Ask a business owner how many AI agents work for their company today and most will say “none” or “one or two”. Ask again in a year and the honest answer will be “I’m not sure”. That gap is AI agent sprawl, and it’s coming faster than most IT plans assume.
Microsoft, Google and almost every SaaS vendor are now making it easy for ordinary staff to build and switch on agents: software that signs in, reads data and takes actions without a person clicking each step. This post looks at where those agents will come from, what goes wrong when nobody owns them, and what to put in place before the wave arrives.
How fast is this happening?
The forecasts all point the same way:
- Gartner predicts that 40% of enterprise applications will feature task-specific AI agents by the end of 2026, up from less than 5% in 2025.
- Gartner also expects 33% of enterprise software applications to include agentic AI by 2028, and at least 15% of day-to-day work decisions to be made autonomously by then.
- In Microsoft’s 2025 Work Trend Index, 81% of leaders said they expect agents to be moderately or extensively integrated into their company’s AI strategy within 12–18 months.
- An IDC Info Snapshot sponsored by Microsoft predicts more than 1.3 billion AI agents by 2028.
The same research carries a warning. Gartner predicts that over 40% of agentic AI projects will be cancelled by the end of 2027, with inadequate risk controls named as one of the reasons. Agents that nobody can see or govern are a big part of that risk.
Where your agents will come from
Agents won’t arrive through one front door. In a typical Microsoft 365 or Google Workspace business, they’ll come from at least five places.
1. Microsoft 365 Copilot and Copilot Studio
Copilot Studio lets staff build agents with little or no code: an HR agent that answers policy questions, a sales agent that drafts proposals from the CRM, a finance agent that chases invoices. Each one is connected to SharePoint sites, mailboxes or business systems, and each one can reach whatever its connections allow. Copilot itself works the same way: it can surface anything the person using it can open, which is why Copilot security starts with oversharing.
2. Microsoft Foundry
Microsoft Foundry (formerly Azure AI Foundry) is where developers build custom agents and AI applications. These are usually more powerful than Copilot Studio agents: they can call APIs, run multi-step workflows and work with production data. They also tend to hold keys and service accounts that outlive the project that created them.
3. Google Gemini Enterprise
Gemini Enterprise brings agents to Google Workspace, and Google has added tools for staff to build agents that run on a schedule or when something happens. Google reports customers rolling Gemini Enterprise out to every employee, with one firm creating more than a hundred agents in its first month.
4. Agents inside the SaaS apps you already use
Your CRM, help desk, accounting and HR tools are all adding agents. Many connect to Microsoft 365 or Google Workspace through an app consent (OAuth grant), which gives them lasting access to mail, files or calendars.
5. Agents people connect themselves
Meeting note-takers, AI assistants and browser agents get connected by individual staff in a couple of clicks. They are the least visible of all, and often the ones with the broadest access.
Why agents are different from apps
An app waits for a person. An agent acts on its own. That changes the security picture in four ways:
- Agents hold their own access. Each one is a non-human identity, with keys to data that never expire unless someone removes them.
- Agents act at machine speed. An agent can read a thousand files in the time a person reads one.
- Agents chain together. One agent calls another app, which calls another, and access spreads further than anyone planned.
- Agents outlive their makers. When the person who built an agent leaves, the agent usually keeps running.
What agent sprawl looks like at a 60-person firm
Here’s an illustrative example of how it happens over twelve months.
Month 1. IT switches on Microsoft 365 Copilot for everyone. Two staff build agents in Copilot Studio to answer HR and expense questions.
Month 4. Sales connects an AI agent from their CRM vendor to everyone’s mailbox and calendar. Finance builds an invoice agent with a contractor, using a key with write access to the accounting system.
Month 7. A developer builds a customer-support agent in Microsoft Foundry for a pilot. The pilot ends; the agent’s key and service account don’t.
Month 9. Several staff connect AI note-takers and browser agents. The marketing team, which works in Google Workspace, starts building Gemini agents.
Month 12. The firm has more than 30 agents. Nobody has a list. The contractor who built the invoice agent has left. The support agent’s key is still live. Two agents can read every file in the finance share, because the share was open to all staff before any of them existed.
None of these steps was reckless. Together they leave the business with dozens of unseen identities holding real access.
Five questions every agent should answer
Whatever platform an agent was built on, you should be able to answer five questions about it:
- Who is it? Does it have its own identity, or does it run on a person’s account or a shared admin login?
- Who owns it? Is there a named person responsible for it, who still works here?
- What can it reach? Which mailboxes, sites, files and systems can it read or change?
- Is it allowed? Was it approved, and is it still needed?
- Is it behaving? Is it doing roughly what it did last week, or has something changed?
If you can’t answer them for every agent, you don’t control your agents. You’re trusting them.
What the platforms give you, and the gap
Microsoft and Google are both adding agent controls. Microsoft describes Agent 365 as a control plane for agents, built on Microsoft Entra Agent ID, and Google’s Gemini Enterprise includes an admin view of agents. These are useful, and you should use them.
But most businesses, and every MSP, face three gaps they don’t close on their own:
- One platform at a time. Few businesses run only one. Agents in Microsoft 365, Google Workspace and connected SaaS apps need to sit in one list.
- One tenant at a time. An MSP looking after 40 clients needs to see every client’s agents in one place, with rules set per client.
- Licensing. Some agent controls depend on extra licences, which many small and mid-sized businesses don’t have. Check each vendor’s current requirements before you plan around them.
Checklist: are you ready for agent sprawl?
- You have one list of every AI agent and AI app connected to Microsoft 365 and Google Workspace.
- Every agent has a named owner who still works for the business.
- No agent runs on a person’s account or a shared admin login.
- Each agent’s access matches its job, and nothing more.
- Files shared with “everyone” have been reviewed before agents and Copilot can surface them.
- Keys and service accounts for finished projects are retired.
- Every agent comes back for review on a schedule, such as every 90 days.
- Someone is alerted when an agent behaves very differently from normal.
- You can stop any agent in one step, and know who to tell.
- There’s a simple rule for staff on how to request a new agent.
How Centeye helps
Centeye Synthwatch gives every AI agent an identity, an owner and an off switch. Today it lists the AI agents and AI apps holding access to Microsoft 365 and Google Workspace, whoever built them, and shows what each one can reach. It gives each agent a named owner and a 90-day re-approval, shows when Copilot opens sensitive files, and finds oversharing that agents could surface. When an agent needs stopping, it can revoke its access, lock its service account or reset its key, at the setting you choose. Synthwatch is in early access.
On the way: reading agents straight from the Copilot Studio and Gemini Enterprise registries, Microsoft Entra Agent ID and Google’s agent identities, and agents and MCP servers running on laptops. Agents built in Microsoft Foundry are covered when they reach Microsoft 365 through an app grant; reading Foundry directly isn’t built yet.
For supervision, the Praxis guard agent, also in early access, watches agents on your behalf, can ask an agent’s owner why it’s doing something, and stops it within your rules. For MSPs, all of it works across every client tenant from one console.
Frequently asked questions
What is AI agent sprawl?
It’s what happens when AI agents multiply across a business faster than anyone tracks them: built in different tools by different people, each holding its own access, with no single list and often no owner.
How is agent sprawl different from shadow AI?
Shadow AI is people using AI tools IT doesn’t know about. Agent sprawl is about AI that acts on its own with real access, whether IT approved it or not. A fully approved agent can still be part of the sprawl if nobody owns or reviews it.
Do small businesses really need to worry about this?
Yes. Small businesses get the same Copilot, Gemini and SaaS agents as large ones, usually with fewer people watching. The steps are the same; there are just fewer agents to list.
Should we stop people building agents?
Usually not. Agents can save real time. It’s better to make the safe path easy: a simple request process, an owner for every agent, access matched to the job, and regular reviews.
What should we do first?
Make the list. You can’t govern agents you can’t see. Then give each one an owner, and fix the widest file sharing before more agents arrive. Read how to secure AI agents in Microsoft 365 and Google Workspace for the full plan.
New to the terms? See AI agent and non-human identity in our glossary. Want to see the agents already working in your tenant? Ask for early access.
Forecasts cited from Gartner press releases (25 June 2025 and 26 August 2025) and Gartner’s agentic AI research, the Microsoft 2025 Work Trend Index, and an IDC Info Snapshot sponsored by Microsoft as cited by Microsoft. Gemini Enterprise customer figures as reported by Google. Microsoft Agent 365 and Entra Agent ID as described by Microsoft. The worked example is illustrative. Synthwatch and agent protection in Praxis are in early access.