跳到正文
DEV Community· Burrowbox·· 2 小時前AI 評分59

Windows 365 for Agents 讓智能體領取 Cloud PCs，如何用 Microsoft Agent Framework 建立同類借用池

Windows 365 for Agents checks Cloud PCs out to agents. Build the same check-out pool with Microsoft Agent Framework

AI 導讀

文章示範如何以 Microsoft Agent Framework 和 Burrowbox 建立類似 Windows 365 for Agents 的智能體桌面借用池。

正文

What Windows 365 for Agents does

Windows 365 for Agents is Microsoft's class of Cloud PCs built for agents to use. An agent checks out a Cloud PC when it needs one for a task, then checks it back in when the task is done so another agent can use it. (Microsoft Learn)

The same overview and Microsoft's related pages add more detail:

  • Governed machines. The Cloud PCs are managed by Intune and governed by Microsoft Entra ID. Admins get session logs, observability tools and human-in-the-loop controls.
  • A session lifecycle. A session goes Prepare, Acquire, Connect, Act, Release. On release the Cloud PC is reset and goes back to its pool. A session with no MCP activity for 30 minutes is evicted, and there's no maximum runtime. (Agent session lifecycle)
  • Generally available. Windows 365 for Agents went GA in the week of June 1, 2026 (What's new). Copilot Studio computer use went GA in May 2026, and the Windows 365 for Agents MCP server in June 2026 (Copilot Studio what's new).
  • Copilot Studio Cloud PC pools are still in preview. They're Entra joined and Intune enrolled, run Windows 11 Enterprise, and scale automatically. Each environment can have up to five pools of up to 10 Cloud PCs. Each tenant gets 50 free hours for published agents running autonomously. (Use a Cloud PC pool)

The pattern

A pool of ready machines sits behind an API. An agent checks one out for a task and works on it while a person can watch. When the task ends, the machine is checked back in with nothing carried over. Every hand-off is recorded, and the cost lands on the team or customer the work was for.

If your company runs on Entra and Intune and your agents need Windows apps, Microsoft's version fits. If you run agents for many outside customers, or Linux desktops are enough, you can build the same loop with a few REST calls. The Project Mariner post used a pool to run many tasks at once, and the Manus post gave each task a durable workflow. Here the focus is governance: check-out, check-in, an audit trail and cost per customer.

Build it with Microsoft Agent Framework and Burrowbox

Microsoft Agent Framework reached 1.0 for Python and .NET on April 3, 2026. Its MCPStreamableHTTPTool connects an agent to a remote MCP server (Microsoft Learn), and every Burrowbox machine has its own MCP endpoint. Burrowbox isn't involved with Microsoft or Windows 365.

1. A warm pool

A warm pool keeps booted machines waiting. A template runs on each one before it counts as ready, so a checked-out machine already has your tools.

curl -X POST https://burrowbox.dev/api/pools \
  -H "Authorization: Bearer $BURROWBOX_KEY" -H "Content-Type: application/json" \
  -d '{"name": "agents", "size": "small", "target": 3,
       "setup": [{"type": "tool", "tool": "apps_install", "arguments": {"kind": "apt", "packages": ["libreoffice"]}}]}'

2. Check out, run the agent, check in

pip install agent-framework httpx

import asyncio, os
import httpx
from agent_framework import Agent, MCPStreamableHTTPTool
from agent_framework.openai import OpenAIChatClient

POOL_ID = os.environ["POOL_ID"]
auth = {"Authorization": f"Bearer {os.environ['BURROWBOX_KEY']}"}

async def run_task(customer_id: str, team: str, task: str) -> str:
    async with httpx.AsyncClient(base_url="https://burrowbox.dev", headers=auth, timeout=120) as http:
        # Check out: a machine from the pool, tagged with who the work is for.
        r = await http.post(f"/api/pools/{POOL_ID}/claim", json={
            "externalId": customer_id, "labels": {"team": team},
            "ttlMinutes": 60, "onExpire": "destroy",  # backstop if check-in never runs
        })
        r.raise_for_status()
        m = r.json()
        token = m["mcpToken"]  # reaches this machine only
        try:
            async with Agent(
                client=OpenAIChatClient(),
                name="DesktopAgent",
                instructions="You operate a Linux desktop with the machine tools. Save results under ~/out.",
                tools=MCPStreamableHTTPTool(
                    name="machine",
                    url=m["mcpUrl"],
                    header_provider=lambda _kwargs: {"Authorization": f"Bearer {token}"},
                ),
            ) as agent:
                result = await agent.run(task)
                return result.text
        finally:
            # Check in: delete the machine, so nothing carries over.
            await http.delete(f"/api/machines/{m['id']}")

print(asyncio.run(run_task("cus_8f2a", "finance", "Open ~/inbox/march.csv in LibreOffice and total column C")))

The agent gets the machine's tools: shell_run, apps_launch, get_app_state, click, browser_navigate, browser_snapshot and the rest of the machine MCP. A claimed machine is brand new, pool machines are never reused, and the pool refills itself in the background.

Deleting is the closest match to Microsoft's reset on release. If the customer might send a follow-up, stop the machine instead with POST /api/machines/{id}/stop. A stop keeps its files, installed apps and browser logins, and costs $0.001 an hour while it's off. The Oct 6 post covers when each one makes sense.

3. The audit log

Burrowbox sends a signed event webhook for each hand-off: machine.claimed at check-out, then machine.stopped (with detail.reason), machine.expired or machine.destroyed. Each event carries the machine's externalId and labels, so the events can serve as your audit trail.

curl -X POST https://burrowbox.dev/api/event-webhooks \
  -H "Authorization: Bearer $BURROWBOX_KEY" -H "Content-Type: application/json" \
  -d '{"url": "https://api.example.com/burrowbox/events",
       "events": ["machine.claimed", "machine.stopped", "machine.expired", "machine.destroyed"]}'

Save the whsec_… secret it returns once. In your handler, check the signature with the verify function from the events docs, then write a row:

import json, os, sqlite3

db = sqlite3.connect("audit.db")
db.execute("""create table if not exists machine_events (
  id text primary key, type text, created_at text,
  machine_id text, customer text, labels text, reason text)""")

def record(raw_body: bytes, signature_header: str) -> int:
    if not verify(raw_body, signature_header, os.environ["BURROWBOX_WHSEC"]):
        return 400
    e = json.loads(raw_body)
    m, detail = e["data"]["machine"], e["data"].get("detail") or {}
    db.execute("insert or ignore into machine_events values (?,?,?,?,?,?,?)",
               (e["id"], e["type"], e["createdAt"], m["id"], m.get("externalId"),
                json.dumps(m.get("labels") or {}), detail.get("reason")))
    db.commit()
    return 200

Events can arrive more than once and out of order. The primary key on id handles the duplicates, and created_at gives you the order.

4. Cost per customer

Usage is billed by the minute and attributed to the externalId the machine had at that minute (Billing):

curl "https://burrowbox.dev/api/usage?groupBy=externalId" -H "Authorization: Bearer $BURROWBOX_KEY"
# → { "groups": [{ "externalId": "cus_8f2a", "usageMicros": 2980000, "machines": 2 }, …] }

Amounts are in micro-dollars (1,000,000 = $1). The row with externalId: null holds untagged usage, including idle pool time before a claim. A small machine costs $0.11 an hour while running, and a pool of three idle small machines about $0.33 an hour.

5. A person in the loop

To let someone watch the session, create a short-lived live-view link on your server with POST /api/machines/{id}/live-view. With interactive: false, input is blocked on the machine itself. Create a new link with interactive: true when a person needs to take over.

Where it differs from Windows 365 for Agents

  • Linux only. Burrowbox machines are Linux desktops. If the agent needs a Windows-only app, this won't run it.
  • No Entra or Intune. Access is your API key plus one machine-scoped mcpToken per check-out. You enforce policy in your own code.
  • No idle timer. Microsoft evicts a session after 30 minutes without MCP activity. On Burrowbox, ttlMinutes is a fixed deadline, after which onExpire stops or destroys the machine.
  • Check-in can keep state. Besides a clean delete, you can stop a customer's machine and start it later with their logins still there.

Key takeaways

  • Windows 365 for Agents lends Windows Cloud PCs to agents through check-out and check-in, governed by Entra and Intune.
  • The same loop works with a warm pool: claim to check out, delete or stop to check in.
  • Tag every claim with externalId. The event webhooks become your audit log and /api/usage becomes your chargeback report.
  • Agent Framework's MCPStreamableHTTPTool connects an agent to the checked-out machine with a token that reaches only that machine.

Create an account to try it.

FAQ

What is Windows 365 for Agents?

It's a class of Windows Cloud PCs for AI agents, built on the Windows 365 platform. Agents check out a Cloud PC for a task and check it back in afterwards, and the Cloud PC is reset before the next session. It went GA in June 2026.

Do I need Entra ID and Intune to use Copilot Studio Cloud PC pools?

Yes. Microsoft's setup guide lists a working Intune and Microsoft Entra tenant as a prerequisite, and the pools are Entra joined and Intune enrolled.

How do I connect Microsoft Agent Framework to a remote MCP server?

Use MCPStreamableHTTPTool with the server's url, and add an Authorization header through header_provider. Pass the tool to an Agent with tools=.

Can I see what each customer's agent cost?

Yes, if you tag each claim with your customer's id as externalId. GET /api/usage?groupBy=externalId then returns usage per customer.

Sources

Originally published on the Burrowbox blog.

來源：DEV Community · dev.to

#教學/實踐#Agent#MCP/工具調用#Microsoft