Windows AI Features Security: Recall, Agent Workspace and MCP on Windows

Windows 11 now ships AI features that capture the screen, act on what users see, run agents under their own accounts and connect those agents to local and remote tools, and several of them are on by default unless an administrator sets policy. Recall, Click to Do, the Copilot app, agent workspace and the Windows On-device Agent Registry for MCP servers each have their own controls, editions and preview status, spread across the WindowsAI policy CSP and Group Policy. This guide maps each feature to the settings that govern it, the identities it uses and what to log, and gives a hardening baseline for managed fleets. It is for endpoint engineers, Intune and Group Policy administrators and security architects. The general risks of AI running on the device are in the On-Device AI Security Guide, and Recall in depth is in Windows Recall Security. Policy details below are from Microsoft Learn as checked on 8 November 2026; several are Windows Insider Preview only and may change.

This is an independent guide from NHI Mgmt Group, based on Microsoft's public documentation as of November 2026. It is not sponsored or reviewed by Microsoft. Product features change, so confirm settings against Microsoft's current documentation.

Key takeaways

• Recall is off on managed devices; Click to Do is not. Microsoft states Recall is disabled and removed on managed devices until AllowRecallEnablement allows it, while Click to Do is available unless DisableClickToDo is set.
• Agents get their own identity. In agent workspace each agent runs under its own account in a separate Windows session, which makes agent actions distinguishable from the user's and gives you something to scope and audit.
• MCP on Windows has an admin plane. The On-device Agent Registry (ODR) lists MCP servers, and preview policies ConfigureAgentConnectors, AgentConnectorAccessPolicy and AgentConsentDuration control which connectors agents may use and for how long consent lasts.
• Many controls need Enterprise or Education. Recall deny lists, retention, storage caps and the DLP provider policy are listed for Enterprise and Education editions only, which matters for Pro fleets.
• Decide per feature, then pilot. Default-deny the agentic features while they are in preview, allow on-device text features where the data risk is acceptable, and pilot anything new with a small ring.

The Windows AI features in scope

The older TurnOffWindowsCopilot policy is marked deprecated and, per Microsoft Learn, does not apply to the new Copilot experience, so baselines that still rely on it are not doing what their owners think.

How identity and access work in Windows AI features

• Recall: users must enrol in Windows Hello Enhanced Sign-in Security (ESS) with at least one biometric option to open Recall, and must have Device Encryption or BitLocker on. Snapshots and the vector index are encrypted with keys protected by the TPM, tied to the user's Hello ESS identity and used inside a virtualisation-based security (VBS) enclave. Other users, including administrators, cannot view them. Snapshots stay on the device. See the Windows Hello for Business Guide.
• Consent model for Recall: administrators can allow Recall but cannot start snapshot saving for users; the user must opt in. DisableAIDataAnalysis ("Turn off saving snapshots for use with Recall") controls whether saving is permitted. Microsoft Learn's description and value table for this policy disagree on the meaning of the default, so test the behaviour before relying on it.
• Click to Do: analysis runs on the device and starts only when the user invokes it (Windows key + Q, Windows key + click and other entry points). Text actions run on the device with the Phi Silica model on the NPU. Content leaves the device only when the user picks an online action, such as web search through Bing.
• Agent workspace: each agent operates under its own account, separate from the user's, in its own Windows session. Microsoft's stated principles are non-repudiation (agent actions observable and distinguishable from user actions), least privilege (no more than the initiating user, granular and time-bound) and authorised data access (users approve queries for their data and the actions taken). When enabled, agents can request read and write access to six known folders: Documents, Downloads, Desktop, Music, Pictures and Videos, with per-agent "Allow Always", "Ask every time" or "Never allow" in recent preview builds.
• MCP servers through ODR: Microsoft says MCP servers registered with the ODR run in a separate, contained environment by default with access only to approved resources, and that users and administrators control which agents can reach each server through Windows Settings and Intune.

Where identity fits

Agent accounts and MCP connectors are non-human identities on the endpoint. Treat each agent account as a workload identity with an owner and a purpose, keep its folder grants to the minimum, and remember that MCP servers may hold their own tokens for remote services. Microsoft's own threat list for MCP on Windows names credential leakage from agents running with full user privileges. See the Local MCP Server Security Guide and the Agent Identity and Access Guide.

Admin roles and privileged access

These features are governed from the same consoles that can reconfigure or wipe the fleet, so the people who set AI policy hold real privilege.

• Intune: assign a custom role scoped to configuration profiles for the AI policy owners rather than broad Intune Administrator rights, and require multi-admin approval for high-impact actions where your tenant supports it. See the Microsoft Intune Guide.
• Group Policy: the policies sit under Computer or User Configuration, Administrative Templates, Windows Components, Windows AI (Paint policies under Windows Components, Paint; Copilot key under Windows Components, Windows Copilot). Restrict who can edit the GPOs that carry them.
• Local administrators: only an administrator can turn on "Experimental agentic features", and the setting then applies to all users on the device. Removing standing local admin rights is therefore also an AI control.
• Policy precedence: several policies exist at both device and user scope. Decide which scope you manage and document it, so a user-scope setting does not quietly loosen a device baseline.

Integrations, API tokens and service accounts

Microsoft's May 2025 announcement also describes all MCP client and server traffic passing through a trusted Windows proxy for policy, consent and audit, and per client-tool approval. It notes that the developer preview may not enforce all of these yet, with secure-by-default enforcement planned for general release. Plan as if enforcement is incomplete until Microsoft documents it as generally available. See the MCP Registry and Server Publishing Security Guide.

Logging and detection

• Configuration state: report on applied WindowsAI policies from Intune device configuration reports or Group Policy results, and alert when a device in a no-AI ring reports Recall or agentic features enabled.
• ODR logging: OnDeviceRegistryLoggingLevel sets on-device registry logging to 0 (errors), 1 (information) or 2 (debug). Use 1 for pilot devices so MCP server registrations and connections are recorded. Microsoft lists logging and auditing of MCP client and server interactions as an ODR capability.
• Inventory: the odr.exe command-line tool lists and manages registered MCP servers; collect its output through your endpoint management tooling to build an inventory of which servers exist on which devices.
• Threat behaviour: Recall's data store is a target for collection techniques such as ATT&CK T1005 Data from Local System, and the feature itself is a form of screen capture (T1113). Alert on unexpected processes reading Recall storage and on policy changes that enable Recall or export outside change control.
• Export: AllowRecallExport is off by default and applies only to devices in the European Economic Area; exports need Windows Hello authentication and are encrypted. Keep it off unless there is a documented need.

Metrics

• Percentage of managed devices compliant with the AI baseline for their ring.
• Number of devices with "Experimental agentic features" enabled outside the pilot group (target zero).
• Number of MCP servers registered per device and the share on the approved list.
• Median agent consent duration configured across rings.
• Recall-enabled devices with deny lists and the DLP provider policy applied.

Hardening baseline

The values below are NHI Mgmt Group recommendations for managed fleets, not Microsoft guidance or a Microsoft security baseline. Policy names, allowed values and defaults are taken from the Microsoft Learn WindowsAI Policy CSP reference; the choice of value for each ring is ours, so adjust it to your own risk assessment.

Rollout

1. Inventory hardware and builds: Recall and Click to Do need a Copilot+ PC (40 TOPS NPU, 16 GB RAM, 8 logical processors, 256 GB storage); know which devices can run them.
2. Apply the conservative baseline to all managed devices first, including the deprecated-policy clean-up.
3. Run a risk review per feature with privacy and data protection, covering what is captured, where it is processed and who can read it.
4. Pilot with a small ring using the pilot column, with ODR logging at information level and DLP in place.
5. Test rollback: confirm that setting AllowRecallEnablement to 0 removes the component and deletes snapshots after restart, and that forcing connectors off disconnects agents, before widening the ring.
6. Review every feature update: Insider Preview policies change; re-check Microsoft Learn on each Windows feature release.

Common misconfigurations

• Relying on TurnOffWindowsCopilot: it is deprecated and does not cover the new Copilot experience.
• Assuming Click to Do follows Recall: DisableClickToDo is separate, Click to Do is on by default, and the policy does not affect Click to Do inside Recall.
• Pro fleets expecting Recall filters: deny lists, retention, storage caps and the DLP provider are listed for Enterprise and Education only.
• Removing the Copilot app once: users can reinstall it, so removal without app control is temporary.
• Leaving connectors user-controlled: the default for ConfigureAgentConnectors is user in control, so any MCP server a user registers is available to agents until policy says otherwise.
• Local admin everywhere: any local administrator can enable experimental agentic features for every user on the device.

Framework mapping

Practitioner checklist

• Inventory Copilot+ PCs and Windows builds, and record which AI features each can run.
• Set AllowRecallEnablement, DisableClickToDo, RemoveMicrosoftCopilotApp and DisableSettingsAgent explicitly for every ring rather than relying on defaults.
• Replace any baseline that depends on the deprecated TurnOffWindowsCopilot policy.
• Force agent connectors off with ConfigureAgentConnectors until an MCP server allow list exists, then use AgentConnectorAccessPolicy.
• Shorten AgentConsentDuration from the 720-hour default for sensitive roles.
• Remove standing local administrator rights so users cannot enable experimental agentic features.
• Where Recall is allowed, apply deny lists, 30-day retention and the DLP provider policy, and keep export off.
• Collect ODR inventories with odr.exe and set OnDeviceRegistryLoggingLevel to information on pilot devices.
• Scope Intune and GPO rights for AI policy owners and protect those admin accounts with phishing-resistant MFA.

Standards and references

• Microsoft Learn: Policy CSP WindowsAI
• Microsoft Learn: Manage Recall for Windows clients
• Microsoft Learn: Manage Click to Do
• Microsoft Learn: MCP on Windows overview
• Microsoft Support: Experimental agentic features
• Windows Experience Blog: Securing the Model Context Protocol on Windows
• NIST: SP 800-53 Rev. 5 Security and Privacy Controls

Related NHI Mgmt Group resources: On-Device AI Security Guide · Windows Recall Security · Local MCP Server Security Guide · Windows 11 Security Settings Guide · Microsoft Intune Guide