Microsoft Scout: enterprise autopilot agent runs on OpenClaw framework with Entra identity controls
Microsoft introduced Scout at Build 2026, an always-on enterprise autopilot agent built on the open-source OpenClaw framework. Unlike chatbots requiring prompts, Scout operates autonomously on behalf of users with its own identity, executing long-running tasks: reading/writing local files, running shell scripts, applying code patches, launching parallel sub-agents, and automating browser sessions. Scout integrates with Work IQ (Microsoft's AI layer across Microsoft 365 apps) and supports Model Context Protocol (MCP) servers for extending access to third-party tools.
Security is central: each Scout instance gets its own Entra identity with scoped credentials, redacted diagnostic logs, and binding to Microsoft Purview sensitivity labels and Data Loss Prevention policies. Highly sensitive operations require human approval before execution. However, early security analysis flagged OpenClaw's core architecture: one researcher warned that agent privilege escalation and file-system access without isolation present 'total system compromise' risks until OpenClaw is rewritten for security-first design.
For enterprise operators: Scout signals Microsoft's bet that agents will move from experimental to mission-critical workloads. The Entra identity model and Purview binding attempt to address the governance gap that has plagued earlier agent frameworks. However, teams must carefully evaluate the security implications of always-on agents with local file/shell access before deploying Scout into production environments with sensitive data or systems.
Sources
- Primary source
- infoq.com
“Scout is built on the open-source agent framework OpenClaw, originally created by Peter Steinberger, who recently joined OpenAI. OpenClaw self-describes as 'The AI that actually does things.' Like OpenClaw, Scout can execute highly privileged local operations, including reading and writing local files, executing shell scripts, applying code patches, launching specialized sub-agents for parallel tasks, and automating browser sessions.”
- infoq.com
“Microsoft seeks to mitigate the risks by assigning each Scout instance its own governed Entra identity. Rather than running under a generic shared service account, Scout acts as an attributable entity within the corporate directory. Its credentials are scoped to individual tasks, redacted from diagnostic logs, and bound by Microsoft Purview sensitivity labels and Data Loss Prevention policies.”
- infoq.com
“The verdict is clear: until the core architecture is rewritten for security-first isolation, no one—home users or enterprises—should be running this tool.”