyse a demo repository. This activity gives Microsoft Defender for Endpoint a signal to observe without allowing any sensitive modification.
Check the agent record
Open Assets > AI agents > Local agents tab. Check the vendor, the host process, its approval status, autoApprove, the device, the account and any MCP servers.
Confirm telemetry with Advanced Hunting
The following Kusto Query Language (KQL) query returns up to 100 observations from the dedicated table. It is read-only.
1// Displays up to 100 local AI agent observations2// to confirm that telemetry reaches Microsoft Defender XDR.3AgentsInfo4| take 100Review the risk indicators
If the licence allows it, open the agent's assessment. Look in particular for the Running on a Critical Device and Used by a Critical User indicators, then check whether the lab context justifies their presence.
Separate dynamic permissions from the Defender test
Do not validate a dynamic permissions requirement from the inventory record alone. No corresponding field or path is documented in the local discovery feature. Treat this need as a separate workstream tied to agentic governance and Project Perception.
Microsoft does not provide a guaranteed delay here between activity and the agent appearing. An acceptance protocol should therefore record the time of the action, the time of the first observation and the machine's antivirus settings, without imposing an arbitrary threshold.
Assessment, runtime and Project Perception are not the same thing
Inventory, risk assessment and runtime blocking are three different controls. Microsoft Project Perception adds a fourth layer oriented towards agentic security systems.
| Capability | Status in November 2026 | Main purpose | Point to watch |
|---|---|---|---|
| Local agent discovery | Generally available on Windows and macOS | Inventory the agent, machine, account and MCP servers | WSL remains in preview |
| Risk assessment | Preview since July 2026 | Correlate configuration, access, activity and context | Higher licence required |
| Runtime protection | Preview | Inspect prompts, tool calls and responses | Coverage limited to supported agents |
| Project Perception | Worldwide preview | Mobilise red, blue and green agents for security | Dynamic permissions not documented here |
Microsoft Defender for Endpoint runtime protection inspects the agent loop. It can block a prompt injection before the action is executed. Its preview status means it must not be presented as a production control equivalent to a generally available feature without prior analysis.
Project Perception was announced in July 2026. It relies on red, blue and green agents as well as specialised models such as MAI-Cyber-1-Flash. Microsoft then linked it to the governance of internal agentic insiders.
Project Perception is not synonymous with Microsoft Security Copilot. The former is presented as an agentic security system integrated into Microsoft Defender. The latter provides an assisted conversational interface. To place these building blocks within their architecture, see our analysis of AI agent security beyond the LLM model.
Four pitfalls that skew the inventory
The first pitfall is equating installation with detection. Microsoft Defender for Endpoint must observe the agent in activity. A software image or an application inventory is not enough to validate discovery.
The second concerns exposure graphs. ExposureGraphEdges has no property that directly identifies local agents. The documented method is to first isolate the nodes in ExposureGraphNodes with NodeLabel == "ai-agent" and the LocalAgents platform, then join on the node identifier.
The third pitfall is treating autoApprove or process approval as proof of least privilege. This information describes the observed configuration. It does not replace a review of the accessible tools, secrets analysis, or control of the actions the agent can trigger.
The fourth is including dynamic permissions in the acceptance test without reference documentation. The local agent discovery documentation describes no parameter, API or log that could certify this behaviour. Before making it a project objective, the organisation must identify the control plane, the audit events and the rollback mechanism.
An inventory is not a security policy
Detection provides the starting point. Governance then requires an owner, a justification for use, an MCP review, risk treatment and a retirement rule.
This approach aligns with a secure AI agent lifecycle: discovery, qualification, authorisation, monitoring, response and retirement.
Frequently asked questions
Is Microsoft Defender for Endpoint Plan 2 enough to detect local agents?
Yes. Microsoft Defender for Endpoint Plan 2 gives access to the inventory, the observed details and the AgentsInfo table. It does not give access to the associated risk level, indicators or recommendations.
Must runtime protection be enabled to discover an agent?
No. Discovery occurs after the agent's activity is observed and is independent of runtime protection. However, detecting MCP configurations requires active antivirus mode and real-time protection.
Why doesn't an installed agent appear in the portal?
First check that it has actually performed some activity, then check onboarding and the minimum versions. If MCP information is missing, also check that Microsoft Defender Antivirus is in active mode and that real-time protection is on.
Does Project Perception already allow testing of dynamic permissions?
The cited documentation provides no procedure to confirm this in a test tenant. Project Perception remains in worldwide preview. Dynamic permissions should therefore stay outside the acceptance criteria until an official path, API and audit events are documented.
Where to start
The first goal is not to enable every control at once. It is to obtain a reliable inventory on a limited scope, then decide which preview capabilities can be evaluated without becoming production dependencies.
Next actions
- Select a representative, isolated Windows or macOS machine
- Check the Microsoft Defender for Endpoint versions and the antivirus mode
- Confirm licences before adding risk assessment to the protocol
- Install a single authorised coding agent and generate benign activity
- Validate the local record and the
AgentsInfotable - Document runtime and Project Perception tests separately
- Exclude dynamic permissions from blocking criteria until their control is officially documented
If the organisation is looking for visibility first, Microsoft Defender for Endpoint Plan 2 is the starting scope. If it wants to prioritise agents by risk context, checking Microsoft 365 E7 or Agent 365 with Plan 2 must precede the pilot.
Going further
- Discover local AI agents with Microsoft Defender for Endpoint — licences, inventory, risk fields and KQL examples.
- AI agent runtime protection with Microsoft Defender for Endpoint — how the preview runtime protection works and its scope.
- What’s new in Microsoft Security: November 2026 — confirmation of general availability and extended coverage.
- Defending AI agents: reducing their attack surface — complementary measures beyond endpoint inventory.
