Microsoft expands security tools for Claude, agents, and data

Microsoft has announced a set of security updates focused on AI agents, data protection, and identity controls across its security portfolio. The company said the changes are designed to give security teams more visibility and governance as organizations spread AI tools across more apps, platforms, and cloud environments.

The biggest update for many teams is new visibility into Anthropic Claude inside Microsoft Purview. Microsoft said security and compliance teams can now detect and investigate Claude usage alongside other cloud applications in the wider AI ecosystem. The new connector for Microsoft Purview covers Claude Enterprise and Claude Platform activity, including feed activity, chat conversations, and audit log signals.

Microsoft said the integration extends to Enterprise Claude.ai, Claude Console, and Claude API. The goal, according to the company, is to help teams see how Claude is being used and protect sensitive data across a broader AI estate.

Microsoft also said a new Data Security Posture Management, or DSPM, experience in Purview is now generally available. DSPM is the process of finding sensitive data, assessing exposure, and reducing risk. Microsoft said the updated experience combines discovery, protection, and remediation in one workflow, with goal-oriented flows, deeper remediation, expanded reporting, and third-party visibility.

For security teams, that means they can investigate risks and take action without moving between separate tools and processes. Microsoft said the new design is meant to help teams identify sensitive data and act on it at scale.

Microsoft Purview Data Security Investigations is also getting new capabilities. The company said it now includes optical character recognition, or OCR, and custom examination features. OCR extracts text from images, which brings visual content into investigations that would otherwise be harder to search or analyze.

Microsoft said investigations already include examinations that identify credentials, risk, and personally identifiable data, or PII. With custom examination, investigators can define their own analysis rules based on their specific needs, giving them more flexibility when reviewing content and incidents.

On the identity side, Microsoft introduced Entra ID Account recovery. The company described it as an advanced authentication recovery mechanism that lets users regain access to organizational accounts when they have lost all registered authentication methods.

Microsoft said Account recovery is different from a traditional password reset. Instead of simply replacing a password, it focuses on identity verification and rebuilding trust before new authentication methods are issued.

Microsoft also said Windows 365 for Agents is expanding in public preview. The feature works with Microsoft Agent 365 to provide what the company described as a consistent, secure environment for running and governing agents.

According to Microsoft, Agent 365 determines what work an agent is allowed to do using organizational policies and identity. Windows 365 for Agents defines where that work runs by giving agents Cloud PCs, so they can operate their own desktops and applications in a managed and auditable environment.

Microsoft said the updates are part of its broader security push as organizations adopt more AI tools and deploy more agents across different platforms. The company pointed readers to its security blog, LinkedIn, X account, and the Microsoft Build event on June 2-3, 2026, for more details.