Microsoft Execution Containers applies developer-defined file and network rules at runtime, with Windows 365 support also listed as generally available.
By [Ryan Merket](https://runtimewire.com/author/ryan-merket)
· Published
Primary source: [Windows Developer Blog](https://blogs.windows.com/windowsdeveloper/2026/10/07/microsoft-execution-containers-policy-driven-containment-for-ai-agents/)
Why it matters #
MXC gives Microsoft a way to make Windows the enforcement layer for agent permissions, linking on-device isolation to its enterprise identity and management products. General availability moves that strategy beyond the preview SDK, while experimental backends and unquantified adoption leave implementation maturity and customer uptake to prove.
Microsoft made Microsoft Execution Containers (MXC), its policy-driven system for restricting what AI agents and other untrusted workloads can access, generally available on Windows on October 7th. Logan Iyer, Microsoft's corporate vice president for Windows Platform and Developer, announced the release in a Windows Developer Blog post.
Iyer's work has spanned Windows' core architecture and developer tools: before leading the Windows platform and developer organization, he was chief architect for Windows Core and helped create Microsoft's cross-PC, Xbox and cloud game-development platform. MXC puts that platform work to a new use: Microsoft wants Windows to supply the operating-system boundary around agents, rather than leave developers to rely on instructions given to the model or limits inside an agent application.
Developers define which resources a workload may use, including file paths and network destinations. MXC then selects a containment backend and enforces the policy at runtime, outside the agent's control. In Microsoft's example, a coding agent could write to a project repository and read deployment settings while being blocked from changing those settings. The idea is to limit the consequences when an agent, generated code or a plugin attempts an action beyond the authority its operator intended to grant.
The announcement marks a shift from preview to Microsoft's stated general availability. At Build on June 2nd, the company introduced the MXC SDK in early preview, initially describing a cross-platform execution layer for Windows and Windows Subsystem for Linux. The October release broadens the documented platform picture: Microsoft says developers can use a shared JSON policy model and SDKs across Windows, macOS and Linux, with different operating-system mechanisms enforcing the rules.
That shared policy surface does not make every backend interchangeable. Microsoft's launch materials describe process containers for Windows, macOS and Linux; Windows-only session containers and WSL containers; and microVMs on Windows and Linux marked experimental. Session containers run under a separate Windows account and isolate an agent's desktop, clipboard, user interface and input from the interactive user's session. That is a different level of separation from a lightweight process sandbox, and developers must choose according to the workload and the security properties they need.
Microsoft is also positioning MXC as infrastructure for enterprise agent management. Its October announcement says Windows 365 support for MXC is generally available, allowing agents to run on Cloud PCs alongside users' existing work. In the same post, Microsoft described Entra-based separation of agent and user activity and extensions to Agent 365 controls for local agents as coming soon. Those are distinct pieces of the pitch: MXC constrains execution, while identity and administrative tools are meant to help IT teams identify and govern agent activity.
The timing follows Microsoft's June introduction of the SDK and arrives as it expands Windows' role in running Linux and agent workloads. In a separate October 7th Windows platform announcement, Microsoft listed Codex, GitHub Copilot, OpenClaw, Replit, LM Studio, NVIDIA OpenShell and Unsloth AI among products that support MXC. That list gives the release an adoption story, though Microsoft's announcement does not quantify usage or customer deployments.
Developers can inspect the MXC source repository, which describes MXC as an SDK dependency that builds into an application and documents Rust, .NET and Node SDKs. The repository also labels several backends experimental, reinforcing that general availability for MXC does not mean every isolation option has the same maturity. Microsoft's June preview announcement likewise framed the work as part of a broader Windows effort combining containment with agent identity and manageability.
For Microsoft, the commercial bet is that organizations will let agents do more work when access can be bounded by operating-system policy and administered through familiar Windows infrastructure. The release moves that argument into general availability on Windows and Windows 365. The practical test is whether teams can set policies that are restrictive enough to reduce risk without breaking the tools and workflows agents need to complete tasks.