Microsoft Agent 365 is Microsoft's control plane for AI agents, generally available since 1 May 2026 and licensed per user. Microsoft describes it as a way to observe, govern and secure the agents in an organisation. Its agent registry also comes with Microsoft 365 plans. Owners, purpose, review dates and retirement rules remain your decisions.
Agents now come from many places. People with a licence for Microsoft Copilot (formerly Microsoft 365 Copilot) create them from SharePoint sites, makers build them in Copilot Studio, and developers publish them from other platforms. Sooner or later someone asks whether the organisation needs Agent 365, and what it would change.
This article answers that question in order: what Agent 365 is, what the registry shows, how agents get an identity, which features need the licence, and which decisions no product takes for you. Our Microsoft AI governance page shows how we put those decisions into practice.
What is Microsoft Agent 365?
Microsoft Agent 365 is Microsoft's own control plane for agents, generally available for commercial customers since 1 May 2026 and licensed per user, according to the Microsoft Agent 365 overview. Microsoft organises it around three ideas:
- Observe: a central registry and a map of your agents.
- Govern: lifecycle and access, through the registry, Microsoft Entra and Microsoft Purview.
- Secure: protection through Entra, Purview and Microsoft Defender.
Agent 365 is included in Microsoft 365 E7, alongside E5, Microsoft Copilot and the Microsoft Entra Suite. It is also sold as an add-on to E5, A5 and Business Premium. Microsoft says it works best with E5, and at least one licensed user is needed to switch it on. We do not quote prices here: ask your licensing partner for current terms.
What does the agent registry list?
The agent registry in the Microsoft 365 admin center lists the agents available in your organisation, as the agent registry documentation explains. You do not need Agent 365 to open it.
Microsoft sorts agents into four types: Microsoft agents, agents built by external partners, agents published by your organisation and agents shared by their creator. Two counters are worth watching from day one:
- Agents without owners: agents that have lost the person who answered for them.
- Unmanaged agents: agents created or managed outside Agent 365, which get neither its protection nor its activity monitoring.
Give both counters an owner on the IT side. An agent without an owner keeps its access while nobody answers for it. An unmanaged agent may be perfectly legitimate, but someone should decide whether it is brought under your rules or retired.
The full list can be exported to CSV, with more than 30 fields per agent. Risk signals from Purview, Entra and Defender appear in the registry with an Agent 365 or Microsoft 365 E7 licence.
Roles matter as much as the list. An admin with the AI Reader role can see every agent without an extra licence. Approving agent requests and assigning owners are reserved for the AI Administrator and Global Administrator roles, as the admin center documentation for Agent 365 states. Decide early who holds each role: it is the first governance decision you will make.
How does each agent get an identity?
Microsoft Entra Agent ID gives each agent its own identity, so its access can be governed like any other account. It is generally available, open to all Microsoft Entra customers, and also works with agents built outside Microsoft (What is Microsoft Entra Agent ID).
Applying Entra security controls to agents, such as Conditional Access, needs Agent 365. For Conditional Access, that means a Microsoft Agent 365 licence paired with at least Microsoft Entra ID P1 or Microsoft 365 E3, or Microsoft 365 E7, as the Microsoft Entra licensing page sets out.
One detail shapes everything that follows. Microsoft is bringing its agent registries together: Agent 365 lists every agent in one registry, including agents that have no Microsoft Entra identity, while the Entra admin center only shows agents that have one (agent registry convergence). Access and identity controls apply to agents with an identity. For the others, your rules on owners, sharing and retirement carry most of the weight.
Which agents are in scope?
The registry covers agents from Microsoft's own platforms: Copilot Studio, SharePoint, Agent Builder, Foundry and the Agents Toolkit, plus Microsoft agents such as Researcher. Drafts are visible for Copilot Studio agents only. Each platform brings its own governance questions:
- SharePoint agents: people with a Copilot licence can create agents from SharePoint sites and files, with no feature to switch on first. An agent only uses content its user is allowed to open (agents in SharePoint). The quality of your SharePoint permissions decides what these agents return. We cover them in detail in SharePoint agents: who can create them and how to govern them.
- Copilot Studio agents: makers can ground an agent on public websites and share it widely. Admins can block public website knowledge with a data policy and cap sharing in Managed Environments. Our article on Power Platform governance for Copilot Studio goes through environments and data policies step by step.
Agents from other vendors can appear too. Some partner agents can be deployed from the admin center. The registry can also sync agents built on connected platforms such as Amazon Bedrock, Google Vertex AI and Salesforce Agentforce. Synchronisation is manual, and what Agent 365 can monitor and control varies by platform (connected platforms).
AI assistants that people use outside Microsoft 365, such as ChatGPT Enterprise and Claude Enterprise, raise a different set of questions. Our ChatGPT and Claude governance page covers them.
Which Agent 365 features need a licence?
The registry and basic agent actions come with Microsoft 365 plans. Policies, activity monitoring and the protections that Entra, Purview, Defender and Intune apply to agents need Agent 365 or Microsoft 365 E7. The split is set out in the Agent 365 service description.
Included with Microsoft 365 plans (Enterprise, Business, Education and Frontline):
- The agent inventory in the registry.
- Basic actions: publish, deploy, block, delete, approve, assign, reassign the owner and pin.
- Automated lifecycle rules based on conditions.
- Syncing agents from external platforms into the registry.
Needs Agent 365 or Microsoft 365 E7:
- Policy templates applied to agents, and monitoring of agent activity.
- Control over the tools agents can reach, including Microsoft's MCP servers.
- Entra controls for agents: access packages, sponsor workflows, Conditional Access and network controls.
- Purview controls for agents: audit, eDiscovery, data lifecycle, insider risk, sensitivity labels and data loss prevention.
- Defender detection and hunting for agents, and Intune controls such as blocking unauthorised local agents.
Two of these are worth a closer look. Microsoft Purview treats an Agent 365 agent like a user: it is audited automatically and can be added to DLP, retention and insider risk policies. With Agent 365, Microsoft Defender can detect threats against agents and block risky tool calls before they run.
Because the licence is per user, the useful question is which people and which agents those protections must cover. Work that out with your security team and your licensing partner before you buy, not after.
What do you still decide about each agent?
Agent 365 and the registry give you the list and the controls. Deciding who answers for each agent, what it is for, who may use it, when it is reviewed and when it goes stays with your organisation. These are the six decisions to make.
Who owns each agent?
The registry flags agents without owners, and an AI Administrator can reassign one. Choosing the right person is a business decision. The owner should be someone who relies on the agent and can say whether it is still needed, not only the person who built it. Agree what happens when an owner leaves: who takes over, and how quickly the agent is reviewed.
What is the agent for, and what may it read?
Write down the purpose and the knowledge sources in one line per agent. For Copilot Studio agents, Power Platform data policies decide which connectors and knowledge sources are allowed, including public websites, and they apply to agents in every tenant (data policies in Copilot Studio). For SharePoint agents, the sources are SharePoint sites and files, so oversharing there becomes oversharing in the agent. Our Copilot governance best practices cover how to fix that first.
Who approves wide sharing?
In Managed Environments, admins can stop makers sharing an agent with whole groups and cap how many people can use it. These limits apply to agents that require sign-in (sharing limits). Decide when an agent may be opened to the whole organisation, and who signs that off.
When is each agent reviewed?
The registry supports automated lifecycle rules based on conditions. Which conditions, and what happens next, are yours to decide: for example a review date agreed when the agent is published, and a period of inactivity you set after which the owner is asked to confirm. A review that nobody is asked to complete does not happen.
How is an agent retired?
Blocking and deleting are basic actions in the registry. For SharePoint agents, blocking in the admin center currently applies to Copilot Chat only; Restricted Content Discovery turns agent features off for a whole site. For Copilot Studio agents, the Power Platform inventory lists every agent, app and flow in the tenant and lets admins block a published agent while they investigate. Decide the order: ask the owner, block, wait, then delete, with each step recorded.
What evidence do you keep?
Copilot interactions are recorded in the Microsoft Purview audit log, including which files were used (audit logs for Copilot), and Agent 365 agents are audited automatically. Owner decisions, review dates and approvals are records you keep yourself. The EU AI Act does not require a formal AI inventory, but keeping one is the practical way to know which tools are used and who needs training.
A simple operating model for agents
A handful of written rules, each tied to a Microsoft control and a named decision maker, is enough to start. The table below is a starting point to adapt, not a standard.
Agent rules, the Microsoft control that helps, and who decides
Example operating model; adapt the owners to your organisation.
| Rule | Microsoft control that helps | Who owns the decision |
|---|---|---|
| Every agent has a named owner | Agent registry: counter of agents without owners, owner reassignment | The business team that relies on the agent |
| Only a few admins approve agents and assign owners | AI Administrator and Global Administrator roles; AI Reader for read-only access | IT, with security |
| Public website knowledge needs approval | Power Platform data policies for Copilot Studio agents | Security, with the agent owner |
| Sharing beyond a team gets a second look | Managed Environments sharing limits, for agents that require sign-in | IT, on request from the owner |
| Agents with an identity follow your access rules | Microsoft Entra Agent ID; Conditional Access for agents with Agent 365 | Identity team |
| Sensitive data stays inside policy | Purview audit, labels and DLP for Agent 365 agents | Compliance or data protection |
| Risky tool calls are stopped | Defender protection for agents with Agent 365 | Security operations |
| Unused agents are retired | Registry lifecycle rules; blocking in the Power Platform inventory | The owner first, then IT |
| Every decision is recorded | Purview audit log; registry export to CSV | Compliance |
Where to start, in this order:
- Give the AI Reader role to the people who need to see every agent.
- Export the registry and sort by agents without owners and unmanaged agents.
- Name an owner for each agent that people still use, and retire the rest after asking.
- Set the data policy for public website knowledge and the sharing limits in Managed Environments.
- Agree review dates and the inactivity period you will act on.
- Decide which records auditors and your data protection officer will ask for.
Keep the first version short. Rules that owners understand and actually answer are worth more than a complete policy that nobody reads, and you can add rules once the first reviews have run.
How Neptune helps
Neptune is an integrator. We select the governance tooling that fits your tenant and your licences, implement it with your team, train your admins and agent makers, and support you once it runs: professional services during the project, then customer success.
We start from the Microsoft controls you already have: the agent registry, Power Platform data policies and Managed Environments, and Agent 365 where you license it. The governance layer we put in place then adds the follow-up for Copilot Studio and SharePoint agents:
- Every Copilot Studio and SharePoint agent gets a named owner, and agents nobody uses are retired once the owner confirms.
- Connectors used by each agent are checked, and agents grounded on public websites or shared with the whole organisation without approval are flagged, ranked by severity and sent to the agent owner.
- SharePoint agents are listed with their site, their maker and their activity.
- Agents are governed alongside the teams, sites and permissions they use.
- Each of these agents is recorded with an owner, a purpose and the data it can reach, which is the practical basis for GDPR and EU AI Act records.
The tool is connected with permissions reviewed by your security team. We run the first inventory with you, rules start in report mode so you see what would be flagged, and enforcement is switched on in waves, with owners informed.
Agents built in Agent Builder or Foundry, or synced from other platforms, are listed in the agent registry and managed there and in Agent 365. See how we cover AI agents within Microsoft 365 governance, or contact us to talk about the agents in your tenant.
Sources
- Overview of Microsoft Agent 365
- Microsoft Agent 365 service description
- Agent registry in the Microsoft 365 admin center
- Agent 365 in the Microsoft 365 admin center
- Connected platforms in Microsoft Agent 365
- What is Microsoft Entra Agent ID
- What's new in Microsoft Entra Agent ID
- Microsoft Entra licensing
- Agent registry convergence in Microsoft Entra
- Microsoft Purview for Agent 365 agents
- Microsoft Defender security for AI
- Manage access to agents in SharePoint
- Data policies in Copilot Studio
- Sharing limits for Copilot Studio agents
- Power Platform inventory
- Audit logs for Copilot and AI applications
- Regulation (EU) 2024/1689, the EU AI Act
