Microsoft Agent 365 is a centralized control plane that lets IT and security teams discover, govern, and secure every AI agent in their organization — the agents built in Copilot Studio and Azure AI Foundry, the ones bundled into SaaS tools, and the ones employees wired up without asking. It became generally available for commercial customers on May 1, 2026, and it extends the identity, compliance, and threat-protection controls you already run — Microsoft Entra, Purview, and Defender — to non-human actors. In short: it governs agents the way you already govern employees.

This guide is written for the IT directors, security leads, and platform architects who can no longer answer a simple question — how many agents are running in our tenant, what can they touch, and who owns them? If agents are multiplying faster than your governance model can absorb them, this is the decision you are actually facing. We cover what Agent 365 does, when it is warranted, how it is licensed, and how to stand it up without stalling the AI program it is meant to protect.

Key takeaways

• Agent 365 is a governance layer, not an agent builder. It registers, identifies, and secures agents — it does not create them. You still build in Copilot Studio or Azure AI Foundry.
• The core problem is agent sprawl. Most organizations cannot say how many agents they run or what those agents can access; Microsoft’s own IT team used Agent 365 to bring more than 500,000 agents into a single registry.
• It is built on controls you already own. Agent 365 extends Microsoft Entra (identity), Microsoft Purview (data security), and Microsoft Defender (threat protection) to agents rather than introducing a parallel stack.
• Every agent gets a real identity. Through Microsoft Entra Agent ID, each agent is a first-class directory object with Conditional Access, lifecycle, and least-privilege controls — the end of anonymous automation.
• Licensing is per user, not per agent. Agent 365 lists at $15 per user per month standalone (or is included with Microsoft 365 E7), and one licensed user is covered for every agent they own, manage, or interact with.
• Governance is now a prerequisite, not a phase two. Gartner projects more than 40% of agentic AI projects will be canceled by 2027, and unmanaged agent risk is a leading reason.

What is Microsoft Agent 365, in one answer?

The short answer: Agent 365 is Microsoft’s enterprise control plane for AI agents — a single place to observe, govern, and secure every agent operating across your Microsoft 365 environment. It does three concrete things.

• Observe: A centralized Agent Registry in the Microsoft 365 admin center inventories every agent — Microsoft-built, partner-built, and self-registered — with an agent map, analytics, and health signals so admins can see adoption, activity, and risk in real time.
• Govern: Centralized lifecycle management, access control, and compliance — publish, deploy, approve, block, or delete agents from one console, with guardrails applied consistently across the enterprise.
• Secure: Identity through Microsoft Entra Agent ID, data protection through Microsoft Purview, and threat protection through Microsoft Defender, all extended to cover agent behavior.

It was announced at Microsoft Ignite 2025, reached general availability on May 1, 2026, and picked up multi-tenant management, partner risk signals, and usage-based spend oversight in subsequent updates. The distinction that matters most for buyers: it is the layer that manages agents, not the layer that makes them.

Why do enterprises need Agent 365 at all?

Because agents already outran the controls built for users and apps. An AI agent accesses documents, calls APIs, sends messages, and increasingly makes decisions on someone’s behalf — but most enterprises were never designed to manage non-human actors at scale. IDC projects businesses will use 1.3 billion AI agents by 2028, and the governance gap widens with every one that ships.

The specific risks Agent 365 is built to close are concrete, not theoretical:

• Agent sprawl: User-created and SaaS-embedded agents proliferate across apps, endpoints, and cloud, expanding the attack surface faster than IT can track it.
• Over-privileged agents: Agents granted excessive access to data and resources — a standing liability the moment one is compromised or misused.
• Tool misuse: Agents manipulated through prompt injection into abusing the very tools and permissions they were given.
• No accountable owner: Automation running with no identity, no lifecycle, and no one on the hook when it acts.

An agent you cannot see is an agent you cannot govern, and an agent you cannot govern is a breach waiting for a trigger.

This is exactly why a governance-first posture matters more than raw capability. We make the same argument in our breakdown of why AI agents fail without governance-first architecture: the organizations getting durable value are the ones that decided how they would control agents before they scaled them. BabyBots runs fixed-fee Agent 365 readiness assessments that inventory the agents already in your tenant, map their access, and hand you a prioritized governance plan — typically in a single working engagement.

How does Agent 365 actually secure agents?

It extends your existing security infrastructure to agents rather than bolting on a separate system — a distributed security model with centralized visibility. Three Microsoft services do the work.

The three security pillars, compared

Microsoft Entra (identity)

• What it governs: Agent identity, authentication, and access — via Microsoft Entra Agent ID.
• How it works: Every agent becomes a first-class directory object with its own identity, subject to Conditional Access, lifecycle rules, and least-privilege access, with defined owners and sponsors.

Microsoft Purview (data security)

• What it governs: What data an agent can see, use, and expose.
• How it works: Sensitivity labeling, data loss prevention, and compliance controls extend to agent activity, so an agent cannot become a side door around your data policies.

Microsoft Defender (threat protection)

• What it governs: Runtime threats against and from agents.
• How it works: Detection and response cover agent behavior — including tool misuse and anomalous activity — feeding into the same security operations workflows your team already uses.

The linchpin is Microsoft Entra Agent ID. Agents built in Copilot Studio and Azure AI Foundry receive an Entra identity automatically at creation, which means authentication and policy enforcement apply from the first run — not as an afterthought. Adaptive Conditional Access can then block agents showing anomalous behavior or tied to risky users, the same machinery you already trust for employees.

When do you actually need Agent 365 versus native controls?

Not every organization needs the full control plane on day one, but the threshold arrives faster than most expect. Use this as a decision guide.

Agent 365 versus governing agents without it

You can likely wait if

• Scale: A handful of agents, all built by one central team, all known and documented.
• Access: Agents touch low-sensitivity data and non-critical systems.
• Ownership: Every agent has a named owner and a manual review cadence you can actually sustain.

You need Agent 365 now if

• Scale: Agents are being created across departments, in SaaS tools, and by non-IT staff — and no single registry exists.
• Access: Agents reach regulated data, customer records, or systems where a wrong action is expensive or irreversible.
• Ownership: You cannot produce, on demand, a list of every agent and what it can do.

If you land in the second column on any row, native per-platform settings will not hold. The value of Agent 365 is precisely that it unifies discovery and control across every agent source instead of leaving you to stitch together Copilot Studio, Azure, and third-party consoles by hand.

How is Agent 365 licensed and priced?

Agent 365 is licensed per user, not per agent, and lists at $15 per user per month as a standalone subscription — or it is included with Microsoft 365 E7. A single user license covers every agent that person owns, manages, sponsors, or interacts with, whether the agent acts on their behalf or operates with its own access. The standalone license requires a qualifying base — Microsoft 365 E5, the Defender plus Purview Suite Frontline Worker bundle, or Microsoft 365 Business Premium.

Two clarifications save budget conversations later. First, Agent 365 governs agents; it does not build or run them — the cost of building and operating agents in Copilot Studio is a separate, consumption-metered line item. We break that side down in our guide to what AI agents actually cost in Microsoft 365. Second, full “agent user” identities — agents with their own mailbox, OneDrive, and org-chart presence — remain in the Frontier preview program, so plan the governance seat and the execution meter as two distinct numbers.

Frequently asked questions

Is Microsoft Agent 365 generally available?

Yes. Agent 365 reached general availability for commercial customers on May 1, 2026, after being announced at Microsoft Ignite 2025. Some capabilities — notably full agent-user identities with their own mailbox and OneDrive — remain in the Frontier preview program, so confirm feature-by-feature availability against your tenant before you scope a rollout.

Does Agent 365 replace Copilot Studio?

No. They solve different problems. Copilot Studio is where you build and configure agents; Agent 365 is where you discover, govern, and secure them once they exist. Most enterprises run both — agents are created in Copilot Studio or Azure AI Foundry and then governed centrally through Agent 365.

What is Microsoft Entra Agent ID?

Entra Agent ID is the identity foundation underneath Agent 365. It gives every AI agent a first-class identity in Microsoft Entra, so agents can be authenticated, authorized, governed, and audited like users and workloads. Agents built in Copilot Studio and Azure AI Foundry receive an Entra identity automatically at creation, which is what makes Conditional Access and least-privilege enforcement possible.

How much does Agent 365 cost?

It lists at $15 per user per month as a standalone subscription, or is included with Microsoft 365 E7. The standalone license requires a qualifying base license — Microsoft 365 E5, the Defender plus Purview Suite Frontline Worker bundle, or Microsoft 365 Business Premium. Remember that this price governs agents; building and running them in Copilot Studio is billed separately through consumption.

Does Agent 365 govern third-party and SaaS agents?

Yes — that is a core reason it exists. The Agent Registry inventories agents built on Microsoft platforms, agents from ecosystem partners, and agents you register yourself, and later updates added partner risk signals and multi-tenant management. The goal is one control plane over every agent source, not just Microsoft-built ones.

How long does an Agent 365 rollout take?

The technical enablement is fast because it rides on infrastructure you already run — Entra, Purview, and Defender. The real work is discovery and policy: inventorying the agents already in your tenant, assigning owners, and defining access guardrails. A focused readiness assessment can produce a prioritized governance plan in a single engagement; full enforcement then rolls out in phases by risk tier.

Where this is heading

Agent governance is following the exact arc that identity and device management did — from an afterthought to a non-negotiable control plane. As agent counts climb toward the billions IDC projects, the enterprises that win will not be the ones with the most agents; they will be the ones that can prove, at any moment, what every agent is, what it can touch, and who owns it. Agent 365 is Microsoft’s bet that this control plane belongs next to your existing identity and security stack, not in a separate silo — and for Microsoft-ecosystem organizations, that bet is increasingly the path of least resistance.

Govern your agents before they govern your risk

If you cannot currently list every agent in your tenant and what it can access, that is the gap to close first. Book a BabyBots Agent 365 readiness assessment — in a single working session we inventory the agents already running, map their identities and access, and hand you a prioritized governance and rollout plan built on the Entra, Purview, and Defender controls you already own. Governance-first, fixed-fee, and designed so your team owns the result.

Sources

• Microsoft Security Blog — Microsoft Agent 365, now generally available (May 1, 2026)
• Microsoft Learn — Microsoft Agent 365 overview
• Microsoft Learn — Why does an enterprise need Agent 365?
• Microsoft Learn — Secure AI agents at scale using Microsoft Agent 365
• Microsoft Learn — Microsoft Agent 365 service description (plans and licensing)
• Microsoft Learn — Microsoft Entra Agent ID key concepts
• Microsoft Inside Track — Implementing Agent 365 at Microsoft (500,000+ agents)
• Microsoft Tech Community — What’s new in Agent 365, July 2026
• Devoteam — Microsoft Agent 365 and the IDC 1.3 billion agents forecast