On October 7 Microsoft made Microsoft Execution Containers (MXC) generally available. Instead of letting an agent govern its own access, it is an execution boundary that enforces developer- or organization-defined policy outside the agent.
MXC has three modes. Enforcement mode blocks ungranted access, Learning mode blocks and records it, and Permissive mode allows and records it.
The JSON activity reports from the learning and permissive modes are produced only by MXC process containers on Windows.
Different questions each mode answers
Enforcement checks whether a task is allowed under the policy. Learning shows why a legitimate task failed without granting more access right away.
Permissive mode shows what a task would attempt if the policy did not block it. Having that record does not mean the action was contained.
For a coding task, policy can be reviewed by separating the repository to modify, configuration that only needs reading, and unrelated files that must stay off limits. Downloading dependencies, calling a compiler and running subprocesses each need different access.
Caveats: relaxed containment in permissive learning mode
According to the MXC repository docs, permissive learning mode (permissiveLearningMode) does not enforce deny-by-default during the run. It is therefore classed as security-sensitive, and a security warning is recorded whenever it is active.
Deny-and-record logging in learning mode (learningModeLogging), by contrast, keeps access denied, so containment does not change. The announcement says permissive mode also does not bypass other operating system or organizational restrictions.
Learning-mode capabilities are Windows-only, apply to AppContainer-based backends, and are ignored on other platforms. The docs were read from the mutable main branch, and no pinned binary was tested.
An adoption order that separates discovery from granting
When discovering permissions, only trusted, narrowly scoped tasks are run. Observed access is not copied wholesale into the allow list; each item is reviewed for whether the task needs it.
Unexpected access may be a reason to investigate the task rather than to grant permission.
Next, the intended policy runs in enforcement mode and both sides are checked. The checks are whether required work succeeds and whether deliberately forbidden actions stay denied.
This is a recommended check order, not a result of testing MXC here. Keeping the policy version and backend with the results lets later changes be reviewed against the same boundary.
Isolation backends that differ by platform
Microsoft says process containers use AppContainer on Windows, Seatbelt on macOS and Bubblewrap on Linux. MicroVM for Windows 11 and Linux is experimental, and each backend has distinct security properties.
Entra-based agent attribution and Intune policy management were presented as coming soon. This announcement alone does not show they are available now.
MXC permissive-mode records are only a candidate list of needed permissions; the boundary is proven only when it is checked again in enforcement mode.