WORKSHOP · OS-LEVEL AI · WS·09

Windows Just Became an Agentic OS

Microsoft is reframing Windows from "an OS that runs AI tools" to "an OS that is itself an agent runtime." What changes for your business model, your governance, your competitive position — and whether you should move first or wait. 20 slides, 30 minutes.

20 SLIDES · ~30 MIN · PLAYBOOK OVERVIEW
Key Takeaways
  • Windows is becoming the first major operating system designed around agents, not applications. The CEO question shifts from 'which AI app do we buy' to 'which agents get OS-level identity, what registry do they live in, and who governs the sandbox they run in.'.
  • Pull the Agent Registry report from M365 admin. Snapshot what your tenant already exposes — Microsoft agents, partner agents, your own, and shared-by-creator. This is the baseline you'll govern against. Twenty minutes, not a project.
  • Microsoft is reframing Windows from "an OS that runs AI tools" to "an OS that is itself an agent runtime." What changes for your business model, your governance, your competitive position — and whether you should move first or wait. 20 slides, 30 minutes.
WORKSHOP · OS-LEVEL AI

Windows Just Became an Agentic OS

What changes when the operating system itself ships with an agent runtime, a registry, and a sandbox.

BuildClub Academy
01 · THE ONE IDEA

From which app
to which agent.

Windows now ships with a registry,
a sandbox, and an identity layer for agents.
The question is no longer 'should we adopt AI'
but 'which agents do we let the OS trust.'

The Thesis
02 · WHAT JUST HAPPENED

What just shipped — three things between November 2025 and Build 2026.

1
Nov 2025 — MCP server registration on Windows
Microsoft published the docs for an on-device agent registry (ODR). MCP servers can now register with Windows itself, run in sandboxed agent sessions, and have OS-mediated access to approved resources. Pre-release at publication; in dev preview by Build.
2
May 2026 — The agentic workspace, Microsoft Agent Framework GA
Windows announced a new agentic workspace surface that ships out of the box. Same week, Microsoft Agent Framework reached GA — AutoGen + Semantic Kernel converged into one commercial SDK. Agent-to-Agent (A2A) and Computer-Using Agents went GA in Copilot Studio.
3
June 2026 — Build keynote, the architectural reveal
At Build 2026 (June 2–3, San Francisco), Microsoft framed Windows as 'a first-class runtime for autonomous AI agents.' Pricing per-agent invocation expected at the keynote. The cumulative effect: the OS has agents as a first-class primitive.

Six months of cumulative shipping. The headline is not any one feature — it's that the OS is now the agent identity layer.

03 · THE CEO STAKES

Why this should matter to you — not just your CIO.

Margin
Agents that run inside the OS — with OS-managed identity, sandboxing, and audit — have lower integration cost than agents you stitch together yourself. The companies that adopt OS-native agents pay less per workflow automated. Margin advantage compounds over five years.
Distribution
If your software runs on Windows and exposes its capabilities through MCP, every agent on every Windows machine in the world can reach you. The OS just became your distribution channel for agent traffic. Companies that don't expose tools end up invisible to that traffic.
Workforce
An agentic workspace shipping out of the box means your employees will encounter agents whether you've sanctioned them or not. Your governance has to lead the rollout, not chase it. The day Microsoft turns the workspace on is the day shadow-agents become a real risk class.
Competitive position
Your competitors will fall into two camps within twelve months: those who built proprietary agent orchestration last year and are now technical-debt-rich, and those who skipped that and built directly on the OS-native primitives. The CEO bet is which camp you want to be in.

Four stakes — none of them is an IT story. All four are P&L stories with a six-to-eighteen-month clock.

04 · WHAT 'AGENTIC OS' ACTUALLY MEANS

App-OS vs Agent-OS — the structural shift in one frame.

App-OS (1985–2025)
Apps own their own state. Users grant permissions per app, per use. The OS doesn't know what an agent is — it sees a process. Inter-app communication is ad-hoc: clipboards, file shares, custom APIs. Identity is the user, never the software.
Agent-OS (2026–)
Agents register with the OS. The OS knows their capabilities, their tool surface, their trust band. Inter-agent communication uses standardized protocols (MCP, A2A). Identity is the agent, distinct from the user, and the OS mediates which agents reach which resources.
What stays the same
Apps still exist. Users still install software. The OS still loads processes. The difference is that there's now a parallel registry — agents — that runs alongside apps with its own lifecycle, sandbox, and governance surface.
What changes for you
The decisions you've been making at the app layer (which Copilot, which vendor, which pilot) now have an OS-layer equivalent. The wrong choice at the OS layer is harder to undo than the wrong choice at the app layer. The asset class is more durable; the bets are more consequential.

Apps and agents will coexist. The shift is that agents now have OS-level identity. That changes who is governing what.

05 · THE RUNTIME, IN FIVE STEPS

How an MCP server actually registers on Windows.

1
2
3
4
5
1
Ship the app with MSIX package identity
MSIX is the modern Windows packaging format. Apps packaged this way get a stable, OS-recognized identity. The MCP server is declared in the package metadata.
2
OS auto-registers on install
When the app is installed, Windows reads the metadata and adds the MCP server to the on-device agent registry (ODR). No separate install step. The lifecycle is managed by the OS.
3
ODR exposes the server to agent sessions
Any agent on the machine — Copilot, Claude, a custom agent — can discover and connect to the server through the registry. The server doesn't need to advertise itself; the OS handles discovery.
4
Sandbox gates which resources it reaches
The server runs in a contained agent session. Approved resources only. The sandbox is engineered to reduce vulnerability to cross-prompt injection — a class of attack that doesn't exist at the app layer.
5
OS auto-unregisters on uninstall
Remove the app, the MCP server disappears from the registry. No orphan agents. No stale tool surface. The OS owns the cleanup.

The lifecycle is OS-managed, not app-managed. Install once, register everywhere; uninstall once, remove everywhere.

06 · HOW SERVERS GET IN

Three registration paths, three trust postures.

1
MSIX package identity — the default
Apps packaged with MSIX get full sandbox protection and automatic lifecycle management. The OS handles registration, discovery, and cleanup. This is the path Microsoft wants you on, and it's the one your IT team will accept without escalation.
2
Unpackaged executables — gated
.exe files, MSI installers, and standalone MCP bundles can be installed directly. But they cannot run in the secure agent process by default — users must explicitly enable 'Reduce protections for agent connectors' in Windows Settings. That toggle is your governance line.
3
Manual CLI registration — power users only
Remote MCP servers and local servers that need fine-grained control register via the on-device agent registry command-line tool. Intended for developers and operations teams, not end users. The right path for your internal LOB agents.

The default is locked down. Every path off the default requires explicit user or admin action — which is exactly what good governance looks like.

07 · THE EMPLOYEE-FACING SURFACE

The agentic workspace — what your employees will see.

1
Ships out of the box
The agentic workspace is part of the next Windows 11 update — not a download, not a license tier, not an opt-in. Every Windows 11 machine in your fleet gets it. Your employees will encounter it whether your IT department was ready or not.
2
Agents run in their own secure session
Each agent runs in a dedicated session, isolated from the user's normal desktop. The agent can see what the user shares with it — and nothing else. The session model is closer to a sandboxed browser tab than to a traditional app.
3
User holds the data-sharing control
The user explicitly chooses what to share with each agent session. They can shut a session down at any moment. Microsoft is positioning this as 'you stay in control of your data' — and that messaging will be what your employees see and repeat.

Out-of-the-box arrival means your governance has to lead the rollout. The day Microsoft turns this on is the day shadow-agents become a real risk class.

08 · HOW AGENTS CONNECT

Four integration patterns — and where each one fits.

MCP — the tool standard
Model Context Protocol exposes tools an agent can call. One MCP server, many clients. Use when you have a system of record (CRM, ticketing, data warehouse) and you want agents to read and write to it without custom integration code per agent.
A2A — the agent-to-agent protocol
General availability in Copilot Studio as of May 2026. Wire-compatible with Microsoft Agent Framework. Use when one agent needs to delegate a subtask to another — like a chief-of-staff agent handing a research task to a specialist agent.
Computer-Using Agents — the UI fallback
Generally available in Copilot Studio. Agents drive desktop and web applications through their UI when the vendor has no API. Microsoft frames it as 'RPA without the brittle scripts.' Use as the integration of last resort — durable, but slower than MCP.
Windows Agent Runtime — the OS execution layer
The sandboxed agent session that runs MCP servers locally on the device. Use when agents need to touch local files, local apps, or sensitive data that shouldn't leave the device. The execution layer underneath the other three patterns.

Four patterns. Different stacks combine them differently. None of them are sexy. All of them are now durable infrastructure.

09 · THE OFFICIAL SDK

Microsoft Agent Framework — the SDK that ships with this.

1
AutoGen + Semantic Kernel converged
AutoGen contributed multi-agent orchestration patterns. Semantic Kernel contributed enterprise memory, plugin architecture, and .NET integration. The two merged into one commercially supported SDK at Build 2026. Both prior libraries continue to exist, but the future is the unified framework.
2
Four primitives, two languages
Agent · AgentGroup · AgentRuntime · ToolRegistry. C# and Python with consistent APIs. Built-in persistent memory via Cosmos DB or Redis. Circuit breakers for agent failure. Application Insights integration out of the box. The plumbing your team would otherwise build is now in the SDK.
3
Wire-compatible with Copilot Studio A2A
Agents built with the SDK can talk to agents built in Copilot Studio's visual designer without adapters. SDK-built agents and Studio-built agents coexist in mixed deployments. This is the moat — Microsoft is unifying the developer surface and the no-code surface around the same protocol.

The SDK is the build path. Copilot Studio is the configure path. Both produce agents that talk to each other natively.

10 · WHO ACTUALLY WINS THIS

The early-mover advantage is expertise, not code.

Early movers built expertise — and that compounds
Companies that built proprietary agent orchestration in 2024–2025 lived the journey: they learned which prompts hold, which tools break, which guardrails matter, where models hallucinate, what production-grade observability looks like. That knowledge transfers. Their code may be technical debt; their team is a moat.
Late movers inherit standards — but not judgment
Companies that waited inherit MCP, A2A, and Microsoft Agent Framework as defaults. They skip the engineering work the early movers wrote. But they also skip the failure data, the calibration, the muscle memory. Standards are free; experience is not. The new tools still demand operators who know how agents actually fail.
What the early movers do next
Port their hard-won lessons onto the new standards. Their custom orchestration becomes Agent Framework. Their bespoke memory becomes Cosmos-backed Agent memory. Their internal tool registry becomes MCP. Same operators, same knowledge, lower platform tax. Their year-of-pain converts into a year of leverage.
What late movers have to do
Run the journey fast. Pilots first, with seasoned operators if you can hire them, or with a partner who's already done it. Don't skip the failure-data step; you cannot read your way past it. Both paths arrive at the same destination — but only one path teaches you how to drive once you're there.

The platform consolidated. The expertise didn't. Early-mover teams keep their edge; late movers have to compress the journey, not skip it.

11 · TWO PATHS, ONE DISCIPLINE

Whatever path you pick, the ROI clock is shorter than the platform's.

1
Path A — move first, build inside the Microsoft ecosystem
Adopt MCP, A2A, and the Agent Framework now. Get internal agents into the on-device registry. Capture the first-mover advantage where agents touch your specific data and workflows. Right for: companies where agents are differentiation, employees are mostly on Windows, and your competitors haven't moved.
2
Path B — run a compressed journey now, then commit
Don't wait passively. Run real pilots inside the platform — eight to twelve weeks, with seasoned operators, against an ROI target. Build the expertise you skipped. Then commit. Right for: companies that didn't build agent muscle in 2024–2025 and need to earn it before scaling.
3
The shared discipline: short ROI cycles
Both paths assume the platform will shift again. Microsoft may change pricing. Anthropic, OpenAI, or Google may ship a competing OS-level surface. Standards may fork. Build every agent to earn its ROI in six to nine months, not three years. If it can't pay back inside one platform cycle, it's a research project, not a deployment.

Pick a path. Set short ROI windows. Reinvest based on results, not loyalty. The platform that won this quarter may not win next year — your discipline has to outlast it.

12 · NEW ASSET CLASS, NEW WORK

What governance teams have to do that they didn't before.

1
2
3
4
1
Inventory which agents are registered with the OS
Microsoft 365 admin center has an Agent Registry view that shows every agent your tenant exposes — Microsoft-built, partner-built, your own, and shared-by-creator. Run it. Snapshot it. This becomes your baseline.
2
Decide your 'Reduce protections' policy
The Windows Setting that lets unpackaged MCP bundles run in the secure agent process. Default off is the right answer for most fleets. Document the decision, communicate it, and audit fleet compliance quarterly.
3
Set agent action policies
Copilot Agent Mode and Microsoft Agent Framework both support action policies — whitelists of what an agent can do, which data sources it can reach, what it can spend. Define them centrally before agents proliferate. Retrofitting policy after rollout is expensive.
4
Wire agent traces into your telemetry pipeline
Agents produce traces — every tool call, every decision, every data access. Microsoft Foundry's trace-based evaluation lets you grade production traces. Send them to the same observability stack you use for human activity. Same review cadence, same audit trail.

Four work streams. None of them is glamorous. All four have to be running before the agentic workspace lands.

13 · WHAT CHANGES UNDERNEATH

The trust boundary moves — and the OS becomes the identity layer.

Before — apps trust the OS
User trusts the app, app trusts the OS. The OS knows about processes, not intentions. Permission grants are coarse — file system, network, camera. Agents do not exist as a category at the OS level.
After — agents register with the OS
User trusts the OS, OS mediates which agents reach which resources. The OS knows the agent's identity, its tool surface, and its sandbox. Permission grants are fine-grained — per agent, per resource, per session.
Who has more power
The OS gains the most power. Microsoft is positioning Windows as the identity-and-trust layer for the next decade of AI. Apps lose some power (they no longer mediate AI access on their own). Users gain explicit control they never had before — and a UI surface that exposes it.
Who has new work
Your security and compliance teams now have a third asset class to govern, alongside users and apps. Vendor management gains a new question: 'does this vendor's agent register with the OS, or run outside it.' Procurement gains a new contract clause: 'OS-native or not.'

The OS is the new identity layer. Trust the OS more, not less. Govern it accordingly.

14 · CIO RECONCILIATION

What this means for the stack you already have.

Microsoft 365 Copilot already had an agent registry
The tenant-level Agent Registry in M365 admin has been live for months. Windows Agent Runtime extends the same registry concept to the desktop OS. CIOs who built familiarity with the tenant registry inherit a head start at the device level.
Windows registry is local-first
Agents registered with the on-device registry run on the device. No round trip to the cloud, no data leaving the endpoint unless the agent explicitly calls out. This is good news for data residency, sensitive workloads, and offline-first use cases. Pair with Foundry Local for full on-device AI stacks.
Foundry hosts the cloud half
Microsoft Foundry now hosts agents in managed VNETs (GA in May 2026) with private outbound rules, project-level cost attribution, and trace-based evaluation. The cloud half of your agent stack lives there. The Windows half lives on the device. Both speak MCP and A2A.
Mix is the norm
No all-in-one play wins. Your fleet will have OS-registered agents, M365-tenant-registered agents, Foundry-hosted agents, and third-party agents (Claude, Gemini, OpenAI) running side by side. The CIO job is the integration architecture, not the vendor selection.

Four pieces, one architecture. The integration architecture matters more than any single vendor choice.

15 · STACK FIT

Where this fits in your existing AI stack.

1
2
3
4
1
Cloud half — what you already have
Foundry-hosted agents, Copilot Studio agents, third-party hosted agents (Claude, Gemini, OpenAI). VNET-isolated, evaluated, governed centrally. This is the layer most CEOs have been investing in for two years.
2
Desktop half — what just shipped
On-device agent registry, sandboxed agent sessions, agentic workspace. The desktop is no longer a passive client — it's an active participant in the agent stack. New layer for most companies.
3
Connecting tissue — the protocols
MCP for tool calls. A2A for agent-to-agent handoff. Microsoft Agent Framework as the SDK that speaks both. These are the wires. They're standardized, they're open, and they're already wire-compatible across Microsoft's surfaces.
4
What's new is the desktop layer
The cloud half existed before. The protocols existed before. The desktop layer — agents running with OS identity, sandboxed at the kernel level, registered through the OS — is the genuinely new piece. It is not replacing your stack; it is becoming the layer underneath it.

Three layers, four pieces. The desktop layer is the new addition — and the layer with the most governance work.

16 · WHAT WE DON'T KNOW YET

Three things still unannounced — and how to plan without them.

1
Pricing per agent invocation
Microsoft confirmed consumption-based pricing for the cloud-hosted Agent Runtime, but per-invocation and per-tool-call rates were not published before the June 2 keynote. Plan with 2-3× your current Copilot per-user cost as a working estimate. Refine when rates publish.
2
Windows Server and WSL support
Everything announced so far is Windows 11 client. Server and WSL extensions of the on-device agent registry have not been confirmed. If your workloads live in Server or WSL today, watch the docs through Q3 2026 before committing migration work.
3
Intune policy controls
Enterprise admin policies for the agent registry — provisioned via Intune or Microsoft Endpoint Manager — were demonstrated but not GA'd. Default-restrictive Settings are your governance lever today. Intune-managed policies are expected by FY27. Plan in two phases.

Three honest gaps. The right CEO posture is to commit to direction now and refine the details as they publish.

17 · DIAGNOSTIC QUESTIONS

Five questions for your IT and security teams this week.

1
2
3
4
5
1
Which Windows 11 versions are in our fleet?
Agent registry support starts at specific Windows 11 builds. Map your fleet versions before any rollout planning. If a meaningful share of the fleet is on older builds, you have an upgrade dependency on the critical path.
2
Who has admin rights to register MCP servers?
MSIX package identity gives apps OS-level agent registration. Anyone who can deploy MSIX apps to your fleet can register agents. That permission set is now an agent-governance permission set. Audit it.
3
Is 'Reduce protections for agent connectors' off across the fleet?
The Settings toggle that lets unpackaged MCP bundles run in the secure agent process. Default should be off. Confirm it is. Document the policy. Audit compliance quarterly.
4
Are our internal Copilot agents wired to Windows Agent Runtime?
If you've built internal agents in Copilot Studio, are they running through the on-device registry, or cloud-only? The cloud path keeps working. The on-device path is the new one. Decide which agents earn local execution.
5
What's our roadmap for the Microsoft Agent Framework?
If your team built proprietary agent orchestration in 2024–2025, when do you plan to migrate to Microsoft Agent Framework? 'Never' is a valid answer for some shops; 'we haven't thought about it' is not.

Five diagnostic questions. Answers reveal whether your team is ready, almost ready, or unaware.

18 · MONDAY-MORNING ACTIONS

Five moves you can start before lunch on Monday.

Monday Morning
  1. 1
    Pull the Agent Registry report from M365 admin. Snapshot what your tenant already exposes — Microsoft agents, partner agents, your own, and shared-by-creator. This is the baseline you'll govern against. Twenty minutes, not a project.
  2. 2
    Audit 'Reduce protections for agent connectors' across your fleet. Default off is almost certainly the right answer. Confirm it. If anyone needs an exception, make them write a ticket — not just toggle the setting.
  3. 3
    Test the agentic workspace on one Windows 11 dev machine. See the per-session data-sharing UI yourself before your employees do. The room should not learn about it from a help-desk ticket.
  4. 4
    Pick the first agent that earns OS-level identity at your company. Not a Microsoft agent. Not a vendor agent. Your agent — built for your data, your workflow, your customer. That's the one the OS-level registry was designed for.
  5. 5
    Pick Path A or Path B and declare it — with a six-to-nine-month ROI gate. Path A: move first inside the Microsoft ecosystem. Path B: run a compressed pilot journey now. Either is coherent. The non-negotiable is the ROI clock: every agent in your stack earns its keep inside one platform cycle, or it gets killed.
CLOSING

From which app
to which agent.

1 — The OS now has a registry, a sandbox, and an identity layer for agents.
2 — The agentic workspace is opt-out, not opt-in. Your governance leads, or it chases.
3 — Early movers built expertise that compounds. Late movers can compress the journey, not skip it.
4 — Every agent earns its ROI inside one platform cycle, or it gets killed.
5 — The companies that win are the ones whose discipline survives platform change.

The Thesis
WS·09 · Questions CEOs Ask

Frequently Asked Questions

What is the core idea of Windows Just Became an Agentic OS?
Windows is becoming the first major operating system designed around agents, not applications. The CEO question shifts from 'which AI app do we buy' to 'which agents get OS-level identity, what registry do they live in, and who governs the sandbox they run in.'.
What should a CEO do Monday morning after reading Windows Just Became an Agentic OS?
Start here: Pull the Agent Registry report from M365 admin. Snapshot what your tenant already exposes — Microsoft agents, partner agents, your own, and shared-by-creator. This is the baseline you'll govern against. Twenty minutes, not a project; Audit 'Reduce protections for agent connectors' across your fleet. Default off is almost certainly the right answer. Confirm it. If anyone needs an exception, make them write a ticket — not just toggle the setting; Test the agentic workspace on one Windows 11 dev machine. See the per-session data-sharing UI yourself before your employees do. The room should not learn about it from a help-desk ticket.
What are the steps in Windows Just Became an Agentic OS?
1) Ship the app with MSIX package identity; 2) OS auto-registers on install; 3) ODR exposes the server to agent sessions; 4) Sandbox gates which resources it reaches; 5) OS auto-unregisters on uninstall.
Where do the claims in Windows Just Became an Agentic OS come from?
The playbook cites Microsoft Learn · MCP servers on Windows; Microsoft Build 2026 coverage; Microsoft Learn · MCP servers on Windows (Nov 2025); Microsoft Foundry · May 2026 release notes.
WS·09 · Sources

All Sources in This Playbook

00 / 20