AI agents are rapidly moving from experimentation into production.
Organizations are no longer dealing with only Microsoft 365 Copilot or a handful of purpose-built assistants. They are beginning to deploy agents created with Microsoft Copilot Studio, Microsoft Foundry, OpenAI frameworks, LangChain, CrewAI, SaaS platforms, cloud providers, and even local desktop or command-line tools.
That creates a new enterprise security problem:
How do you know which agents exist, who owns them, what identities they use, what data they can access, what actions they can perform, and whether they are operating safely?
This is the problem Microsoft Agent 365 is designed to address.
Microsoft introduced Agent 365 in November 2025 as a control plane for AI agents, with the goal of helping organizations manage agents using many of the same enterprise systems already used to manage people, applications, identities, devices, data, and security.
On May 1, 2026, Microsoft Agent 365 became generally available for commercial customers.
From Copilot to the Agentic Enterprise
The evolution is important.
The first stage of enterprise generative AI was largely focused on assistants. A user asked a question, the AI generated an answer, and the human remained firmly in control of the next action.
Agents change that model.
An agent can potentially:
- access enterprise data,
- call APIs and tools,
- interact with business systems,
- execute multi-step workflows,
- communicate with other agents,
- operate with its own credentials or delegated permissions,
- and continue working with much less human involvement.
That means the security question is no longer only:
“Can the AI see sensitive information?”
It becomes:
“What can this agent see, decide, execute, share, and change?”
This is why traditional AI governance alone is not enough.
What Is Microsoft Agent 365?
Microsoft describes Agent 365 as the control plane to observe, govern, and secure AI agents at scale.
The key idea is centralization.
An enterprise may have agents coming from multiple sources, but security and IT teams should not have to manage each ecosystem independently.
Agent 365 aims to provide a common management and governance layer across those environments.
Microsoft currently supports several integration models.
1. Native Microsoft and Partner Integrations
Agents created on supported Microsoft platforms can integrate directly with Agent 365.
Examples include:
- Microsoft Copilot Studio
- Microsoft Foundry
- Agent Builder
- Copilot Cowork
- Researcher
- Microsoft agents
- GitHub Copilot
Some third-party solutions can also integrate directly through supported partner integrations.
These scenarios generally do not require custom SDK integration.
2. Agent 365 SDK Integration
Organizations increasingly build agents using their own development frameworks.
Microsoft documents support for frameworks including:
- Microsoft 365 Agents SDK
- Microsoft Agent Framework
- OpenAI Agents SDK
- LangChain
- CrewAI
- LlamaIndex
In these scenarios, developers can integrate Agent 365 capabilities into their agent implementation.
The important point is that Agent 365 is not the framework used to build the agent.
You build the agent using the framework appropriate for the application, and Agent 365 provides the enterprise control plane around it.
3. Registry Synchronization
Microsoft is also enabling registry synchronization for external agent platforms.
Examples documented by Microsoft include Google Vertex AI and Amazon Bedrock.
This allows organizations to bring externally hosted agents into a common inventory and governance model without rebuilding those agents on Microsoft infrastructure.
4. Shadow Agents
This may ultimately become one of the most important capabilities.
Just as organizations discovered shadow IT and shadow SaaS, they are now facing Shadow AI and shadow agents.
Employees and developers can run agents through:
- local applications,
- command-line tools,
- desktop AI clients,
- IDE extensions,
- custom scripts,
- local models,
- SaaS agent platforms,
- and autonomous development tools.
Many of these agents may never have gone through a formal security review.
The enterprise challenge therefore becomes not only onboarding known agents, but also discovering unknown ones.
Microsoft has positioned Defender and Intune capabilities as part of the broader Agent 365 strategy for discovering local and cloud-based agent activity and bringing those agents under organizational governance.
Agent 365 Does Not Replace Entra, Defender, Purview, or Intune
This distinction is critical.
Agent 365 is the control plane, but the underlying Microsoft security platforms continue to provide their specialized controls.
Think of Agent 365 as the place where the organization establishes visibility and governance over the agent estate.
The existing Microsoft security stack then provides the enforcement and protection layers.
Microsoft Entra
Entra provides the identity foundation.
An enterprise needs to know:
- Which identity represents the agent?
- Who owns it?
- What permissions does it have?
- Which resources can it access?
- Is it over-privileged?
- Should access be conditional?
- Can its identity be disabled or revoked?
Agents are effectively becoming another identity type that security teams must govern alongside users, applications, service principals, and workloads.
Microsoft Defender
Defender adds the threat-protection dimension.
Agents can potentially be abused, compromised, manipulated, or induced to execute unsafe actions.
Defender therefore becomes important for:
- agent discovery,
- threat detection,
- security posture,
- runtime monitoring,
- investigation,
- and response.
An agent may be legitimate and properly registered but still behave dangerously if its credentials are compromised or its workflow is manipulated.
Microsoft Purview
For data-security teams, this is where the Agent 365 story becomes particularly interesting.
Purview addresses the question:
What information can the agent access, process, expose, or misuse?
Purview can contribute controls around:
- sensitivity labels,
- Data Loss Prevention,
- DSPM,
- AI data security,
- oversharing,
- audit,
- information protection,
- and broader compliance requirements.
Agent governance without data governance would leave a major security gap.
An organization could know exactly which agent exists and who owns it while still allowing that agent to access thousands of overshared confidential documents.
That is why Purview remains central to the Agent 365 architecture.
Microsoft Intune
Intune provides another important dimension where agents operate on or interact with endpoints.
As agentic experiences increasingly reach desktops and managed devices, device compliance and endpoint governance become part of the trust model.
The Security Architecture Is Becoming Identity + Data + Runtime
One way to understand the Agent 365 security model is through three layers.
Identity: Who or what is the agent?
This is primarily an Entra problem.
Data: What information can the agent access or disclose?
This is primarily a Purview problem.
Runtime: What is the agent actually doing?
This is where Defender, observability, endpoint security, and broader monitoring become essential.
Agent 365 sits above these layers and provides the organizational control plane.
The model can therefore be summarized as:
Agent discovery → Agent registration → Identity → Permissions → Data access → Runtime behavior → Monitoring → Governance
Why Shadow Agents Matter
The biggest risk may not come from an approved Copilot Studio agent.
It may come from an agent that security teams do not know exists.
Consider a developer who installs an autonomous coding agent.
The tool can read source code, execute commands, access repositories, use credentials stored on the workstation, communicate with external services, and potentially modify production infrastructure.
From a traditional security perspective, this combines several risk categories:
- identity risk,
- endpoint risk,
- application risk,
- data-loss risk,
- software supply-chain risk,
- and AI governance risk.
This is why agent discovery must become part of the enterprise security program.
The question cannot simply be:
“Which agents did IT approve?”
It must also be:
“Which agents are actually operating inside the organization?”
Agent 365 and Microsoft Purview: A Powerful Combination
For organizations already investing in Microsoft Purview, Agent 365 expands the scope of data security.
Historically, Purview protected information when humans interacted with applications.
For example:
User → Outlook → Sensitive email → DLP
or:
User → Endpoint → USB → Endpoint DLP
or:
User → Microsoft 365 Copilot → Sensitive prompt → DLP
The agentic model introduces another pathway:
Agent → Enterprise data → Tool or external system
The user may not even be directly involved when the transaction occurs.
This means organizations must increasingly apply data-security controls to both human and non-human actors.
That is a major architectural shift.
What Security Teams Should Start Doing Now
Organizations do not need to wait until thousands of agents are deployed before creating an agent-security strategy.
A practical starting point is to establish an agent inventory and governance process.
Identify where agents are currently being created, including Copilot Studio, Microsoft Foundry, custom development teams, SaaS platforms, cloud providers, and local development environments.
Then define an ownership model.
Every production agent should have an accountable business and technical owner.
Next, establish identity governance.
Agents should receive only the permissions required to perform their intended function. Long-lived credentials and broad delegated access should be treated as high risk.
Then bring data security into the architecture.
Use Purview to understand what sensitive information exists, where oversharing occurs, which labels and DLP controls are required, and whether agents are accessing content beyond their business purpose.
Finally, continuously monitor agent behavior.
Registration is not the end of governance.
Organizations need visibility throughout the lifecycle of the agent.
A New Security Operating Model
Agent 365 represents something bigger than another Microsoft administration portal.
It reflects a broader transformation in enterprise security.
For decades we secured:
Users → Devices → Applications → Data
Cloud computing added:
Workloads → APIs → SaaS
The agentic enterprise adds a new actor:
AI Agents
These agents can potentially combine identity, data access, reasoning, and execution.
That combination is extremely powerful.
It also means they require enterprise-grade governance.
The organizations that succeed with agentic AI will not be those that simply deploy the largest number of agents.
They will be the organizations that can answer:
What agents do we have?
Who owns them?
What identities and permissions do they use?
What sensitive data can they access?
What actions are they taking?
Can we detect risky behavior?
Can we revoke access immediately when something goes wrong?
Microsoft Agent 365 is Microsoft’s answer to the first part of that challenge: creating a unified control plane for the agentic enterprise.
And the real strength of the architecture comes from combining it with Microsoft Entra for identity, Microsoft Purview for data security, Microsoft Defender for threat protection, and Microsoft Intune for endpoint governance.
The future Microsoft security architecture is therefore not simply about securing Copilot.
It is about securing an ecosystem where humans, applications, workloads, and autonomous agents all interact with the same enterprise data.
That is the next phase of Zero Trust.
Never trust an agent simply because it is an AI agent. Identify it, govern it, restrict it, monitor it, and protect the data around it.
