Microsoft Agent 365 May Update: Defender Runtime Blocks Agent Threat Behaviors, Cross-Cloud Registry Syncs AWS/GCP Agents Under M365 Governance

Microsoft Community Hub·medium signal

The Agent 365 May 2026 update adds Microsoft Defender runtime detection that can block suspicious agent behaviors (e.g., an agent abusing email MCP permissions) and trigger incident alerts for investigation. New registry sync connects ecosystem partner platforms (AWS, Google Cloud) so agents built elsewhere are governed under the same Agent 365 policies. Policy templates group Entra, Purview, Defender, and SharePoint settings into reusable governance profiles for agent onboarding at scale.