Think back to the early days of cloud adoption. Every team was creating virtual machines, storage accounts, and databases in ways that worked for them individually. But for the person responsible for governance, security, and cost control, it was chaos. This problem became known as shadow IT.

Now, the same pattern is emerging again, but this time with AI agents. Teams are deploying AI assistants, bots, and autonomous agents to automate work and improve productivity. Unlike cloud resources, agents can be created much faster and often without centralized oversight.

This has led to a new challenge called AI agent sprawl.

IDC predicts there will be 1.3 billion AI agents by 2028. That's not a slow rollout - that's an avalanche.

Without proper governance, organizations face serious risks:

Microsoft’s answer to this challenge is Microsoft Agent 365 and frankly, it is one of the most architecturally sensible things they have announced in this space.

At its core, Microsoft Agent 365 is the control plane for AI agents. A control plane is the layer where you manage, monitor, and govern resources. It gives you visibility and control over how those resources operate.

In this case, the resources are AI agents.

The best way to understand this is by comparing it with Microsoft Entra ID. Entra ID helps you manage human identities by controlling:

Microsoft Agent 365 applies the same concept to AI agents. It allows organizations to manage agents as digital identities, with defined permissions, access controls, and governance policies.

Importantly, Agent 365 builds on the existing Microsoft security and governance foundation. It integrates with services such as:

This means organizations do not need a completely new governance model. Instead, they can extend their existing identity, security, and compliance frameworks to include AI agents.

From an architecture perspective, this makes AI agents first-class entities that can be governed just like users, applications, and services.

Microsoft Agent 365 is platform-agnostic. It does not matter where the agent was built.

An agent could be created using:

As long as the agent is registered and assigned a Microsoft Entra Agent ID, it can be governed through the Agent 365 control plane.

If you are building agents using Copilot Studio, Microsoft Foundry, or custom frameworks, the key requirement for Agent 365 compatibility is simple: your agent must have a Microsoft Entra Agent ID and be registered in the Agent 365 Registry.

This is what allows Agent 365 to apply identity, governance, security, and monitoring policies.

The exact steps depend on how the agent is built.

Agents built using Copilot Studio and Microsoft Foundry have native integration pathways that enable onboarding into the Agent 365 governance model.

When an agent is created using Copilot Studio or Microsoft Foundry:

To ensure proper governance:

This is the easiest and most seamless path to Agent 365 integration.

Custom agents built using frameworks such as LangChain, Semantic Kernel, or Azure OpenAI can also be governed by Agent 365.

The integration workflow follows a standard identity-first model:

Once integrated, the agent receives the same governance, security, and compliance protections as Microsoft-built agents.

Entra Agent ID acts like a managed identity. It has no permissions by default and must be explicitly granted access to enterprise resources.

Microsoft’s vision for Agent 365 is an open platform that can govern agents from any source, including Salesforce, ServiceNow, Workday, and custom-built systems.

The integration model is straightforward in principle:

However, this ecosystem is still maturing.

Today:

For organisations running third-party agents today, the recommended approach is:

Over time, Agent 365 is expected to become the unified governance layer for all enterprise agents, regardless of platform.

Microsoft Entra Agent ID provides the identity layer, while Agent 365 provides the governance layer.

Together, they enable a complete lifecycle:

This creates a unified governance model across all agents.

From an architectural perspective, Entra Agent ID is the foundation that makes Agent 365 governance possible.

Microsoft’s framing of agents as digital employees might sound like marketing language, but architecturally, it is accurate.

When a human employee joins an organisation, they go through a defined lifecycle. They are assigned an identity, granted access to specific systems, monitored for security and compliance, and eventually deprovisioned when they leave.

Microsoft Agent 365 applies this same lifecycle model to AI agents.

This lifecycle model brings immediate architectural advantages.

First, it allows organisations to extend their existing governance framework to agents. The same identity, access control, compliance, and security processes used for human users can now be applied to AI agents.

Second, it improves accountability and traceability.

Instead of a generic system log entry such as:

You get a clear, identity-based record:

This provides full visibility into:

This identity-centric model is what makes large-scale agent governance possible. Agents are no longer anonymous automation scripts. They are governed digital identities operating within the enterprise security and compliance framework.

From an architecture perspective, this is the critical shift that allows organisations to safely adopt AI agents at scale.

Shadow IT did not disappear. It evolved.

With tens of millions of monthly active Power Platform users, agents are already being built across organisations. In many cases, these agents are created by well-intentioned business users trying to automate repetitive work. They solve real problems, but they often do so without going through formal IT onboarding or governance.

The result is shadow agents - agents operating in your environment without centralized visibility, identity governance, or security oversight.

These agents may:

From an architecture perspective, this creates the same risks that shadow IT created in the early cloud era, but at a much faster scale.

Microsoft Agent 365 addresses this through built-in discovery and quarantine capabilities. Agent 365 provides discovery and governance capabilities that allow administrators to identify and quarantine unmanaged agents. This prevents the agent from running until it has been reviewed and approved.

Quarantine does not delete the agent. Instead, it places the agent in a controlled state where it cannot access enterprise systems or data.

While quarantined, the agent remains visible in the Agent 365 Registry. This allows administrators to investigate:

This follows the same architectural principle used for unmanaged devices. When an unknown device connects to the network, it is isolated first, then reviewed before being trusted.

So far, we’ve looked at Agent 365 from a conceptual and user perspective. Now let’s shift to the IT administrator’s point of view, because this is where governance actually happens.

As agents start multiplying across the organization, administrators need a central place to manage them. This is provided through the Microsoft 365 Admin Center, where Agent 365 integrates directly into the existing admin experience.

From here, administrators can discover agents, control their access, monitor their behavior, and enforce security policies.

The five pillars of Agent 365 map directly to these administrative capabilities:

These pillars ensure that agents are not operating outside IT governance. Instead, they become fully managed entities within the enterprise identity, security, and compliance framework.

The Agent Registry provides a centralized inventory of all agents in the environment, regardless of how they were built. Administrators can see each agent’s identity, permissions, data access, and applied security policies.

This includes:

Unapproved agents can be quarantined, blocking access to enterprise systems until reviewed.

This gives IT real-time visibility and governance, replacing the manual spreadsheets many organisations rely on today.

Agent 365 enforces access control both before deployment and during runtime.

Before activation, agents must be approved in the Microsoft 365 Admin Center. Administrators review requested permissions, data access, and capabilities, then assign policies using Microsoft Entra, Purview, and Microsoft 365 controls. This ensures least-privilege access from the start.

During runtime, Agent 365 continuously monitors agent behavior. If suspicious activity is detected, Conditional Access can block the agent immediately. Administrators can also disable the agent, instantly revoking its access.

This ensures agents operate within defined security boundaries throughout their lifecycle.

As agent usage grows, administrators need visibility into how agents interact with systems, data, and each other.

The Agent Map provides a real-time visual view of:

Administrators can quickly identify abnormal behavior and investigate issues without digging through logs.

Agent 365 also provides dashboards with performance, security, and usage insights. Activity is fully logged and integrated with Microsoft Purview, ensuring auditability, compliance, and governance.

This gives organizations the visibility needed to safely operate agents at scale.

Agents are only useful if they can access enterprise tools and data. Microsoft Agent 365 connects agents to systems like Microsoft 365, SharePoint, Dynamics 365, and other business applications, allowing them to operate within real workflows.

Work IQ provides organizational context, enabling agents to understand relationships, documents, and business processes. This allows agents to make decisions based on your organisation’s actual environment, not generic data.

Agent 365 is platform-agnostic. Agents built using Copilot Studio, Microsoft Foundry, Azure AI services, or open-source frameworks can all be registered and governed once assigned a Microsoft Entra Agent ID.

This gives organisations:

From an architecture perspective, Agent 365 provides interoperability without sacrificing governance or control.

Security in Microsoft Agent 365 is built on the same enterprise security stack that protects users and applications.

Microsoft Defender provides security monitoring and threat detection capabilities for agents, including protections against prompt injection and abnormal behavior.

Microsoft Purview enforces data protection and compliance policies. Agents automatically respect sensitivity labels, data access restrictions, and audit requirements.

Microsoft Entra provides identity and access control, ensuring least privilege access and enforcing Conditional Access policies in real time.

Administrators manage all of this using familiar tools like Entra, Purview, and Defender. Agent 365 extends the existing security model to agents, without requiring new management systems.

From an architecture standpoint, Microsoft Agent 365 is built on the right foundation. Instead of introducing a new management silo, it extends existing enterprise platforms:

This allows agents to be governed using the same controls already in place for users and applications.

Agent 365 treats agents as digital employees, giving them their own identity and workspace. This enables agents to participate directly in business workflows, while ensuring full accountability and governance.

Support for third-party agents is equally important. Agents built on platforms like ServiceNow, SAP, or Workday can be registered and governed once assigned a Microsoft Entra Agent ID. This creates a vendor-neutral control plane, avoiding lock-in and enabling centralized governance.

There are still open questions around pricing, ecosystem maturity, and multi-agent governance. However, the architectural direction is clear.

Agent 365 brings identity, security, and governance to AI agents - a necessary foundation for enterprise-scale adoption.

Microsoft Agent 365 has a strong architectural foundation, but several important operational and ecosystem details are still evolving as the platform moves toward general availability.

If you are planning adoption, these are the key areas to monitor closely.

Agent 365 is currently available through the Frontier preview and is closely integrated with Microsoft 365 Copilot environments. Microsoft has not announced a standalone SKU or public pricing.

Key questions that remain:

These answers will directly impact adoption strategy and cost planning.

Microsoft’s vision is for Agent 365 to govern agents from any platform, including ServiceNow, Salesforce, Workday, and custom-built systems. However, the partner ecosystem is still maturing.

Open questions include:

This will determine how effectively organisations can govern their entire agent ecosystem.

Agent 365 is currently available through the Frontier preview program. Some capabilities may change before general availability.

Key questions include:

This is critical for organisations planning production deployments.

Agent 365 introduces identity validation, security checks, and telemetry logging. These controls are essential, but they also introduce operational overhead.

Architectural questions to monitor:

These factors affect scalability and runtime performance.

Copilot Studio and Microsoft Foundry provide native integration, but developer tooling for custom and open-source agents is still evolving.

Important questions include:

Developer experience maturity will influence enterprise adoption speed.

Agent 365 builds on Microsoft Entra and Purview, which already support regional data residency and compliance boundaries. However, detailed implementation specifics are still emerging.

Key questions include:

This is especially important for regulated industries and public sector organisations.

Agent 365’s identity-first governance model is clear and well-designed. The remaining questions are primarily operational, ecosystem, and commercial - not architectural.

As Microsoft expands the ecosystem and moves toward general availability, Agent 365 is positioned to become the standard control plane for enterprise AI agents.

AI agents are quickly becoming part of the enterprise fabric. They access data, execute workflows, and make decisions at scale. The real question is not whether they need governance, but whether that governance is implemented proactively or after problems emerge.

Microsoft Agent 365 gives IT and security teams the same visibility and control over agents that they already have over human users. By building on Microsoft Entra, Defender, and Purview, it extends existing identity, security, and compliance frameworks rather than introducing a new governance model.

Importantly, this governance applies across all agent types - Microsoft-built agents, third-party agents, Azure-based custom agents, and open-source frameworks. This creates a unified control plane, rather than a fragmented or vendor-locked solution.

Organisations that succeed with AI agents will treat them like any other enterprise identity: governed, monitored, and secured from day one. Agent 365 provides the foundation to do exactly that.

If you found this useful, tap Subscribe at the bottom of the page to get future updates straight to your inbox.