Microsoft Now Sandboxes Every AI Agent — What SMBs Should Check Before Letting Agents Touch Real Data

On October 7, Microsoft made Microsoft Execution Containers (MXC) generally available — an operating-system-level containment layer built specifically for AI agents (Windows Developer Blog). It runs on Windows 11, macOS and Linux, and it is managed through tools most businesses already own: Intune and Entra.

Why it matters: an AI agent is not a chatbot waiting for your next sentence. It is software that acts — reading files, sending email, moving data, calling other systems. Microsoft's own framing is that agents should be treated as untrusted code. MXC wraps each agent in a boundary that defines which files and networks it can reach, and enforces that at runtime, so an agent cannot quietly grant itself more access.

For a small business, that is the difference between "our AI assistant did something we didn't expect" and "our AI assistant deleted the wrong folder."

Why Containment Matters at 20 Employees, Not Just 20,000

Large enterprises have security teams to review what every agent can touch. A 20-person firm usually has one person who "handles IT" on top of another job. As agents move from writing drafts to taking actions — replying to customers, updating records, scheduling — the blast radius of a mistake grows. Containment is a technical backstop for the fact that no small team can watch every agent action by hand.

The Four Containment Types, in Plain English

1. Process container — the lightest option. Good for low-risk agents that only read and summarize.
2. Session container (Windows 11) — runs the agent in an isolated desktop session, separate from your normal work.
3. WSL container — for agents that need Linux-based tooling.
4. MicroVM — hardware-backed isolation for the highest-risk workloads, where a mistake would be expensive.

You don't need all four. The principle is to give each agent the least isolation that still protects you, and to raise it when the agent touches money, customer data or production systems.

A 5-Point Agent Checklist for SMBs

1. Give agents their own identity. Agent activity should be separate from a human login, so you can tell who did what.
2. Start with least privilege. Grant read access first. Add write, send or delete only when a task proves it needs them.
3. Keep a record. Know which agents exist, what they connect to, and who approved them.
4. Review monthly. An agent that was fine in June may now reach data it no longer needs.
5. Train the people who run agents. Most incidents start with a person pasting the wrong data into the wrong tool, not with a sophisticated attack.

Quick Test: Could You Contain an Agent Today?

• Can you list every AI agent or automation currently connected to your business systems?
• Do any of them run under a shared human login instead of their own identity?
• If one of them started emailing customers tomorrow, would you find out the same day?

Two or more "no" answers means your agents have more access than your oversight.

Technology Is Half the Answer; Governance Is the Other Half

Containment tools help, but they assume you already know what your agents are allowed to do. That decision — who may use which AI, on what data, with what limits — is governance, and it is the part most small businesses skip. It is also the part that protects you when a tool's defaults don't match your business.

This is the work DAOVA does with BC small and mid-sized businesses: practical AI governance, secure deployment of agents, and team training so people use them correctly. Eligible AI training for BC employers can be reimbursed up to 80% through the B.C. Employer Training Grant (up to $10,000 per participant).

The Bottom Line

Agents are becoming coworkers with credentials. Microsoft just made it easier to keep them on a leash — but only if you decide the rules first. Containment without governance is just a locked room with no idea what's inside it.

Your action this week: list every AI agent or automation connected to your business, note what each one can reach, and mark the one that worries you most. That one goes on a leash first.