Microsoft described a Customer Zero effort called Securing AI Agents on August 27, 2026. The participants did not test agents only in an isolated demo. They ran scenarios inside Microsoft Digital's corporate tenant under conditions intended to resemble real work, testing how agents interact with endpoint, identity, data, network, and runtime protections.
The effort brought together Microsoft Digital, Windows, Entra, Intune, Defender, Purview, and Microsoft Security. Microsoft says a two-week sprint initially organized for Microsoft Build grew into a cross-company project with more than 70 stakeholders. The pilot used dedicated Windows 365 Cloud PCs for roughly 100 internal users, giving them a corporate-bound environment that could still be isolated and reset quickly.
The tested stack included Windows images with Copilot CLI and OpenClaw, Cloud PC provisioning, Entra Agent IDs to distinguish people from agents, Defender runtime protection, Purview data-loss-prevention policies, Intune device and agent configuration, and Global Secure Access network controls at runtime. The point is not one security product. It is that an agent action should leave an identity and policy signal across the control layers that govern it.
Microsoft puts particular emphasis on separating human and agent identities. When an agent borrows a person's account, access decisions, auditing, and incident response become entangled. A distinct agent identity lets administrators set different permissions, inspect actions, and revoke or isolate the agent when needed. It does not automatically solve mistaken authorization or prompt injection, but it makes the responsibility boundary clearer.
The choice of Windows 365 Cloud PCs also has an operational implication. Microsoft describes a non-primary device that supports realistic experiments while retaining fast isolation, reset, and phased rollout. Enterprises need to test more than whether an agent gives a good answer. They need to verify that policies catch data movement, network restrictions work under real traffic, device changes are traceable, and a person can take over before a high-impact action.
This is Microsoft's Customer Zero experience and product blueprint, not an independent security audit or universal success-rate report. Its useful contribution is to move enterprise-agent security away from a single model evaluation and toward an operating control plane: distinct identities, managed endpoints, data-loss prevention, network policy, runtime monitoring, and incremental rollout. Without those layers, an agent can look effective in a test and still be difficult to govern in a real tenant.
