Threat protection with Microsoft Defender

Windows 365 for Agents integrates with Microsoft Defender to deliver continuous, multi-layered threat protection across agent Cloud PCs and agent activity. With the appropriate licensing, the Microsoft Defender for Endpoint sensor can run natively on each Cloud PC, which enables real-time detection and blocking of threats while automatically scaling protection as new agents are deployed. Tamper protection is centrally managed, which ensures consistent enforcement of security policies across both user and agent environments.

Protection extends beyond the endpoint. Because Windows 365 for Agents is integrated with Agent 365, Microsoft Defender also provides visibility into agent activity through Advanced Hunting, monitors cloud interactions with Defender for Cloud Apps, and enables dynamic protection based on real-time risk signals through just-in-time controls. Microsoft Defender evaluates agent-initiated tool invocations before they execute, blocks unsafe actions in real time, and surfaces near-real-time alerts for suspicious behavior, such as persistent jailbreak attempts, data exfiltration, or credential leakage, which ensures a consistent Zero Trust security model across your agent workloads.

Next steps

• Learn about data governance with Microsoft Purview.
• Learn about Windows 365 for Agents in Agent 365.

Related content

Learn more about threat protection:

• AI agent inventory in Microsoft Defender XDR
• AI agent detection and protection in Microsoft Defender XDR