Microsoft Agent 365
Microsoft Agent 365 is a per-user licensed control plane for observing, governing and securing AI agents across an organization, whether built by Microsoft, partners or in-house. It became generally available for commercial customers on 1 May 2026 and relies on Microsoft Entra, Purview and Defender.1
Also known as Agent 365, A365
- Intended for
- IT and AI administrators, Security operations and identity teams, Compliance and data protection teams, Business owners and sponsors of agents
- Runs on
- Microsoft 365 cloud service, Commercial segment (general availability), Covers agents on Microsoft platforms, partner platforms and, through preview sync, AWS Bedrock and Google Cloud
At a glance
- What is it?
- Agent 365 is Microsoft's management layer for agents. Microsoft groups it into three pillars: observe (a central registry and agent map showing adoption, activity and health), govern (lifecycle, access and compliance controls through the registry in the Microsoft 365 admin center, Microsoft Entra and Microsoft Purview) and secure (Entra access controls, Purview data protection and Defender threat protection extended to agents). It has been generally available for the commercial segment on a per-user basis since 1 May 2026. It is included in Microsoft 365 E7 and sold standalone.12
- What does it do?
- Admins see every agent available in the tenant in one registry, split into Microsoft agents, partner-built agents, agents published by the organization and agents shared by individual creators, with counts of ownerless and unmanaged agents. They can block, delete or remove agents, pin up to three agents for users, apply security policy templates when onboarding an agent, export the inventory and review risk signals consolidated from Entra, Purview and Defender. Entra applies Conditional Access and network controls to agent identities, Purview applies DLP and information protection, and Defender detects threats. A Microsoft Graph API for the registry is in preview.3
- Who needs it?
- Organizations where employees build or use many agents across Copilot Studio, Microsoft Foundry, Microsoft 365 and third-party platforms, and where IT and security need an inventory, owners and policies for them. Microsoft says each license covers a person who manages or sponsors agents, or who uses agents to do work on their behalf. It suits tenants already using E5-level security, since Microsoft states Agent 365 works best with E5 as a prerequisite.12
- What does it need?134
- At least one user with a qualifying Microsoft Agent 365 license (standalone, or through Microsoft 365 E7)
- Microsoft Entra ID, with Entra Agent ID for agent identities
- Microsoft 365 E5 recommended by Microsoft as a prerequisite; Agent 365 is sold as an add-on to E5, A5 or Business Premium (or Defender Suite plus Purview Suite)
- Admins with the AI Administrator role for registry tasks, and security roles in Entra, Defender and Purview to follow risk deep links
- Commercial cloud tenant (general availability is for the Commercial segment)
- What it is not
- Agent 365 is not a tool for building agents; Copilot Studio, Foundry, the Agents SDK and Agent Framework do that. It is not the same as Microsoft Entra Agent ID, which is available to all Entra customers; Agent 365 is what extends Entra security features such as Conditional Access to agents. It does not automatically see every agent: agents published through Microsoft 365 channels and registered with an Entra Agent ID appear on their own, while agents built elsewhere need extra steps. Several capabilities, such as registry sync with other clouds and Windows 365 for Agents, were still in preview at launch.45
Availability and licensing. Generally available for commercial customers on a per-user basis since 1 May 2026. Price checked 26 Oct 2026 on Microsoft's US product page: $15.00 per user per month, paid yearly, annual commitment. Included in Microsoft 365 E7. Some features were in preview at launch, including registry sync with AWS Bedrock and Google Cloud, agents in team workflows with their own access, and Windows 365 for Agents (US only).25
The problem it solves
As agents spread, organizations lose track of who built them, what data they can reach and what they do on users' behalf. Agents can become ownerless when their creator leaves, overshare data or be targeted by adversarial attacks.
Agent 365 applies the identity, data and threat controls that already protect users to agents, and gives admins one registry with owners, risk signals and lifecycle actions. It depends on the rest of the Microsoft security stack to do the enforcement.
How it works
Microsoft's documentation describes how the pieces connect:
- Registry in the Microsoft 365 admin center (Agents, All agents, Registry) lists agents by publisher type, channel (Copilot, Teams, Outlook, Microsoft 365 apps, SharePoint), platform and data source.
- Agent map and analytics show how agents connect and perform.
- Microsoft Entra Agent ID gives agents identities; Agent 365 extends Conditional Access, risk detection, lifecycle and network controls to them.
- Microsoft Purview adds information protection, DLP and risk safeguards for agent data.
- Microsoft Defender adds threat detection and runtime protection.
- Risk signals from these platforms are aggregated per agent in the registry, with deep links to each portal.
Agents published through Microsoft 365 channels and registered with an Entra Agent ID appear automatically. Registry sync with AWS Bedrock and Google Cloud was in public preview at launch.34
Diagram as a list
Agents & automation
- Agents (Microsoft, partner, published by your org, shared by creators)Agents built in Copilot Studio, Foundry, Microsoft 365 or third-party platforms
- Agent registry and agent map (Microsoft 365 admin center)Inventory, ownership, lifecycle actions, pinning and risk view
Developer tools
- Microsoft Graph registry API (preview)Programmatic access to the agent inventory and detailsConnects to Agent registry and agent map (Microsoft 365 admin center)
Security, identity & governance
- Microsoft Entra Agent ID and Conditional AccessAgent identities and access policies, network controls
- Microsoft PurviewInformation protection, DLP and risk safeguards for agent data
- Microsoft DefenderThreat detection and runtime protection for agents
- Microsoft Intune (local agent discovery, preview)Finds agents running on user endpoints, starting with OpenClawConnects to Agent registry and agent map (Microsoft 365 admin center)
Cloud & hybrid infrastructure
- Registry sync with AWS Bedrock and Google Cloud (preview)Brings agents from other clouds into the inventoryConnects to Agent registry and agent map (Microsoft 365 admin center)
Capabilities
Central agent registry3
One list of agents in the tenant by publisher type, channel, platform and data source, with counts of total, ownerless and unmanaged agents, filters, export and manifest upload.
Why it matters: Gives IT an inventory to govern instead of discovering agents one by one.
Limits: The same Copilot Studio agent can appear more than once with different publisher types, and agents built outside Microsoft 365 channels need extra steps to appear.
Lifecycle and ownership controls35
Admins can find ownerless agents and block or delete them, pin agents for users, apply policy templates when onboarding, and set rules to expire inactive or ownerless agents.
Why it matters: Prevents abandoned agents from keeping access after their creators leave.
Limits: Available actions differ by agent type and publisher state; some entries can only be blocked.
Identity and access for agents2
Microsoft Entra extends Conditional Access, risk-based access and internet traffic filtering to agent identities; network controls also cover Copilot Studio agents and local agents on endpoints.
Why it matters: Agents get the same access discipline as users.
Limits: These Entra security extensions need the Agent 365 license; Entra Agent ID alone does not include them.
Data and threat protection12
Purview applies information protection, DLP and risk safeguards to agents; Defender adds continuous threat detection and blocks unsafe behavior.
Why it matters: Reduces data leakage and attacks through agents.
Limits: Context mapping, policy-based controls and runtime blocking through Intune and Defender were announced for public preview in June 2026.
Consolidated risk signals3
The registry shows an aggregated count of high, medium and low risk signals per agent from Purview, Entra and Defender, with an Agents at risk view.
Why it matters: IT admins can triage agent risk without switching portals.
Limits: Requires an E7 or Agent 365 license, counts can lag the security portals by up to an hour, and the updated experience was rolling out gradually.
Cross-platform reach2
Microsoft lists integration with Microsoft 365 Copilot, Teams, Copilot Studio and Foundry agents, partner agents, and registry sync with AWS Bedrock and Google Cloud.
Why it matters: One governance plane can cover agents built on several platforms.
Limits: Registry sync was in public preview at launch, with lifecycle actions such as start, stop and delete planned; local agent discovery started with OpenClaw.
Practical use cases
Hundreds of agents have appeared in the tenant and nobody knows who owns them.
- Approach
- Open the Agent 365 registry, filter for agents without owners and unmanaged agents, then assign owners or block and delete them.
- Role of Microsoft Agent 365
- Agent 365 provides the inventory, ownerless count and lifecycle actions.
- Data, infrastructure and skills
- Agent 365 or E7 licenses and an AI Administrator.
- Type of benefit
- Visibility and control
- Caveats
- Some agents appear more than once by design; agents built outside Microsoft 365 need extra steps to show up.
- First step
- Export the registry to a CSV and review the ownerless list with business units.
Security wants agents to follow the same access rules as users.
- Approach
- Use Entra Agent ID identities for agents and apply Conditional Access and network controls through Agent 365, with Purview DLP on agent data.
- Role of Microsoft Agent 365
- Agent 365 extends Entra, Purview and Defender controls to agents.
- Data, infrastructure and skills
- Agent 365 licenses, Entra ID and Purview configuration.
- Type of benefit
- Risk reduction
- Caveats
- Runtime blocking and some Defender features were in preview; test policies on a small set of agents first.
- First step
- Pick three widely used agents and apply a security policy template to them.
Who uses it
Lloyds Banking Group
ScalingLloyds Banking Group: Copilot and GitHub Copilot at scale
46 minutes per day (measured)
Financial services, United Kingdom
NHS England, with the Department of Health and Social Care
ScalingNHS England: Microsoft 365 Copilot from trial to national rollout
43 minutes per day or more (measured)
Healthcare, United Kingdom (England)
Works with
Requires
- Microsoft EntraAgent identities come from Microsoft Entra Agent ID, and Entra enforces access controls for agents.
Optional integration
- Microsoft PurviewPurview provides information protection, DLP and risk safeguards for agents.
- Microsoft Defender XDRDefender adds threat detection and runtime protection for agents.
- Microsoft IntuneLocal agent discovery and policy controls through Intune and Defender, in preview at launch.
Complementary tools
- Microsoft Copilot StudioAgent 365 inventories Copilot Studio agents and extends Entra network controls to them.
- Microsoft EntraExtending Entra security features to agents requires Microsoft Agent 365.
- Microsoft Foundry Agent ServiceFoundry agents are among the Microsoft platforms Agent 365 integrates with.
Same family
- Microsoft 365 E7Agent 365 is included in Microsoft 365 E7.
Optional integration for
- Windows 365Windows 365 for Agents can be integrated into Agent 365 agents.
- Microsoft PurviewDSPM AI observability lists Agent 365 agents, and Purview publishes controls for Agent 365.
Relationship labels follow Microsoft's documentation. "Alternative approaches" does not mean one is better: each profile says when it fits.
Getting started
License at least one user
Assign a qualifying Agent 365 license or Microsoft 365 E7 to enable Agent 365 in the tenant.
Check: Agent 365 features, such as the Risks column, appear in the registry.
Review the registry
In the Microsoft 365 admin center go to Agents, All agents, Registry and review total, ownerless and unmanaged agents.
Check: You have counts for each and an exported CSV.
Set access and data policies
Apply security policy templates when deploying agents and configure Purview and Defender for AI as linked from the Agent 365 docs.
Check: New agent deployments show the chosen template applied.
Assign roles for risk follow-up
Give security staff the roles needed to open Entra, Defender and Purview deep links from risk details.
Check: A security reader can open the source portal from an agent's risk pane.
Official resources
Deciding whether you need it?
Three free tools apply Microsoft's own published guidance to your situation, and say when Microsoft Agent 365 or any new technology is not needed.
Sources
Each statement above links to the source it comes from. Labels say who reported it.
- Microsoft Agent 365 overview (opens in a new tab)
- Microsoft Agent 365, now generally available, expands capabilities and integrations (Microsoft Security Blog, 1 May 2026) (opens in a new tab)
- Agent Registry in Microsoft 365 admin center (Microsoft Learn) (opens in a new tab)
- What is Microsoft Entra Agent ID? (opens in a new tab)
- Microsoft Agent 365: the control plane for agents (product page) (opens in a new tab)
- Overview: Microsoft Copilot Studio (opens in a new tab)
Thank you. Your correction was sent.
The editors check it against the sources. If you left an email address, they may reply about it.