Microsoft bills AI security on three separate meters: per user (Microsoft 365), per Azure resource (the Defender plans), and per gigabyte ingested (Sentinel). The meters don't overlap. Every control on this page is paid for on exactly one of them, and the grid below shows which.
| Axis | Billed | What lives here |
|---|---|---|
| Microsoft 365 | Per user | Copilot audit, Purview, Defender XDR, Agent 365 / E7 — the agent control plane |
| Azure — Defender plans | Per resource + per tokens scanned | Foundry and Azure OpenAI workload security (surface 2) |
| Sentinel | Ingestion, retention, and the data lake tier | SIEM correlation — and the lake tier that carries the deepest agent telemetry. Agent 365 writes into the lake; it does not include it |
Every capability below sits on one of the five asset classes and is tagged see, govern, protect or detect, with the licence that gates it. Toggle what you actually hold — a selection lights everything it includes (E7 lights Agent 365, Copilot, the Entra Suite and E5; E5 lights E3, Defender for Endpoint P2, Entra ID P2 and the Purview suite). Greyed capabilities name the gate you're missing.
Chips in lighter blue are included by something you selected. Prices are deliberately absent — never quote one from a web page, including this one.
Since 1 June 2026, buying Agent 365 standalone requires a qualifying base plan: Microsoft 365 E5 (enterprise), F5-level Defender and Purview suites (frontline workers), or Microsoft 365 Business Premium (SMB). Microsoft 365 E7 includes Agent 365 outright, so nothing changes there. That is a commerce rule; the technical dependency is separate and narrower — Microsoft documents that an Agent 365 subscription needs a product carrying the AAD_PREMIUM service plan, such as Entra ID P1 or Microsoft 365 E3. Two different gates with similar names, so check which one a conversation is actually about. This is why the Agent 365 chip lights no base plan on its own: pick the one you hold.
* Purview PAYG is Purview's pay-as-you-go billing model: consumption-metered against an Azure subscription instead of per-user seats. It exists because agents and custom AI apps hold no seat licence — their data protection is billed by use. It's how the Foundry "Powered by Microsoft Purview" toggle is paid for without Agent 365, which is why the two Foundry-Purview capabilities above light from either chip.
AgentsInfo — local agents populate on Defender for Endpoint P2 (included in E5) with no Agent 365 licence; cloud agents need Agent 365. CloudAppEvents — Copilot interaction verdict rows (Jailbreak, XPIA) arrive on E5; the Agent 365 runtime rows (InvokeAgent, InferenceCall, ExecuteToolBy*) do not exist until Agent 365 instruments an agent. When a screen shows nothing, check the licence gate before declaring a data gap — the Agent Telemetry Map carries the gate on every table for exactly this reason.
A lit capability means the licence entitles you to it — it says nothing about whether it's deployed, configured, or covering the agents you think it covers. "Enabled" and "covered" are different claims. Entitlement boundaries follow the Agent 365 service description and Microsoft Learn as of early September 2026; the split moves, so re-verify before purchasing decisions. And never quote a price from a web page — verify against the current Microsoft price list.