Microsoft Defender Ships AI Agent Context Mapping: MCP Server Discovery, Identity Graphs, Runtime Blocking in June Preview

Microsoft Security Blog·high signal

Microsoft Defender will provide asset context mapping for AI agents in June 2026, building a relationship graph showing which devices each agent runs on, which MCP servers it connects to, which identities are associated, and which cloud resources those identities can reach. Policy-based controls plus runtime blocking and alerts go to public preview through Intune and Defender. Agent 365 will discover 18 agent types by June, starting with OpenClaw and expanding to Cursor, Claude Code CLI, and Codex CLI.