The enterprise control plane for AI agents. Agent 365 doesn't build or host agents — it wraps agents you've already built in enterprise-grade identity, governance, observability, and security controls.
Agent 365 is not an agent builder or hosting platform. It is a management and security layer that sits above whatever platform your agents run on — Copilot Studio, Microsoft Foundry, LangChain, OpenAI Agents SDK, or anything else. Once an agent is onboarded to Agent 365, it gains enterprise-grade controls it didn't have before.
RegistrySource == "A365"). Near-real-time threat detection, incident alerts, and investigation via Defender portal → Settings → Security for AI.Agent 365 works with agents built on any platform and hosted anywhere. This is not a Microsoft-only capability.
You add the Agent 365 SDK to your agent code. Once instrumented, the agent registers with Agent 365 regardless of where it runs — Azure, AWS, GCP, or your own infrastructure. The SDK handles the Entra identity registration, OpenTelemetry event emission, and ATG integration automatically. You don't rewrite your agent; you add a governance layer around it.
⚠️ Per-user, not per-agent. Governance scope doesn't automatically scale with agent count. An organisation with 50 licensed users but 500 deployed agents has a coverage gap. Plan accordingly.
💡 When E7 makes sense: If you're buying M365 Copilot + E5 + Entra Suite anyway, E7 likely costs less than the sum of parts. Run the numbers — the break-even depends on your existing licence baseline.
Agent 365 is GA on May 1, 2026. Before that date — and for some advanced preview features — access is via the Microsoft Frontier programme.
Coverage depth varies depending on how the agent was built and whether the Agent 365 SDK is integrated.
| Agent type | Discovery (AIAgentsInfo) | Threat detection | Real-time protection (ATG) | Requires |
|---|---|---|---|---|
| Copilot Studio agents | ✓ AutomaticRegistrySource == "PowerPlatform" |
✓ Extended alert set Audit logs sent by default |
✓ Available | Power Platform connector enabled in Defender |
| Agent 365 SDK agents | ✓RegistrySource == "A365" |
✓ Near-real-time Requires M365 audit log routing |
✓ ATG | Agent 365 licence + SDK integration |
| Foundry / Bedrock / Vertex AI | ✓ UI inventory | ⚠ Limited — no SDK | ❌ Without SDK | Agent 365 SDK required for detection + ATG |
| Classic Copilot Studio agents | ✓ via PowerPlatform connector | ⚠ Basic only | ✓ Existing Defender RT | No Agent 365 needed — but no Entra Agent ID |
Use RegistrySource == "A365" to target Agent 365-registered agents specifically. See Playbook 01 Step 8 for the full query set.
// All A365 registered agents AIAgentsInfo | where RegistrySource == "A365" | summarize arg_max(Timestamp, *) by AIAgentId | where AgentStatus != "Deleted" | project AIAgentId, AIAgentName, AgentStatus, IsBlocked, AIModel, Instructions // Agents with no instructions — prompt injection risk AIAgentsInfo | where RegistrySource == "A365" | summarize arg_max(Timestamp, *) by AIAgentId | where isempty(Instructions) or Instructions == "N/A" | project AIAgentId, AIAgentName, Instructions // Agents with MCP tools — expanded attack surface AIAgentsInfo | where RegistrySource == "A365" | summarize arg_max(Timestamp, *) by AIAgentId | where isnotempty(AgentActionTriggers) | extend Triggers = parse_json(AgentActionTriggers) | mv-expand Trigger = Triggers | where Trigger.type == "RemoteMCPServer" | project AIAgentId, AIAgentName, Trigger.type