Daily Defender News
Aboutmerill.net
Microsoft Defender for Endpoint
Endpoint protection

Set up AI agent runtime protection with Microsoft Defender for Endpoint (Preview)

4 September 2026Doc update+36 / −30 lines

In brief

The page is now labeled Preview and adds Intune and alert-review permission prerequisites, clarifies PowerShell mode commands, and updates deployment and alert-investigation guidance.

What Defender admins need to know

Administrators deploying the protection should use the clarified permission requirements and Audit, Block, or Disabled configuration instructions.

Summaries are generated from the documentation change itself.

Documentation change

View full page diffView on Microsoft Learn

The comparison below shows only the changed extract. Use the full-page view for complete context.

Set up AI agent runtime protection with Microsoft Defender for Endpoint (Preview)

[!INCLUDE Prerelease information]

Local AI agents run with the user's privileges on the endpoints they operate on, where they can read files, invoke tools, and run commands. Malicious instructions hidden in the content an agent reads can hijack the agent through prompt injection. AI agent runtime protection helps you detect prompt injection at the device level and block or audit the agent's action before it acts on those instructions.

This article explains how to enable runtime protection in Microsoft Defender for Endpoint, deploy it acrossthroughout your organization, and investigate detections.

For an overview of how runtime protection works, see AI agent runtime protection with Microsoft Defender for Endpoint.

  • Your organization has a Microsoft Defender for Endpoint Plan 2, Microsoft 365 E5, Microsoft Agent 365, or Microsoft 365 E7 license.
  • Your devices are onboarded to Defender for Endpoint, and Microsoft Defender Antivirus is running in active mode with real-time protection enabled.
  • Your devices are running a supported version of Windows, and Microsoft Defender Antivirus is updated with current monthlyhas the latest platform, engine, and security intelligence updates.
  • Your devices have one or more supported local AI agents installed for the runtime protection approach you plan to enable.
  • To deploy the settings with Microsoft Intune, your account has an Intune role with permission to create, update, and assign device configurations, such as Policy and Profile Manager.
  • To review alerts, your account has a supported Microsoft Entra role, such as Security Reader, Security Operator, or Security Administrator, or a Microsoft Defender custom role with permission to read security data. For more information, see Required permissions to investigate alerts.

Recommended deployment approach

Microsoft recommends the following phased rollout:

  1. Test: Enable runtime protection in audit mode on a small set of devices where supported agents are actively used.
  2. Review: Monitor alerts in the Microsoft Defender portal for 1-2one to two weeks. Classify inaccurate alerts as false positives. If there are false positives,a detection involves a file incorrectly identified as malicious, submit the file to Microsoft for analysis.
  3. Deploy: Deploy throughout your organization in audit mode to additionalmore device groups.
  4. Enforce: After validating that alerts are accurate and actionable, switch to block mode on device groups where you want active enforcement.

Enable runtime protection

To enable runtime protection on a single device:

  1. Open an elevated PowerShell session.session (a PowerShell window you opened by selecting Run as administrator).

  2. Verify that AntivirusSignatureVersion is 1.451.224.0 or later:

    You can enable agent-native event inspection, network inspection, or both. Both methods support the same modes: Disabled, Audit, and Block.

    • Use AiAgentProtection to protect agents that expose vendor-supported agent event interfaces.
    • Use AiAgentNetworkInspection to extend protection to agents that don't expose vendor-supported agent event interfaces.

  3. Enable the method or methods you need:

    • To enable agent-native event inspection, run:replace <mode> with Audit or Block, and then run the following command: 

      Set-MpPreference -AiAgentProtection <mode>

      Replace <mode> with Disabled, Audit, or Block.

    • To enable network inspection, run:replace <mode> with Audit or Block, and then run the following command: 

      Set-MpPreference -AiAgentNetworkInspection <mode>

    Replace <To turn off either runtime protection method, set its mode> with to Disabled, Audit, or Block.

    For details about each mode, see What happens when you enable runtime protection. For more information about the runtime protection methods, see Network inspection and Agent-native event inspection.

  4. Verify the current settings:

  5. Close the PowerShell window and any terminal windows used to run agents. Then open a new terminal window before starting the agent.

Deploy settings acrossthroughout your organization with Microsoft Intune

The PowerShell commands in the Enable runtime protection section configure a single device. After you confirm runtime protection behavior on a limited device group, you can deploy a PowerShell commands as aplatform script to target device groups, settinggroups. The script can set agent-native event inspection, network inspection, or both to Audit or Block for allon devices in scope.

To deploy runtime protection settings with Microsoft Intune:

  1. Create a PowerShell script that includes the settings you want to deploy.

    Replace Audit with Block when you're ready to enforce protection. You can enable either setting, or both, based on the agent coverage you need.

  2. In the script settings, set Run this script using the logged on credentials to No. This setting runs the script in the system context so that it has permission to change Microsoft Defender Antivirus preferences.

  3. Use Microsoft Intune to deploy the script to target device groups. For detailed steps, see Use PowerShell scripts on Windows devices in Intune.

  4. To apply a different mode later, update the script or its policy so that Intune runs the script again.

Review and investigate detections

After you enable runtime protection, review alerts to validate detection accuracy and tune your configuration before broadening enforcement. This step is critical during the audit phase because it helps you understand what agents are encountering and whether detections represent real threats.

When runtime protection detects prompt injection, Defender raises a Suspicious AI prompt injection alert and takes action based on the configured mode. The alert appears on the device timeline, and related alerts are correlated into incidents for SOCsecurity operations center (SOC) investigation. In block mode, the alert severity is Critical, High, Medium, or Low based on assessed risk. In audit mode, the alert is Informational, so your team can review what would have been blocked without triaging it as an active threat.

:::image type="content" source="media/configure-ai-agent-runtime-protection/runtime-protection-suspicious-prompt-injection-alert.png" alt-text="Screenshot showingof a Suspicious AI prompt injection alert in Microsoft Defender, including the process tree and related detection details." lightbox="media/configure-ai-agent-runtime-protection/runtime-protection-suspicious-prompt-injection-alert.png":::

For more information onabout mode behavior, see What happens when you enable runtime protection.

End-user experience

When Defender blocks an agent action, users see twoit follows the notification rules configured for the device. Users can receive the following notifications:

  1. In the agent terminal: The agent displays a block message showing what was blocked, why, and confirmation that the action didn't execute.
  2. Windows toast notification: AIf Windows Security notifications are enabled, a system notification appears regardless of whether the agent terminal is in focus.

The following screenshot shows an example of a blocked prompt injection in the agent terminal and the corresponding Windows toast notification:

:::image type="content" source="media/configure-ai-agent-runtime-protection/ai-runtime-agent-block-and-toast.png" alt-text="Screenshot showingof a Defender block message in the agent terminal and a Windows toast notification for a blocked prompt injection attack." lightbox="media/configure-ai-agent-runtime-protection/ai-runtime-agent-block-and-toast.png":::

Users can also review detections under Windows Security > Virus & threat protection > Current threats and the Protection history, where they can see the threat name, severity, affected agent, and remediation status.

Security operations experience

For security operations teams, runtime protection events appear in the Microsoft Defender portal:

portal. Select an alert to view the detection type, severity, affected agent, process tree details, and recommended actions.

Your security team uses the same investigation workflows as other endpoint detections: timeline review, alert and entity correlation, and response actions.