Agent 365: Centralized Governance of AI Agents in Microsoft 365

The proliferation of AI agents in Microsoft 365 environments poses a concrete governance problem: who deployed what, with what access, and on what data? Agent 365 is Microsoft's answer to this question. This centralized control platform is designed for M365 administrators, security architects, and teams responsible for identity and compliance.

What Agent 365 Is and Why It Changes Everything

Agent 365 is integrated into the Microsoft 365 admin center. It aggregates in a single interface visibility, access management, security controls, and cost tracking for all AI agents in the organization — whether created by your internal developers, partners, third-party publishers, or directly by Microsoft.

The platform relies on native signals from Microsoft Entra, Microsoft Purview, Microsoft Defender, and Microsoft Intune. It doesn't create a parallel security layer: it orchestrates existing protections and applies them to the specific scope of AI agents.

The agents covered span a broad spectrum:

• Agents created in Copilot Studio or Agent Builder (Microsoft 365)
• Agents deployed in Azure AI Foundry
• SharePoint Agents and agents packaged by Microsoft or its ISV partners
• Third-party agents from AWS Bedrock, Google Cloud, Databricks Genie, Anthropic Claude, Salesforce AgentForce

The Unified Agent Registry: Complete Visibility of Your Agent Fleet

The unified agent registry is the central entry point for Agent 365. It automatically inventories all agents detected in your tenant, regardless of their original platform.

For each registered agent, the registry exposes:

• Managed Identity: Does the agent have its own identity (service principal, managed identity) with associated permissions?
• Designated Owner: Who is responsible for the agent in the organization?
• User Access: Which accounts or groups have the ability to interact with the agent?
• Data and Tools Scope: Which data sources, connectors, plugins, and MCP (Model Context Protocol) servers has the agent been configured with?
• Applied Security Controls: Which Entra, Purview, or Defender policies are active on this agent?
• API Permissions: Which endpoints, connectors, or MCP servers is the agent authorized to call?
• Recent Activity and Usage Trends over time

All agent actions are logged via OpenTelemetry (OTel), an open standard that ensures consistent tracing across all connected AI stacks — including third-party platforms.

The Agent Map: Mapping Dependencies

The agent map provides a visual representation of agents running on different platforms. It visualizes connections between agents, users, data, and tools — useful for identifying unexpected call chains or unanticipated cross-access.

External Registry Synchronization

Agent 365 allows you to import agents from other cloud platforms via registry synchronization. Available connectors include:

Once synchronization is configured, agents from external platforms appear in the unified registry with their metadata. The administrator thus has a consolidated view without having to navigate between multiple consoles.

Access Control: Who Can Use What

Agent 365 introduces a dedicated role — Agent 365 Administrator — that manages the publication and sharing of agents in Microsoft Copilot.

The lifecycle of an agent follows a structured flow:

Automating Routine Governance

For repetitive operations, Agent 365 offers automated rules. Concrete example: when an employee leaves the organization, agents they owned are automatically reassigned to their manager. This type of rule prevents orphaned agents — a classic Shadow AI risk vector.

From the registry, an administrator can also:

• Block an undesirable or high-risk agent
• Change the owner of an existing agent
• Manage tools (MCP servers, plugins, connectors) and block those deemed non-compliant

Security Controls: Entra, Purview, Defender, and Intune Serving Agents

Agent 365's security controls continuously evaluate access requests, prevent data leaks, and protect against threats specific to AI agents.

From the Agent 365 Settings, you create reusable policy templates that reference protections managed in each Microsoft security platform. These templates are applicable to agents with or without their own identity.

Configurable content in a template:

• Entra Conditional Access: access conditions, MFA, device compliance
• Entra Identity Governance Access Packages: lifetime, approval workflow
• Custom Security Attributes: classify agents according to your own taxonomies
• Purview Policies: data loss prevention (DLP) adapted to agent interactions
• Defender Alerts: detection of abnormal behaviors
• Intune Strategies: confinement of local agents

Shadow AI: Blocking Unauthorized Local Agents

For local AI agents running without authorization on user endpoints, Agent 365 allows you to:

• Configure default blocks applied by Intune policies
• Require session isolation in Microsoft execution containers, separating the agent from the primary user profile

This approach directly addresses the Shadow AI vector without requiring custom development — existing Intune policies serve as the enforcement mechanism.

Adoption Analytics: Providing Visibility to Business Leaders

Visibility is not reserved for administrators. The Agent 365 Dashboard exposes adoption indicators filterable by group, organization, function, or license type — accessible to team leads and managers.

Available data includes:

• Usage trends by group with temporal comparisons
• Ranking of most-used agents
• Detail by agent: usage statistics and evolution over time
• View of the creation environment (who builds agents, in which tool)

These analytics serve two distinct purposes: identifying over-utilized agents that merit additional investment, and detecting those that fail to find an audience despite deployment.

Cost Management: Usage Credits and Budget Limits

Agent 365 integrates a usage-based service management module to prevent unanticipated budget overruns. Relevant services — including Copilot Cowork and the Work IQ API — are disabled by default and must be explicitly enabled.

Granular Policies by Group and Prepaid Credits

Beyond the organizational policy, you can create spending policies by group with their own caps — useful for allocating separate budgets by department or project.

Agent 365 also offers the purchase of prepaid credits at reduced rates (example: 300,000 prepaid credits) combinable with usage-based billing for excess credits. This mixed approach lets you optimize costs on predictable usage while maintaining flexibility.

Implementation: PowerShell Agent Inventory via Microsoft Graph

Required Module: Microsoft.Graph (version 2.x minimum)
Minimum Permission: AgentApp.Read.All (read-only access to agent registry)
Output: CSV export of detected agents with their owner, status, and original platform

1# Prerequisites: install Microsoft Graph module if missing
2# Install-Module Microsoft.Graph -Scope CurrentUser -Force
3 
4# Connection with required minimum permissions
5# AgentApp.Read.All is sufficient for reading the registry
6Connect-MgGraph -Scopes "AgentApp.Read.All"
7 
8# Simulation parameter: set to $true to test without export
9$DryRun = $false
10 
11# Path to CSV export file
12$ExportPath = "./Agent365-Inventory-$(Get-Date -Format 'yyyyMMdd-HHmm').csv"
13 
14# Retrieve agent list via Microsoft Graph
15# The /beta/agentApps endpoint returns the unified Agent 365 registry
16Write-Host "[INFO] Retrieving Agent 365 registry..." -ForegroundColor Cyan
17 
18try {
19    $agents = Invoke-MgGraphRequest -Method GET -Uri "https://graph.microsoft.com/beta/agentApps" `
20        -ErrorAction Stop
21} catch {
22    Write-Error "[ERROR] Unable to retrieve registry: $($_.Exception.Message)"
23    Write-Host "[INFO] Verify that AgentApp.Read.All is consented and that Agent 365 is enabled on your tenant."
24    exit 1
25}
26 
27$agentList = $agents.value
28 
29if (-not $agentList) {
30    Write-Warning "[WARNING] No agents detected in the registry. The tenant may be empty or synchronization is not configured."
31    exit 0
32}
33 
34Write-Host "[INFO] $($agentList.Count) agent(s) detected in the registry." -ForegroundColor Green
35 
36# Build structured report
37$report = foreach ($agent in $agentList) {
38 
39    # Retrieve extended details for each agent
40    $agentDetail = Invoke-MgGraphRequest -Method GET `
41        -Uri "https://graph.microsoft.com/beta/agentApps/$($agent.id)" `
42        -ErrorAction SilentlyContinue
43 
44    [PSCustomObject]@{
45        AgentId          = $agent.id
46        DisplayName      = $agent.displayName
47        Platform         = $agent.platform          # Microsoft, Bedrock, GoogleCloud, Salesforce...
48        Status           = $agent.status             # Approved, Pending, Blocked
49        OwnerId          = $agentDetail.ownerId
50        ManagedIdentity  = if ($agentDetail.managedIdentityId) { "Yes" } else { "No" }
51        CreationDate     = $agent.createdDateTime
52        LastActivity     = $agent.lastActivityDateTime
53        ConfiguredTools  = ($agentDetail.tools.displayName -join "; ")
54    }
55}
56 
57# Display summary in console
58$report | Format-Table DisplayName, Platform, Status, ManagedIdentity, OwnerId -AutoSize
59 
60# CSV export unless in simulation mode
61if (-not $DryRun) {
62    $report | Export-Csv -Path $ExportPath -NoTypeInformation -Encoding UTF8
63    Write-Host "[OK] Export generated: $ExportPath" -ForegroundColor Green
64} else {
65    Write-Host "[DRYRUN] Simulation mode active — no file written." -ForegroundColor Yellow
66}
67 
68# Clean disconnect
69Disconnect-MgGraph

Result Verification: the CSV should list each agent with its Graph identifier, original platform, and status. An agent with Pending status requires approval action in the Agent 365 console before being usable at scale.

Troubleshooting Common Errors

What You Do Right Now

Agent 365 solves a real and immediate problem: AI agents deploy faster than governance policies are built. The platform gives IT teams the levers to close this gap without blocking adoption.

Priority actions based on your context:

• If you already have Copilot Studio agents in production: enable Agent 365 and audit the registry to identify agents without a designated owner — that's your first risk surface.
• If your organization uses AWS Bedrock or Salesforce AgentForce: configure registry synchronization to get a consolidated cross-cloud view without custom tooling.
• If cost management is a priority: set spending limits and alerts before enabling Copilot Cowork or the Work IQ API — both are disabled by default, this is the right time to define caps.
• If Shadow AI is your primary concern: start with Intune blocks on a pilot group, verify productivity impact, then roll out progressively.

Starting documentation is available at aka.ms/agent365.