Artificial intelligence agents are becoming a new class of worker inside the enterprise: not people, not ordinary applications, and not simple automation scripts. Microsoft Agent 365 is Microsoft’s answer to the management problem this creates. It gives administrators one place to find agents, give them identities, control what they can reach, watch what they do, and apply security and compliance rules across agents built in Microsoft tools, bought from partners, or discovered after they are already running.

The simplest definition

Microsoft Agent 365 is a Microsoft 365 service that provides a central control plane for artificial intelligence agents. An artificial intelligence agent is software that can reason over a goal, use tools or data, and take actions with some degree of autonomy.

The product’s job can be reduced to four verbs: discover, manage, govern, and secure. Discover means finding agents across the tenant, including ones that were not formally registered. Manage means keeping an inventory and assigning owners, settings, and lifecycle controls. Govern means deciding what each agent is allowed to access or do. Secure means applying identity, threat protection, data protection, and device controls to non-human actors.

It belongs to the Microsoft 365 family, so it is meant to sit beside the administrative and security systems many organisations already use for Outlook, Teams, SharePoint, OneDrive, and Microsoft 365 Copilot. It is not a separate island that asks administrators to rebuild their governance model from scratch.

📌
Plain meaning. Agent 365 is best understood as the management and security layer for agents, not as the tool that builds every agent.
The product's job reduces to four verbs: discover, manage, govern, and secure agents across the tenant. Agent 365 in Four Verbs Discoverfind every agent Manageinventory and owners Governwhat it can do Secureidentity and threats
The product's job reduces to four verbs: discover, manage, govern, and secure agents across the tenant.

What a control plane means

The term control plane comes from networking and cloud architecture. In those systems, the data plane is where work happens, and the control plane is where rules are set. The data plane moves traffic, runs workloads, and performs tasks. The control plane keeps inventory, assigns permissions, applies policy, and records what happened.

For agents, the distinction matters. An agent may read mail, search documents, call an application programming interface, update a record, or draft a message. Those actions happen in the agent’s working environment. Agent 365 sits above that activity. It does not replace the agent’s runtime, language model, or builder tool. It governs the agent as an actor.

This separation is why one control plane can cover many kinds of agents. The control plane does not need every agent to be built the same way. It needs each agent to be identifiable, visible, policy-bound, and monitored.

The data plane is where agent work happens; the control plane sits above it to set and record the rules. Data Plane vs Control Plane Data plane Control plane Runs workloads Moves traffic Performs tasks Keeps inventory Applies policy Records activity
The data plane is where agent work happens; the control plane sits above it to set and record the rules.

Which agents it works with

A common mistake is to assume Agent 365 only manages agents made with Microsoft’s own low-code tools. Microsoft describes a broader target: agents built on Microsoft platforms, agents bought or integrated from third parties, and agents found in the environment after the fact.

That range matters because enterprise agent adoption is rarely tidy. One team may build a customer-service agent in Microsoft Copilot Studio. Developers may build a code-first agent in Microsoft Foundry. A business unit may buy a specialised agent from a partner. Someone may connect an unsanctioned agent to organisational data before central information technology knows it exists.

Agent 365 is designed to bring these sources into one registry and one governance model. The promise is not that every agent becomes identical. The promise is that every agent can be made visible, assigned an identity, linked to an owner, governed by policy, and monitored through common controls.

  • Agents built in Microsoft Copilot Studio by business users or makers.
  • Agents built in Microsoft Foundry by developers and engineering teams.
  • Third-party or partner agents integrated into the Microsoft 365 environment.
  • Shadow agents discovered after they are already active in the tenant.

The services underneath it

Agent 365 does not try to invent a new security universe for agents. Its design extends existing Microsoft security, identity, compliance, and management services so they can treat agents as governed actors.

Microsoft Entra provides identity. In this context, Microsoft Entra Agent ID gives an agent a first-class identity rather than forcing it to hide behind a user account or a vague application credential. Microsoft Defender provides threat protection, watching for risky or malicious behaviour. Microsoft Purview provides information protection, compliance, and data-loss prevention, which means controls that help stop sensitive data from going where it should not. Microsoft Intune provides device and endpoint management for the machines involved in agent activity.

Other Microsoft 365 components complete the operating environment. Microsoft 365 apps and Work IQ help agents work against organisational context such as documents, messages, meetings, and collaboration data. The Microsoft 365 admin center is the administrative place where many of these controls are surfaced.

Agent 365 extends existing Microsoft services so they can treat agents as governed actors. Services Underneath Microsoft Entraidentity Microsoft Defenderthreat protection Microsoft Purviewdata protection Microsoft Intunedevice management
Agent 365 extends existing Microsoft services so they can treat agents as governed actors.

Why identity comes first

Agent governance begins with identity because every serious control depends on knowing exactly which actor is acting. If an agent borrows a person’s account, shares credentials with another process, or appears only as an anonymous integration, it becomes difficult to set boundaries or investigate behaviour.

A named agent identity changes that. Administrators can authenticate the agent, authorize only the access it needs, attach policy to that identity, assign an owner, monitor its actions, and revoke access when the agent is retired or misbehaves.

This is the reason Microsoft positions Microsoft Entra Agent ID as foundational to Agent 365. Identity is not merely a login step. It is the anchor for access control, audit trails, accountability, and threat response.

⚠️
Borrowed identity. An agent using a human account is harder to govern because its actions are mixed with the person’s actions.
A named agent identity is the anchor for access control, audit trails, accountability, and threat response. Identity as the Anchor Named identitywho is acting Authorizeonly needed access Attach policyboundaries, owner Audit & revokeaccountability
A named agent identity is the anchor for access control, audit trails, accountability, and threat response.

What changes for leaders and practitioners

For a chief information officer, chief information security officer, platform owner, or enterprise architect, Agent 365 turns agent adoption from a collection of local experiments into a governance question. The practical decision is not simply which agent builder to standardise on. It is how to let many teams build or buy agents without losing visibility, policy control, or accountability.

That leads to concrete operating choices. Which agents must be registered before they run? Who owns each agent after deployment? Which data sources are off limits? What approval is required before an agent can send messages, call business systems, or act on behalf of a department? How long should logs be retained? What happens when an agent is no longer used?

The value of a central control plane is that these choices can become repeatable controls instead of one-off negotiations. A security team can define baseline policy. A compliance team can require auditability. Developers and business makers can still build, but within a model that makes ownership and risk visible.

  • Require every production agent to have an owner, purpose, and identity.
  • Separate build-time freedom from run-time governance.
  • Use least privilege, meaning each agent receives only the access it needs.
  • Plan for discovery of unregistered agents, not just approval of new ones.
  • Define retirement rules so unused agents do not keep stale access.

Availability, licensing, and fit

Microsoft Agent 365 became generally available for commercial customers on May 1, 2026. Generally available means the service is released for normal production use rather than limited preview testing.

Microsoft licenses Agent 365 on a per-user basis. It is available as a standalone subscription and is also included with Microsoft 365 E7. Microsoft describes it as working best when Microsoft 365 E5 is already in place, because many of the identity, security, compliance, and management capabilities it builds on are strongest in that environment.

The fit is clearest for organisations that expect agents to spread across many teams and tools. If an organisation has only a small pilot, local controls may feel sufficient for a while. Once agents begin touching sensitive data, acting across applications, or arriving from several sources, a central control plane becomes less of a convenience and more of an operating requirement.

Key takeaways

  • Microsoft Agent 365 is a Microsoft 365 service for discovering, managing, governing, and securing artificial intelligence agents.
  • It acts as a control plane: it sets rules and observes behaviour while agents continue doing work in their own runtimes.
  • It is intended to cover agents from Microsoft Copilot Studio, Microsoft Foundry, third-party sources, and discovered shadow agents.
  • Its foundation is the existing Microsoft stack: Microsoft Entra for identity, Defender for threat protection, Purview for data protection and compliance, and Intune for device management.
  • Microsoft Entra Agent ID is central because access control, audit, ownership, and response all depend on a clear agent identity.
  • Agent 365 became generally available for commercial customers on May 1, 2026, is licensed per user, is sold standalone, and is included with Microsoft 365 E7.

Glossary

Artificial intelligence agent
Software that can interpret a goal, use tools or data, and take actions with some degree of autonomy.
Control plane
The layer of a system that sets rules, assigns permissions, tracks inventory, and directs behaviour without doing the work itself.
Data plane
The layer where the actual work happens, such as reading files, calling services, sending messages, or updating records.
Microsoft Entra Agent ID
A Microsoft Entra capability that gives an agent its own identity so it can be authenticated, authorized, monitored, and governed.
Tenant
An organisation’s dedicated instance of a cloud service, including its users, data, settings, and administrative boundaries.
Data-loss prevention
Controls that help detect and stop sensitive information from being shared, copied, or moved in ways that violate policy.
Shadow agent
An agent that is already running or connected in an environment without having been formally registered or approved.
Generally available
A release stage in which a service is available for normal production use rather than limited preview or testing.