Configure MDE AI agent runtime protection for Windows

What changed

You can use Audit mode to detect and alert on unsafe AI agent activity without blocking it, or Block mode to stop threats before they execute. These settings support Windows devices managed through Intune or MDE security settings management.

Why it matters

Audit and Block modes can detect or stop unsafe AI-agent activity on Windows, so policy scope and false positives must be validated before enforcement.

Known limitations

• Availability, prerequisites and rollout scope remain authoritative in the linked Microsoft documentation.

Now check

• Confirm Windows support and whether devices use Intune or MDE security-settings management
• Pilot Audit mode and review AI-agent runtime alerts
• Test Block mode, exclusions and rollback on representative AI workloads