# Windows Just Became an Agentic OS

> Microsoft is reframing Windows from "an OS that runs AI tools" to "an OS that is itself an agent runtime." What changes for your business model, your governance, your competitive position — and whether you should move first or wait. 20 slides, 30 minutes.

*WS·09 · Module WORKSHOPS — Workshops · The CEO AI Playbook by Stephen Forte*

Canonical: https://academy.buildclub.com/workshops/windows-agentic

## Thesis

Windows is becoming the first major operating system designed around agents, not applications. The CEO question shifts from 'which AI app do we buy' to 'which agents get OS-level identity, what registry do they live in, and who governs the sandbox they run in.'

## Key Takeaways

- Windows is becoming the first major operating system designed around agents, not applications. The CEO question shifts from 'which AI app do we buy' to 'which agents get OS-level identity, what registry do they live in, and who governs the sandbox they run in.'.
- Pull the Agent Registry report from M365 admin. Snapshot what your tenant already exposes — Microsoft agents, partner agents, your own, and shared-by-creator. This is the baseline you'll govern against. Twenty minutes, not a project.
- Microsoft is reframing Windows from "an OS that runs AI tools" to "an OS that is itself an agent runtime." What changes for your business model, your governance, your competitive position — and whether you should move first or wait. 20 slides, 30 minutes.

## The Playbook

1. **Ship the app with MSIX package identity** — MSIX is the modern Windows packaging format. Apps packaged this way get a stable, OS-recognized identity. The MCP server is declared in the package metadata.
2. **OS auto-registers on install** — When the app is installed, Windows reads the metadata and adds the MCP server to the on-device agent registry (ODR). No separate install step. The lifecycle is managed by the OS.
3. **ODR exposes the server to agent sessions** — Any agent on the machine — Copilot, Claude, a custom agent — can discover and connect to the server through the registry. The server doesn't need to advertise itself; the OS handles discovery.
4. **Sandbox gates which resources it reaches** — The server runs in a contained agent session. Approved resources only. The sandbox is engineered to reduce vulnerability to cross-prompt injection — a class of attack that doesn't exist at the app layer.
5. **OS auto-unregisters on uninstall** — Remove the app, the MCP server disappears from the registry. No orphan agents. No stale tool surface. The OS owns the cleanup.
1. **Inventory which agents are registered with the OS** — Microsoft 365 admin center has an Agent Registry view that shows every agent your tenant exposes — Microsoft-built, partner-built, your own, and shared-by-creator. Run it. Snapshot it. This becomes your baseline.
2. **Decide your 'Reduce protections' policy** — The Windows Setting that lets unpackaged MCP bundles run in the secure agent process. Default off is the right answer for most fleets. Document the decision, communicate it, and audit fleet compliance quarterly.
3. **Set agent action policies** — Copilot Agent Mode and Microsoft Agent Framework both support action policies — whitelists of what an agent can do, which data sources it can reach, what it can spend. Define them centrally before agents proliferate. Retrofitting policy after rollout is expensive.
4. **Wire agent traces into your telemetry pipeline** — Agents produce traces — every tool call, every decision, every data access. Microsoft Foundry's trace-based evaluation lets you grade production traces. Send them to the same observability stack you use for human activity. Same review cadence, same audit trail.
1. **Cloud half — what you already have** — Foundry-hosted agents, Copilot Studio agents, third-party hosted agents (Claude, Gemini, OpenAI). VNET-isolated, evaluated, governed centrally. This is the layer most CEOs have been investing in for two years.
2. **Desktop half — what just shipped** — On-device agent registry, sandboxed agent sessions, agentic workspace. The desktop is no longer a passive client — it's an active participant in the agent stack. New layer for most companies.
3. **Connecting tissue — the protocols** — MCP for tool calls. A2A for agent-to-agent handoff. Microsoft Agent Framework as the SDK that speaks both. These are the wires. They're standardized, they're open, and they're already wire-compatible across Microsoft's surfaces.
4. **What's new is the desktop layer** — The cloud half existed before. The protocols existed before. The desktop layer — agents running with OS identity, sandboxed at the kernel level, registered through the OS — is the genuinely new piece. It is not replacing your stack; it is becoming the layer underneath it.
1. **Which Windows 11 versions are in our fleet?** — Agent registry support starts at specific Windows 11 builds. Map your fleet versions before any rollout planning. If a meaningful share of the fleet is on older builds, you have an upgrade dependency on the critical path.
2. **Who has admin rights to register MCP servers?** — MSIX package identity gives apps OS-level agent registration. Anyone who can deploy MSIX apps to your fleet can register agents. That permission set is now an agent-governance permission set. Audit it.
3. **Is 'Reduce protections for agent connectors' off across the fleet?** — The Settings toggle that lets unpackaged MCP bundles run in the secure agent process. Default should be off. Confirm it is. Document the policy. Audit compliance quarterly.
4. **Are our internal Copilot agents wired to Windows Agent Runtime?** — If you've built internal agents in Copilot Studio, are they running through the on-device registry, or cloud-only? The cloud path keeps working. The on-device path is the new one. Decide which agents earn local execution.
5. **What's our roadmap for the Microsoft Agent Framework?** — If your team built proprietary agent orchestration in 2024–2025, when do you plan to migrate to Microsoft Agent Framework? 'Never' is a valid answer for some shops; 'we haven't thought about it' is not.

## What to Do Monday

- Pull the Agent Registry report from M365 admin. Snapshot what your tenant already exposes — Microsoft agents, partner agents, your own, and shared-by-creator. This is the baseline you'll govern against. Twenty minutes, not a project.
- Audit 'Reduce protections for agent connectors' across your fleet. Default off is almost certainly the right answer. Confirm it. If anyone needs an exception, make them write a ticket — not just toggle the setting.
- Test the agentic workspace on one Windows 11 dev machine. See the per-session data-sharing UI yourself before your employees do. The room should not learn about it from a help-desk ticket.
- Pick the first agent that earns OS-level identity at your company. Not a Microsoft agent. Not a vendor agent. Your agent — built for your data, your workflow, your customer. That's the one the OS-level registry was designed for.
- Pick Path A or Path B and declare it — with a six-to-nine-month ROI gate. Path A: move first inside the Microsoft ecosystem. Path B: run a compressed pilot journey now. Either is coherent. The non-negotiable is the ROI clock: every agent in your stack earns its keep inside one platform cycle, or it gets killed.

## FAQ

**What is the core idea of Windows Just Became an Agentic OS?**

Windows is becoming the first major operating system designed around agents, not applications. The CEO question shifts from 'which AI app do we buy' to 'which agents get OS-level identity, what registry do they live in, and who governs the sandbox they run in.'.

**What should a CEO do Monday morning after reading Windows Just Became an Agentic OS?**

Start here: Pull the Agent Registry report from M365 admin. Snapshot what your tenant already exposes — Microsoft agents, partner agents, your own, and shared-by-creator. This is the baseline you'll govern against. Twenty minutes, not a project; Audit 'Reduce protections for agent connectors' across your fleet. Default off is almost certainly the right answer. Confirm it. If anyone needs an exception, make them write a ticket — not just toggle the setting; Test the agentic workspace on one Windows 11 dev machine. See the per-session data-sharing UI yourself before your employees do. The room should not learn about it from a help-desk ticket.

**What are the steps in Windows Just Became an Agentic OS?**

1) Ship the app with MSIX package identity; 2) OS auto-registers on install; 3) ODR exposes the server to agent sessions; 4) Sandbox gates which resources it reaches; 5) OS auto-unregisters on uninstall.

**Where do the claims in Windows Just Became an Agentic OS come from?**

The playbook cites Microsoft Learn · MCP servers on Windows; Microsoft Build 2026 coverage; Microsoft Learn · MCP servers on Windows (Nov 2025); Microsoft Foundry · May 2026 release notes.

## Sources

- [Microsoft Learn · MCP servers on Windows](https://learn.microsoft.com/en-us/windows/ai/mcp/servers/mcp-server-overview)
- [Microsoft Build 2026 coverage](https://wowhow.cloud/blogs/microsoft-build-2026-windows-agent-runtime-copilot-developer-guide-2026)
- [Microsoft Learn · MCP servers on Windows (Nov 2025)](https://learn.microsoft.com/en-us/windows/ai/mcp/servers/mcp-server-overview)
- [Microsoft Foundry · May 2026 release notes](https://devblogs.microsoft.com/foundry/whats-new-in-microsoft-foundry-may-2026/)
- [Build 2026 Windows Agent Runtime preview](https://wowhow.cloud/blogs/microsoft-build-2026-windows-agent-runtime-copilot-developer-guide-2026)
- [Microsoft Build 2026 — agent ecosystem strategy](https://wowhow.cloud/blogs/microsoft-build-2026-windows-agent-runtime-copilot-developer-guide-2026)
- [Windows agentic era · Davuluri reorg](https://tech.yahoo.com/ai/copilot/articles/windows-entering-agentic-era-ai-135546725.html)
- [MCP servers on Windows · architecture](https://learn.microsoft.com/en-us/windows/ai/mcp/servers/mcp-server-overview)
- [Microsoft Learn · MCP server registration on Windows](https://learn.microsoft.com/en-us/windows/ai/mcp/servers/mcp-server-overview)
- [MCP servers on Windows · registration paths](https://learn.microsoft.com/en-us/windows/ai/mcp/servers/mcp-server-overview)
- [Windows entering its 'agentic era' · Yahoo Tech](https://tech.yahoo.com/ai/copilot/articles/windows-entering-agentic-era-ai-135546725.html)
- [Model Context Protocol (Anthropic)](https://modelcontextprotocol.io)
- [Copilot Studio May 2026 — A2A GA](https://www.microsoft.com/en-us/microsoft-copilot/blog/copilot-studio/new-and-improved-computer-using-agents-a-new-workflows-experience-and-real-time-voice-experiences/)
- [Microsoft Build 2026 · Agent Framework GA](https://wowhow.cloud/blogs/microsoft-build-2026-windows-agent-runtime-copilot-developer-guide-2026)
- [Microsoft Agent Framework (AutoGen + Semantic Kernel convergence)](https://wowhow.cloud/blogs/microsoft-build-2026-windows-agent-runtime-copilot-developer-guide-2026)
- [BuildClub field experience · 135+ internal pipelines](https://buildclub.com)
- [Internal workshop framework](https://buildclub.com)
- [M365 admin · Agent Registry](https://learn.microsoft.com/en-us/microsoft-365/admin/manage/agent-registry)
- [.NET Blog · Agent Governance Toolkit MCP Extensions](https://devblogs.microsoft.com/dotnet/announcing-agent-governance-toolkit-mcp-extensions-for-dotnet/)
- [MCP servers on Windows · sandbox model](https://learn.microsoft.com/en-us/windows/ai/mcp/servers/mcp-server-overview)
- [Microsoft Foundry May 2026 · managed VNET GA](https://devblogs.microsoft.com/foundry/whats-new-in-microsoft-foundry-may-2026/)
- [Microsoft Foundry May 2026](https://devblogs.microsoft.com/foundry/whats-new-in-microsoft-foundry-may-2026/)
- [Windows MCP servers overview](https://learn.microsoft.com/en-us/windows/ai/mcp/servers/mcp-server-overview)
- [Build 2026 pricing notes](https://wowhow.cloud/blogs/microsoft-build-2026-windows-agent-runtime-copilot-developer-guide-2026)

---

Work with BuildClub: https://buildclub.com/engagements