The control plane for agents
Agent 365 extends the tools you already run — Entra, Defender, Purview, Intune, and the Microsoft 365 admin center — to AI agents. Microsoft frames it around three verbs: observe, govern, secure. It reached general availability on May 1, 2026, standalone at $15/user/month or inside Microsoft 365 E7.
Five things it gives you
One inventory
Every agent — Microsoft, partner, org-built, and imported third-party — in a single registry in the Microsoft 365 admin center, with a Risks column aggregating high-severity signals from Entra, Defender, and Purview.
learn.microsoft.com →Entra Agent ID
Each agent gets its own first-class identity — built on service-principal infrastructure with an agent-specific subtype — so Conditional Access, auditing, and lifecycle management work the way they do for humans.
learn.microsoft.com →Agent map & telemetry
Dashboards, usage metrics, and an agent map that visualizes how agents connect to users, data, and each other — role-tuned so compliance, security, and IT each see the signals they own.
microsoft.com →Beyond Microsoft
Registry sync imports AWS Bedrock and Google Gemini Enterprise agents (preview), and Defender + Intune discover local agents on Windows endpoints — starting with OpenClaw, expanding to GitHub Copilot CLI and Claude Code.
microsoft.com/security →Defense in depth
Defender delivers runtime protection and end-to-end activity tracing; Purview enforces data protection, DLP, and audit; Entra network controls extend to Copilot Studio agents and endpoint agents for traffic inspection.
microsoft.com/security →Blueprint → Instance
The two objects you'll actually manage. A blueprint is the template — credentials, auth settings, inheritable permissions. An instance is the tenant-specific deployment with its own Entra Agent ID.
Agent Blueprint
- Defines capabilities and behavior rules
- Holds credentials and auth settings
- Permissions instances can inherit
- Provisions or deprovisions instances
Agent Instance
- Its own Entra Agent ID
- Tenant-specific configuration
- Scoped, least-privilege access
- Governed in the Agent Registry
Where agents come from
Microsoft agents
Pre-built agents like Researcher and Analyst, maintained by Microsoft. IT can pin, block, or restrict them via the registry — and install first-party agents in bulk with agent management rules.
Partner agents
Ecosystem agents from ISVs — Adobe, SAP, ServiceNow, Workday, Zendesk, n8n, and more — manageable through Agent 365 and deployable from the admin center.
Org-published agents
Built by your makers and developers in Copilot Studio or Foundry, then reviewed and published through your approval workflow. Your knowledge bots and process agents.
User-shared agents
Personal productivity agents users create and optionally share. Lowest ceremony, highest sprawl risk — exactly what naming conventions and lifecycle rules exist for.
Local & shadow agents
CLI and desktop agents running on endpoints, plus unregistered SaaS AI. The Shadow AI page, Entra discovery, and Intune policies exist to find and fence these.
Imported multicloud agents
AWS Bedrock and Google Gemini Enterprise agents synced into the registry (public preview), so your inventory isn't three consoles and a spreadsheet.
Readiness assessment
24 questions across six pillars. Answer honestly — "in progress" is a legitimate answer, and the plan this generates is only as good as the inputs. Your answers stay in this browser (localStorage) and can be shared as a link.
Governance checklist
The working list. Click the square to cycle each item: not started → done → partial. Filter by role to see just your lane. Progress saves in this browser; export CSV for your tracker of choice.
Naming convention builder
Sprawl starts with names. A registry full of "Test agent (2)" is unsearchable, unownable, and unretirable. Build your pattern here, then enforce it in the publish workflow — the generated metadata block goes straight into your governance doc.
Why this shape: the registry sorts alphabetically, so AGT- groups agents together, org+dept makes filters trivial, source code tells security the trust tier at a glance, and ENV keeps test agents out of production searches.
The first 90 days
Observe, then govern, then secure — in that order. Governing an inventory you haven't seen yet is how policies get written for a fleet that doesn't exist.
Observe
- Baseline the Agent Registry against what teams say they run — the delta is your shadow problem
- Turn on shadow-AI discovery (Entra) and review the Shadow AI page for local endpoint agents
- Walk the agent map; flag over-connected agents and anything with no obvious owner
- Kick off the oversharing assessment — agents will surface whatever permissions allow
- If multicloud: enable Bedrock / Gemini registry sync (preview) so it's one list
Govern
- Enforce the naming convention + metadata block (above) in a documented publish workflow
- Issue Entra Agent IDs for all sanctioned agents; kill shared registrations and standing maker credentials
- Apply Entra security policy templates, then tighten toward least privilege per agent
- Define the ownerless-agent default — reassign or retire — and automate it
- Use agent management rules for bulk actions instead of one-at-a-time clicking
Secure & scale
- Extend sensitivity labels and Purview DLP to agent interactions; turn on agent audit review
- Agree the IT / SOC split; exercise the rogue-agent playbook (block → revoke → investigate)
- Adopt the Defender advanced-hunting templates for agents
- Extend Entra network controls to Copilot Studio and endpoint agent traffic
- Start the cadence: usage reviews with owners, retire what nobody uses
Portal map
The question every admin actually asks: where do I click? Agent 365 isn't one portal — it's capabilities threaded through five. Here's who goes where.
M365 Admin Center
The Agent 365 overview dashboard and Agent Registry. Publish, pin, block, remove, reassign. Risks column, Shadow AI page, agent management rules for bulk actions, ownerless-agent management.
Microsoft Entra
Agent IDs, ownership, least-privilege access, Conditional Access for agents, network controls and traffic inspection, shadow-AI discovery via Entra Internet Access.
Microsoft Defender
Runtime threat detection, incident graphs including agent activity, advanced-hunting templates (e.g., agents running MCP tools on a maker's standing credentials), local-agent discovery.
Microsoft Purview
Sensitivity labels, DLP for agent interactions, audit of agent activity, insider-risk and compliance signals that surface in the registry's Security tab.
Microsoft Intune
Endpoint policies for local agents: detect managed devices running unmanaged agents and block common launch paths. Windows 365 for Agents Cloud PCs for policy-controlled agent workloads.
Roles & responsibilities
| Role | Owns |
|---|---|
| AI Administrator | Agent Registry day-to-day: publish, block, remove, approval workflows, management rules |
| AI Reader | View-only registry access — least privilege for reporting and audit |
| Global Admin | Tenant-wide control; delegates operations to the AI Administrator |
| Security Admin | Defender monitoring, Conditional Access for agents, incident response |
| Compliance Admin | Purview policies, sensitivity labels, DLP, audit review |
| Agent Owner | One agent's lifecycle: reviews, updates, retirement — every agent needs one |
| Business Sponsor | Business case, success metrics, budget for major agent deployments |
Licensing quick-ref
Agent 365 standalone
$15/user/month — the control plane on its own. Per-seat, on the M365 invoice. Microsoft recommends pairing with Entra ID P1/P2 or Entra Suite plus Purview DLP to use it fully.
Microsoft 365 E7
The "Frontier Suite" — bundles E5, M365 Copilot, Entra Suite, and Agent 365 in one SKU. GA alongside Agent 365 on May 1, 2026.
techcommunity →What Copilot doesn't cover
An M365 Copilot license lets people use and build agents — it does not include Agent 365 governance. Building runs on Copilot Studio / Foundry (consumption, Azure invoice); governing is Agent 365 (per-seat).
Key terms
Entra Agent ID
A dedicated identity type for agents — service-principal infrastructure with an agent-specific subtype, so CA, audit, and lifecycle work like they do for users.
Agent Blueprint
The parent template object: credentials, auth settings, inheritable permissions. Its one job in the tenant is provisioning or deprovisioning instances.
Agent Instance
A tenant-specific deployment of a blueprint, with its own Agent ID and configuration, managed by IT in the registry.
Agent Registry
The central inventory in the M365 admin center — adoption, activity, health, and aggregated risk per agent, with block/restrict actions inline.
Agent Store
The marketplace for discovering and installing Microsoft and partner agents; IT controls what's allowed in the tenant.
Agent Map
Visualization of how agents connect to users, resources, and other agents — the fastest way to spot an over-connected agent.
Shadow agents
AI tools operating without IT visibility — SaaS agents, local CLI agents, personal accounts. The gap discovery features exist to close.
Windows 365 for Agents
Cloud PCs purpose-built to run agent workloads inside policy-controlled environments instead of on someone's laptop.
Build path decider
"We need an agent" is a sentence, not a plan. Answer a few questions and get the right path — plus the governance steps that path implies.
Field FAQ
The questions that come up in real customer conversations, with sources.
Is Agent 365 generally available?
Yes — GA on May 1, 2026, alongside Microsoft 365 E7. The Frontier program continues as the early-access path for preview features without production SLAs.
What does it cost, and what license do I need?
$15/user/month standalone, or included in Microsoft 365 E7 (which bundles E5, M365 Copilot, Entra Suite, and Agent 365). An M365 Copilot license alone does not include Agent 365 governance. Pairing with Entra ID P1/P2 or Entra Suite plus Purview DLP is recommended to light up the full capability set.
Does Agent 365 govern agents outside Microsoft?
Increasingly, yes. Registry sync imports AWS Bedrock and Google Gemini Enterprise Agent Platform agents into the inventory (public preview at GA), and ecosystem partners — Adobe, SAP, ServiceNow, Workday, Zendesk, Manus, Genspark, n8n — ship agents manageable through Agent 365.
What about agents running locally on laptops?
GA added discovery and management of local AI agents on Windows endpoints via Defender and Intune — starting with OpenClaw and expanding to widely used agents like GitHub Copilot CLI and Claude Code. Admins can see which devices run them and use Intune policies to block common launch paths from the Shadow AI page.
What's the difference between Agent 365 and Copilot Studio?
Copilot Studio (and Azure AI Foundry) is where agents get built and run — developer-side, consumption-billed on Azure. Agent 365 is where agents get governed — identity, access, compliance, lifecycle — per-seat on the M365 invoice. Workshop vs. HR department.
How do I find risky agents fast?
The registry's Risks column aggregates high-severity signals from Entra, Defender, and Purview per agent; clicking through opens the agent's Security tab with investigation and a Block action. SOC teams get the full incident graph in Defender, including hunting templates like "agents running MCP tools on the maker's standing credentials."
What happens to an agent when its owner leaves?
Without a policy: it keeps running, unowned. The admin center supports managing ownerless agents (reassign or retire), but your governance policy should decide the default before it happens — automated reassignment to the team, or scheduled retirement after a grace period.
Can I use this planner before buying anything?
That's the point. The assessment and checklist are about the framework — ownership, naming, approval flow, data hygiene — which you want in place before agents scale, not after. Nothing here requires a license.