Microsoft's Agent Infrastructure Goes GA: The Experimental Phase Is Over

The Thesis

Microsoft used Build 2026 not to announce a vision but to close one. The company shipped three pieces of production infrastructure — the Agent 365 SDK at general availability, Windows 365 for Agents at GA, and an expanded preview of MDASH with Defender integration — that together remove the three most concrete blockers to enterprise agentic deployment: no standard SDK, no agent-native security tooling, and no safe path for agents into legacy Windows environments. Operators who have been watching this space from the sideline now have something specific to evaluate.

Agent 365 SDK: What GA Actually Means

With the general availability of the Agent 365 SDK, developers can integrate controls directly into their development workflows, bringing observability, access controls, and compliance enforcement into how agents are designed and deployed — enabling teams to build custom agents for any AI platform that are compliant, enterprise-ready, and compose well with Agent 365.

That framing — "any AI platform" — is deliberate. Microsoft is not requiring developers to build exclusively on Azure Foundry. The SDK acts as a governance and observability layer that wraps agents built on other frameworks. Agent 365 for local agents extends Entra, Defender, and Purview into a single control plane to observe, govern, and secure agents across your estate, regardless of where they're hosted or what framework they're built on.

The practical bet: enterprises will adopt Agent 365 as their control plane even if they don't adopt it as their build-time framework. The SDK being free and framework-agnostic lowers friction considerably. The SDK is GA and free, with Microsoft 365 E7 as the bundled path for full integration. The licensing move matters. E7 bundles E5, Copilot, Entra Suite, and Agent 365 in one SKU. Enterprises on E5 face an upsell conversation, not a net-new purchase.

Agent 365 introduces an Agent Registry that surfaces unmanaged local agents discovered by Microsoft Defender, Microsoft Entra, and Microsoft Intune, supporting more than 20 types of local agents, including coding agents, AI desktop applications, and both local and remote Model Context Protocol (MCP) servers. Discovering shadow agents before IT does is a real operational problem. The registry addresses it without requiring developers to register agents manually.

MDASH: Benchmark Number, Real Proof

The headline figure — a CyberGym benchmark score of 96.55% — looks like vendor optimization on first glance, but merit exists here. On the CyberGym benchmark, UC Berkeley's evaluation framework built around 1,507 real-world vulnerability reproduction tasks drawn from 188 open-source projects, MDASH scored 88.45% at launch on May 12, topping the public leaderboard by roughly five points. By the time of the Build 2026 announcement, that score had risen to 96.55%, a gain of approximately 10 percentage points in under three weeks.

The retrospective testing carries more weight. When Microsoft ran MDASH retrospectively against pre-patch snapshots of two heavily audited Windows components, it achieved 96% recall on 28 confirmed Microsoft Security Response Center cases spanning five years in clfs.sys, and 100% recall on 7 confirmed MSRC cases in tcpip.sys. These are real bugs in real Microsoft code that passed human review — not synthetic tasks.

Rather than feeding a codebase to a single large language model, MDASH runs a five-stage pipeline in which each stage is handled by a specialized cohort of agents. In the Prepare stage, the system ingests source code, builds language-aware indices, and maps the attack surface by analyzing commit history. The Scan stage deploys auditor agents over candidate code paths, generating hypotheses with supporting evidence. This architecture matters operationally. A single-model scanner misses cross-file vulnerabilities by design. MDASH's multi-agent debate pipeline specifically surfaces the class of bugs that require comparing patterns across multiple files.

In May 2026, MDASH discovered CVE-2026-33824, a double-free vulnerability in Windows' IKEEXT service, reachable remotely over UDP port 500 by an unauthenticated attacker. The bug spanned six source files and was invisible within any single file.

Microsoft added native integration between Microsoft Defender and GitHub Code Security, and MDASH is now available in expanded preview for eligible organizations with Defender integration included. Expanded preview is not GA. Enterprises evaluating this should plan for further maturation before treating MDASH coverage as a compliance backstop. Real-world false-positive rates in diverse codebases remain unpublished.

Windows 365 for Agents: A Bridge, Not a Solution

Windows 365 for Agents, now generally available, enables you to run any agent in a fully isolated, policy-governed Cloud PC. The use case is narrower than the framing suggests. An agent can obtain a Cloud PC and carry out actions in a Windows session, while Windows 365 handles provisioning, session lifecycle, isolation, and operational reliability. The intended scenarios include interacting with desktop or web apps that lack reliable APIs, performing UI-level actions, and supporting human-in-the-loop workflows inside environments governed by Microsoft Entra ID, Microsoft Intune, and Conditional Access.

This is UI automation wrapped in enterprise governance. Many enterprise workflows still depend on browsers, desktop applications, and legacy tools, which require agents to operate beyond traditional integration points. Windows 365 for Agents solves a real and deeply unglamorous problem: getting autonomous agents into line-of-business systems that were never designed for API access.

Agents can interact directly with applications and browsers, execute multi-step workflows, and operate across modern and legacy systems. Each Cloud PC is Entra-joined, Intune-managed, and policy-enforced, helping IT scale agents with consistent security, governance, and compliance.

The risk is path dependency. Enterprises that route agents through Windows 365 Cloud PCs rather than investing in API modernization will pay Cloud PC licensing costs indefinitely. This is pragmatic but carries long-term technical debt. Watch whether it becomes a forcing function for backend modernization or a permanent workaround.

Who Gets Threatened

Open-source agent frameworks — LangGraph, AutoGen, CrewAI — don't disappear overnight, but they lose positioning. The Agent 365 SDK creates a governance gravity well inside the Microsoft enterprise stack. Developers who need to satisfy compliance and security teams will face internal pressure to adopt the layer that already integrates with Defender, Entra, and Intune.

Independent agentic security vendors now compete with a well-resourced player shipping bundled into licenses their prospects already own. Microsoft followed this same pattern in endpoint security: free and integrated eventually outpaces best-of-breed in enterprise procurement.

Microsoft is folding the MDASH capability into a full enterprise security control plane, connecting Defender, GitHub Code Security, Agent 365, and Purview. A control plane spanning code scanning, runtime governance, data loss prevention, and model integrity is harder for point-solution vendors to displace.

What to Watch

1. MDASH false-positive rates in production. The benchmark scores are real but narrow. First-mover enterprises in the expanded preview should instrument their findings carefully. A 10% false-positive rate at scale generates enough noise to erode trust within two quarters.

   MDASH CyberGym Benchmark Score Progression

2. Agent 365 SDK adoption outside Azure. Microsoft claims framework agnosticism. Track whether the SDK gains meaningful adoption in shops running agents on AWS Bedrock or GCP Vertex. If adoption stays Azure-only, the "open" positioning is marketing, not architecture.

3. Legacy modernization vs. Cloud PC lock-in. Windows 365 for Agents will be a visible line item in enterprise budgets by Q1 2027. If enterprises are not also funding API modernization programs alongside it, they are building a permanent dependency.

4. Competitive SDK response from Amazon and Google. Microsoft has set a production-grade bar for what an enterprise agent governance SDK looks like. Expect a comparable GA announcement from at least one hyperscaler competitor within twelve months. The competitive window for Microsoft SDK primacy is narrow.

5. MDASH post-deployment behavioral coverage. Today's scanner catches vulnerabilities in static code. The harder capability is detecting behavioral drift after an agent is deployed. Watch whether future MDASH releases extend into runtime behavioral analysis, not just pre-deployment code scanning.