If your clients use Microsoft 365, you’ve probably been asked about Microsoft Agent 365. Microsoft calls it the control plane for agents. It became generally available on 1 May 2026, and it’s a real step forward: agents get their own identities, a registry and usage reports.
So the natural question is: if we have Agent 365, are our agents secure? The honest answer is that Agent 365 covers a lot of the Microsoft side well. But “secure” depends on four things, and Agent 365 is one tool across part of them. This post explains what you get out of the box, what the licence adds, and what’s still on you.
What Microsoft Agent 365 is
Agent 365 brings Microsoft’s agent controls together in one place. As Microsoft describes it, it includes:
- An agent registry that lists agents built on Microsoft platforms, partner agents, and agents registered through its APIs. Microsoft says the registry now also surfaces unmanaged agents found on devices by Defender, Entra and Intune working together.
- Agent identities through Microsoft Entra Agent ID, so each agent has its own identity in Entra rather than borrowing a person’s.
- Access controls through identity governance, to limit each agent to the resources it needs.
- Observability: reports on agent usage and adoption, an agent map, and activity details.
Agent identities are now arriving automatically, which matters as Copilot agents multiply. Microsoft’s Copilot Studio documentation says that since May 2026, every new Copilot Studio agent gets a Microsoft Entra Agent ID, and the person who created it is recorded as its sponsor. Microsoft says agents built in Microsoft Foundry get an Entra Agent ID as part of onboarding too.
What’s free and what needs a licence
According to Microsoft’s licensing FAQ and GA announcement:
- Included for Microsoft Cloud customers at no extra cost: foundational capabilities, including agent identity, inventory visibility, basic usage insights and core admin governance actions.
- With an Agent 365 licence: premium capabilities such as advanced usage analytics and agent governance policies. The licence is listed at $15 per user per month standalone, or included in Microsoft 365 E7. It’s licensed per person, not per agent, and it isn’t included in E3 or E5.
Microsoft also notes that some capabilities vary by agent type, platform or level of integration. Check the current licensing pages before you plan around a specific feature.
Where Agent 365 helps most
Use it. In particular:
- Turn on agent identities and keep them on. Agents with their own identities are far easier to govern than agents on shared accounts.
- Check sponsors. The creator of a Copilot Studio agent is recorded as its sponsor. Make sure that’s someone who should answer for it, and fix it when they leave.
- Review the registry regularly, especially for unmanaged agents found on devices.
What’s still on you
Agent 365 is built for one organisation’s Microsoft estate. For most small and mid-sized businesses, and for every MSP, four gaps remain.
1. Agents outside Microsoft
Few businesses run only Microsoft. Marketing works in Google Workspace. Sales has a CRM with its own agents. Someone connected an AI note-taker. Microsoft says registry sync with other clouds was in preview at launch; even with it, many agents reach your data through app consents rather than a platform registry. You still need one list across Microsoft 365, Google Workspace and the apps connected to both.
2. Grants, not just identities
An identity tells you who an agent is. A grant tells you what it can do. Many of the riskiest agents are third-party apps holding an OAuth grant to someone’s mailbox or files, approved in two clicks. Those need reading one by one: what each grant allows, whether the job needs it, and whether anyone still uses it.
3. Connections between agents and apps
Microsoft’s agent map is a useful start. But the risk that’s hardest to see is the chain: one connected app using its access to reach the next, until data ends up somewhere nobody approved. In 2025, Google’s Threat Intelligence Group reported attackers using stolen tokens from one sales integration to export data from many companies’ Salesforce instances. The core platforms weren’t broken. The access came through a connected app.
4. Every client in one view, and someone acting on it
Agent 365 is licensed and run per organisation. An MSP looking after 40 clients has 40 places to look, and many of those clients won’t have the licence for the premium features. And a report doesn’t revoke anything: someone has to notice the agent going off script at 2 am and act.
A worked example: Agent 365 turned on, gap still open
This is an illustrative example, not a real client. A 120-person accounting firm turns on Agent 365. The registry lists 14 agents built in Copilot Studio, each with an Entra Agent ID and a sponsor. The IT lead feels in control.
Three things the registry doesn’t make obvious:
- A tax-prep AI app a partner approved last year holds an OAuth grant to her whole mailbox, including client tax records. It isn’t a Copilot Studio agent, so it isn’t in the list the IT lead is reviewing.
- One Copilot Studio agent’s sponsor is a contractor whose engagement ended in August.
- A scheduling app connected by the front desk uses its calendar access to pass meeting details to a second app nobody approved.
None of these is Agent 365 failing. They’re the parts of agent security that sit across tools: grants, ownership over time, and connections.
Checklist: is Agent 365 enough for this client?
- Agent identities are on, and every agent has its own identity.
- Every agent’s sponsor still works for the business.
- You know which Agent 365 features this client’s licences include.
- Agents and AI apps outside Microsoft are on the same list.
- Every OAuth grant to mail, files or calendars has been read and scored.
- You can see when one connected app starts reaching into another.
- Someone is alerted, and can act, when an agent goes off script out of hours.
- For MSPs: you can see every client’s agents in one place.
How Centeye fits alongside Agent 365
Centeye Synthwatch works alongside Microsoft’s controls, not instead of them. Today it lists the AI agents and AI apps holding access to Microsoft 365 and Google Workspace, whoever built them, gives each one an owner and a 90-day re-approval, reads what each grant allows with a risk score, and traces app-to-app chains. It can revoke a grant, lock a service principal or reset an API token, at the setting you choose, across every client tenant.
Synthagent, the guard agent inside Synthwatch, watches each agent’s four control layers (identity, authentication, grants and connections) all the time, and links what it sees to the sponsor’s account and mailbox.
Reading the Agent 365 registry and Microsoft Entra Agent ID directly is coming. Synthwatch and Synthagent are in early access.
Frequently asked questions
What is Microsoft Agent 365?
Microsoft’s control plane for AI agents: a registry, agent identities through Microsoft Entra Agent ID, access controls and usage reports. It became generally available on 1 May 2026.
How much does Agent 365 cost?
Microsoft lists it at $15 per user per month standalone, or included in Microsoft 365 E7. Foundational features such as agent identity and inventory are included for Microsoft Cloud customers at no extra cost. Check Microsoft’s current pricing.
Does Agent 365 cover Google Workspace agents?
It’s built around Microsoft’s platforms. Microsoft announced registry sync with other clouds in preview at launch. Agents working in Google Workspace and third-party SaaS apps still need covering.
Do small businesses need Agent 365?
Every Microsoft Cloud customer gets the foundational features. Whether the paid licence is worth it depends on how many agents the business runs. Either way, grants, connections and agents outside Microsoft still need watching.
Can an MSP manage Agent 365 for all its clients at once?
Agent 365 is licensed and run per organisation, so plan for each client separately, and check Microsoft’s partner tools for what they show across tenants. Read Copilot agents for MSPs for a multi-tenant model.
New to the terms? See AI agent, non-human identity and OAuth grant in our glossary. Want to see every agent across your clients? Ask for early access.
Agent 365 features, availability (1 May 2026) and pricing as described in Microsoft’s GA announcement and licensing FAQ, October 2026. Copilot Studio and Foundry agent identities as described on Microsoft Learn and the Microsoft Entra blog. Salesforce integration incident as reported by Google Threat Intelligence Group, August 2025. The worked example is illustrative. Synthwatch and Synthagent are in early access. Microsoft, Microsoft 365, Agent 365, Copilot Studio, Entra and Foundry are trademarks of the Microsoft group of companies.