Agent Registry Convergence: Discovery Meets Identity

It can be confusing that two different Microsoft systems both seem to “do the registry.” The confusion clears the moment you see that they are answering two different questions — who is here? and how do we govern them? — and that the whole design depends on them handing off cleanly to each other. That hand-off has a name: convergence. This article is about why the split exists and how the join works.

1 · Two jobs, deliberately kept separate

Good systems design often splits a big responsibility into two focused parts, each doing one thing well — a principle engineers call separation of concerns. Managing agents has two genuinely different demands. One is breadth: finding every agent, everywhere, so nothing is missed. The other is depth: giving each found agent a proper identity and the exact controls it needs. Trying to build one component that does both equally well tends to do neither well. So Microsoft splits them: Microsoft Agent 365 owns breadth, and Microsoft Entra Agent ID owns depth. Understanding which does which is the key to the whole topic.

2 · Agent 365: discovery and inventory (breadth)

Microsoft Agent 365’s job in this partnership is to be the wide net. Microsoft describes it as building “the unified registry for agent visibility,” and frames its focus as “discovering and inventorying all agents.” Two words carry the meaning. Discover: find agents wherever they are, including ones nobody registered on purpose and ones running on other platforms. Inventory: keep a complete running list of everything found.

Notice this is exactly the visibility promise from the pillar of the same name: see everything. Agent 365 is optimised for not missing anything. It is the team at every entrance, spotting each agent that appears — but spotting is not the same as controlling, which is the second team’s job.

3 · Entra Agent ID: management at scale (depth)

Microsoft Entra Agent ID’s job is to govern deeply. Microsoft describes it as enabling customers “to manage AI agents at scale by providing a dedicated identity and access management foundation.” Where Agent 365 asks “is this agent here?”, Entra Agent ID asks “what is this agent allowed to be and do, and who owns it?” It supplies the first-class identity, the permissions, the ownership, the lifecycle, and the protections — the depth that turns a name on a list into a properly governed actor.

This division is why the two are complementary rather than redundant. In Microsoft’s words, the separation “lets Agent 365 focus on discovering and inventorying all agents, while Entra Agent ID enables customers to manage agents at scale with the right identities, permissions, and protections.” Neither is trying to be the other; each is the best at its half.

4 · Convergence: the hand-off from found to governed

Convergence means the two systems come together into one continuous flow. Concretely, Microsoft states that “agents discovered through Agent 365 can be assigned a first-class identity in Entra Agent ID.” That single sentence is the whole mechanism: discovery feeds management. An agent noticed by the wide net does not merely sit on a list; it is handed to the identity system and given a real, governed identity — after which “consistent authentication, authorization, lifecycle management, and policy enforcement” apply to it as they grow in number and capability.

The everyday version is the airport hand-off from the opening: the spotters find someone, and the credential desk immediately issues them a proper, governed pass. Discovery and identity are not two competing registries; they are two ends of one pipeline, and convergence is the join in the middle where “seen” becomes “managed.”

5 · Why convergence closes the shadow-agent gap

Now the payoff. Consider what each system would leave open on its own. Discovery without management would find agents you still could not control — you would know a stranger was in the building but have no way to issue or revoke their access. Management without discovery would govern beautifully, but only the agents that arrived through the front door, leaving every quietly-created or third-party agent invisible. Either alone leaves precisely the gap a shadow agent — an unregistered, unapproved agent — hides in.

Convergence removes the gap by making found and governed the same event. Because a discovered agent is handed straight to the identity system for a first-class identity, there is no lasting state of “seen but ungoverned” for a shadow agent to live in. That is the deeper reason the two systems are designed to hand off rather than to overlap: the hand-off itself is the control.

6 · Glossary — every short-form term, spelled out

Separation of concerns

A design principle: split a big responsibility into focused parts, each doing one thing well.

Discovery

Finding agents wherever they are, including unregistered and third-party ones.

Inventory

A complete running list of everything discovered.

Microsoft Agent 365

The control plane that discovers and inventories every agent — the breadth half of the partnership.

Microsoft Entra Agent ID

The identity system that manages agents at scale with first-class identities, permissions, ownership, and protection — the depth half.

First-class identity

A full, governed identity of an agent’s own — not a borrowed account — that permissions, monitoring, and lifecycle attach to.

Convergence

The hand-off in which an agent discovered by Agent 365 is assigned a first-class identity in Entra Agent ID, so found and governed become one step.

Shadow agent

An unregistered, unapproved agent — the exact gap convergence removes.