Local AI agents are becoming part of endpoint inventory
Microsoft says Defender discovery for supported local AI agents and their configured Model Context Protocol connections is now generally available on Windows and macOS. By observing activity, it can identify more than 50 supported agents and bring together agent, device, account and configured connection context. This helps answer a question conventional application inventories can miss: which tools can an AI agent reach on a staff computer? Discovery is a starting point for governance, not evidence that every agent is visible or that discovered activity has been blocked. Districts need to reconcile what the product observes with approved tools, privileged accounts and the services those tools can access.
Why it matters for leaders
With the endpoint team, confirm licensing and prerequisites, then compare a small test fleet with a known list of installed agents and connections. Assign an owner to each approved use. Budget for triage and permission cleanup, rather than assuming an inventory view enforces policy.
Cost, service, risk & adoption
The November security roundup explicitly identifies the discovery capability as generally available and describes its supported-agent scope. The evidence is a product announcement, not an independent coverage test.
What the evidence cannot tell us
Activity-based discovery and a supported list can leave gaps. The announcement does not establish a district's entitlement, deployment readiness or complete visibility; configured connections do not prove actual data access.
Read the original sources
Summary and leadership analysis from the Week ending 2026-11-06 brief. The edition’s selection notes explain source access and evidence limitations.