Key insight
Microsoft Agent 365 is a Microsoft 365 service that gives an organisation one central place to discover, manage, govern, and secure every AI agent — whether that agent was built with Microsoft tools or bought from someone else. It does this by extending the systems the organisation already trusts for its people: Microsoft Entra for identity, Defender for threat protection, Purview for data protection, and Intune for device management. It reached general availability for commercial customers on May 1, 2026.
In the last article we argued that AI agents are a new kind of actor and that scattered tools cannot govern them — what is needed is a single control plane. This article names the one Microsoft built for the job, and defines it carefully, because a clear definition here makes everything that follows easier. We will resist jargon, and where a Microsoft term is unavoidable, we will spell it out.
1 · The one-sentence definition, unpacked
Here is Microsoft’s own definition, lightly paraphrased and then taken apart: Microsoft Agent 365 is a Microsoft 365 service that provides a centralized control plane for AI agents, enabling an organisation to discover, manage, govern, and secure agents across its environment. Every word earns its place:
- A Microsoft 365 service. It is part of the Microsoft 365 family — the same world as Outlook, Teams, and SharePoint — not a separate, bolt-on product living somewhere else. It is managed from the tools administrators already use.
- Centralized. One place, not many. This is the direct answer to the fragmentation problem of scattered point tools.
- Discover, manage, govern, and secure. These four verbs are the job. Often they are compressed to three: observe (see every agent and what it does), govern (decide and enforce what each may reach), and secure (protect each with trusted identity and security systems).
- Across its environment. Not one team or one tool — the whole tenant, the organisation’s dedicated instance of the cloud.
2 · What “control plane” means, precisely
The term control plane is borrowed from networking and cloud engineering, where systems are split into two layers. The data plane is where the actual work happens — packets moving, tasks running, agents acting. The control plane is the layer that decides and directs: it sets the rules, hands out permissions, keeps the inventory, and watches what happens, while staying separate from the work itself.
Applied to agents, this separation is the key idea. The agents keep doing their jobs — reading, calling, sending — in the data plane. Agent 365 sits above them as the control plane: it does not do their work, it governs it. That is why one control plane can manage agents that are wildly different from each other internally, because it operates at the level of “what is this agent allowed to be and do,” not “how is this agent built.”
3 · What it works with: any agent, anywhere it came from
This is the point most people underestimate. Agent 365 is deliberately not limited to agents built with Microsoft’s own tools. Microsoft states it “works with agents built on Microsoft platforms and with agents built or acquired from third-party sources.” In practice, that spans at least four origins, all managed in one registry:
- Agents built in Microsoft Copilot Studio — the low-code tool where businesspeople and makers build agents.
- Agents built in Azure AI Foundry — the professional, code-first platform where developers build agents.
- Third-party and partner agents — agents bought from other vendors, including a set of pre-integrated ecosystem partners deployable directly from the Microsoft 365 admin center.
- Shadow agents — agents already running in the tenant that were never formally registered, which Agent 365 can discover and bring under management.
The unifying promise is: one control plane, regardless of origin. An organisation does not need a separate management system for each way an agent might arrive. Whether it was built in-house, bought, or crept in unnoticed, it lands in the same place to be observed, governed, and secured.
4 · The Microsoft services that power it
Agent 365 does not reinvent security from nothing. Its real strength is that it extends the systems an organisation already runs for its people so those same protections cover agents. Microsoft is explicit that Agent 365’s capabilities are “powered by Microsoft’s identity, security, data protection and compliance, and device management services.” Four services do the heavy lifting:
- Microsoft Entra — identity. It answers “who or what is this, and what may it do?” For agents this is Microsoft Entra Agent ID, giving each agent a first-class identity of its own.
- Microsoft Defender — threat protection. It watches for dangerous or malicious behaviour and can block it in real time as an agent runs.
- Microsoft Purview — data protection and compliance. It guards against data leakage with information protection and data-loss-prevention (DLP, controls that stop sensitive data from leaving where it should).
- Microsoft Intune — device management. It governs the devices and machines involved in an agent’s work.
On top of those four, two more pieces complete the picture: Microsoft 365 apps and Work IQ give agents a safe, governed way to actually get work done across Microsoft 365 data, and the Microsoft 365 admin center is the console where administrators manage everything. We will return to each of these in later levels; for now, the shape to hold onto is: Agent 365 is a governance layer on top of security foundations an organisation already has.
5 · Why identity is the foundation, not an add-on
Of those four services, one is first among equals. Microsoft is emphatic that for Agent 365, “identity isn’t an add-on… it’s the foundation.” The reason is simple: once an agent has a clear identity of its own — a real account, not a borrowed human one — every other capability has something solid to attach to. You can only say what an agent may access, hold an owner accountable, and trace what it did if the agent is a distinct, named thing in the first place.
Agent 365 builds directly on Microsoft Entra Agent ID to give each agent that identity, so it can be “consistently authenticated, authorized, and monitored across the environment.” This is important enough to deserve close study on its own. For now, remember the one-line version: the agent’s identity is the control point for everything the agent does.
6 · Availability: when, how it is licensed, and prerequisites
Concrete facts help ground an abstract product. As of the current documentation:
- General availability. Microsoft Agent 365 became generally available for the Commercial segment on May 1, 2026, licensed on a per-user basis.
- How it is sold. It is available as a standalone subscription for use with eligible Microsoft 365 subscriptions, and it is also included with Microsoft 365 E7 (one of the enterprise plans).
- Prerequisites. It “works best when using Microsoft E5 as a pre-requisite,” and at least one user in the tenant must hold a qualifying Agent 365 license.
- Ecosystem at launch. A set of pre-integrated partner agents can be deployed directly from the Microsoft 365 admin center from day one.
The licensing tiers — and which capabilities require E7 or Agent 365 rather than E5 — are covered on their own elsewhere. The takeaway here is simply that Agent 365 is a real, generally available, per-user Microsoft 365 service, not a preview or a concept.
“Agent 365” is the control plane. It is often mentioned alongside Copilot Studio and Azure AI Foundry (where agents are built) and Microsoft 365 Copilot (where many agents run). Keep these straight: Agent 365 does not build or run agents itself — it governs the ones built and run elsewhere, wherever they come from.
7 · Glossary — every short-form term, spelled out
- Microsoft Agent 365
- A Microsoft 365 service that provides a centralized control plane to discover, manage, govern, and secure AI agents across an organisation, regardless of where each agent was built.
- Control plane
- The layer of a system that decides and directs — sets rules, grants permissions, keeps inventory, and monitors — kept separate from the layer doing the actual work.
- Data plane
- The layer where the actual work happens; for agents, where they read, call tools, and act. The control plane governs it without doing it.
- Observe, govern, secure
- The three verbs at the heart of Agent 365: see every agent, decide and enforce what each may reach, and protect each with trusted identity and security systems.
- Microsoft Entra
- Microsoft’s identity system, which answers who or what something is and what it may do; for agents this is Microsoft Entra Agent ID.
- Microsoft Entra Agent ID
- The capability that gives each agent a first-class identity of its own, so it can be authenticated, authorized, and monitored like any other actor.
- Microsoft Defender
- Microsoft’s threat-protection system, which detects and can block dangerous or malicious behaviour, including at the moment an agent acts.
- Microsoft Purview
- Microsoft’s data-protection and compliance system, providing information protection and data-loss prevention.
- DLP (data-loss prevention)
- Controls that stop sensitive information from leaving where it is supposed to stay.
- Microsoft Intune
- Microsoft’s device-management system, governing the devices and machines involved in work.
- Work IQ
- A capability that gives agents a governed, simplified way to reach and act on Microsoft 365 data.
- Microsoft 365 admin center
- The administrative console where Microsoft 365 — and Agent 365 — is managed.
- Tenant
- An organisation’s own dedicated instance of a cloud service, holding its users, data, applications, and agents.
- General availability (GA)
- The point at which a product is fully released for production use by all eligible customers, rather than in limited preview.
- Microsoft 365 E5 / E7
- Enterprise Microsoft 365 plans; E5 is a recommended prerequisite for Agent 365, and Agent 365 is included with E7.
Microsoft Agent 365 is a Microsoft 365 service: a single control plane to discover, manage, govern, and secure every AI agent.
“Control plane” means the layer that decides and directs, separate from the agents doing the work — which is why one plane can govern agents built very differently.
It works with agents from any origin: Copilot Studio, Azure AI Foundry, third-party partners, and even discovered shadow agents.
It extends four services an organisation already trusts — Entra (identity), Defender (threat protection), Purview (data protection), Intune (devices) — plus Microsoft 365 apps, Work IQ, and the admin center.
Identity is the foundation: Microsoft Entra Agent ID gives each agent a first-class identity that everything else attaches to.
It became generally available for commercial customers on May 1, 2026, per user — standalone or included with Microsoft 365 E7, and works best with E5.
References
- Microsoft Learn, Overview of Microsoft Agent 365 — definition, availability, and prerequisites. learn.microsoft.com
- Microsoft 365 service descriptions, Microsoft Agent 365 — what it is, plans, and feature availability. learn.microsoft.com
- Microsoft Learn, How does Microsoft Entra support Agent 365? — identity as the foundation. learn.microsoft.com
- Microsoft Learn, Why does an enterprise need Agent 365? — the services underneath. learn.microsoft.com