Satya Nadella opened Build 2026 by making a developer conference sound like a security briefing. As AI agents morph from chatbots into the backbone of the enterprise network, he argued Tuesday at San Francisco’s Fort Mason Center, the Microsoft ecosystem will be there to serve and protect.
His message: Let OpenAI, Anthropic and Google race alongside Microsoft to build the smartest model. But at the end of the AI race, Microsoft is best positioned to handle the security heavy lifting, from identity and containment to the governance layer that keeps those agents in check.
[See Related: Microsoft Build 2026: Top 5 Cybersecurity Takeaways]
“Agents effectively are a new execution environment,” Nadella said during the keynote. They “reason continuously,” generate and run code, and take actions across files, devices and networks. Earlier, he described agents as systems that are “continuously storing, retrieving, reasoning, acting and learning.”
He said if AI agents are going to read files, join workflows, write code, call tools, touch business data and act on behalf of employees, they will need identities, policies, containment, monitoring and audit trails.
On Tuesday, Microsoft outlined how it planned to help developers keep things secure. It announced a security stack Tuesday around that pitch, including MDASH, its multi-model agentic vulnerability scanning harness; new Defender and GitHub Code Security integrations; the Agent 365 SDK; Microsoft Execution Containers; Windows 365 for Agents; Agent 365 local-agent discovery; Purview controls for agent prompts and sensitive data; Defender AI model scanning; and open governance work around ASSERT and the Agent Control Specification.
Keynote demos were full of whiz-bang examples: Copilots summarizing meetings, reading procedures, querying business data, writing code, opening pull requests, deploying backends and working through queues while humans admired their own newly effortless productivity.
The more agents behave like employees, developers and service accounts, the faster old security questions come roaring back: Who approved this thing? What identity does it use? What data can it touch? What did it do? Can we stop it?
Nadella’s answer was not one product or solution; rather, he outlined a platform grab. Naturally, Microsoft is in the middle, with AI spokes reaching out to a universe of Microsoft products and platforms: Outlook, Teams, SharePoint, OneDrive, Windows, GitHub, Fabric, Foundry and Azure.
It wants Foundry, Microsoft’s platform for building and running AI apps and agents, to be where developers assemble, test and tune them. It wants Entra, Defender, Purview, Intune and Agent 365 to become the management layer security teams use to govern the whole mess.
This is Microsoft being Microsoft. It is not trying to win the AI race by claiming one perfect model. It is trying to make the frontier model that OpenAI, Anthropic and Google are racing to perfect less important than the enterprise machinery around it.
Microsoft vs. the world
Microsoft’s latest quarterly results underscore the importance of the AI fork in the road. Microsoft’s AI business has surpassed a $37 billion annual revenue run rate, up 123% year over year. The company is also spending heavily on AI infrastructure while investors press Big Tech to prove that chips, data centers and models can turn into durable enterprise revenue.
Build is Microsoft’s chance to clear its AI throat just as the competition shifts into overdrive. Anthropic confidentially filed for an IPO on June 1, the day before Build opened. OpenAI is reportedly preparing its own IPO. Google is pushing Gemini deeper into search and enterprise workflows to blunt gains by OpenAI and Anthropic. AWS is selling itself as the neutral cloud layer for companies that do not want to be boxed into one model or one vendor.
Microsoft’s Build pitch shows how it plans to differ from the other AI pitches making the CEO keynote circuit. It already owns the inbox, calendar, office documents, developer workflow, identity stack and a large piece of the security console. Nadella’s argument was that those assets become more valuable, not less, when agents start doing the work inside a structured ecosystem.
Microsoft wants to be seen as the lion tamer able to wrangle agents before they become a shadow IT horror show. It is also making a very Microsoft bet that the company that governs the agents can tax the agent economy.
The catch
Build 2026 made Microsoft’s agent strategy look coherent. It did not make the hard questions go away. The biggest is concentration: Microsoft is asking customers to trust one vendor for the agent runtime, productivity data, the developer workflow, the identity layer, the security console, the governance plane and the bill.
It may be convenient, but it’s an enormous amount of control in a single set of hands.
Agent 365 may be built to manage agents beyond Microsoft’s stack. But it remains to be seen what policy and audit trails look like when agents live in AWS, Google Cloud, OpenAI, Anthropic, Cursor or Replit.
Containment is only part of the problem. A sandbox can stop an agent from deleting a file. It cannot explain why the agent tried, whether a poisoned document nudged it, what memory it used or which tool call sent it sideways.
Yes, Build 2026 was not a cybersecurity conference. But it may still end up as one of the year’s bigger security signals.
The five that matter most for security teams — identity, containment, data protection, the software supply chain and agentic defense — get their own breakdown in “Five Cybersecurity Takeaways from Microsoft Build 2026,” publishing June 3.
Photo courtesy of Microsoft by Dan DeLong
