Microsoft Agent 365 is the control plane Microsoft sells for AI agents, and it has been generally available for commercial customers since May 1, 2026. It doesn’t build agents. It puts agents you already have into the consoles you already run: the agent registry in the Microsoft 365 admin center, Entra for identity and network controls, Purview for data, Defender for threats and Intune for endpoints. The license is per user, at $15 per user per month standalone or included in Microsoft 365 E7.
This is the explainer: what Agent 365 covers, what each piece costs, and the order I’d roll it out in. For the hands-on shadow AI work (finding and blocking OpenClaw on Windows devices), use the companion guide, Blocking shadow AI on Windows endpoints with the Agent 365 Shadow AI page.
I updated this article on October 19, 2026 against current Microsoft Learn and replaced the “coming in June 2026” items with what Microsoft actually documents now.
What Agent 365 is, and what it isn’t
Microsoft organizes Agent 365 around three jobs:
- Observe. One registry of agents, plus an agent map, with adoption, activity and health.
- Govern. Lifecycle, access control and compliance through the registry, Entra and Purview.
- Secure. Entra access controls, Purview data protection and Defender threat detection applied to agents.
It’s a governance layer over Copilot Studio, Microsoft Foundry and Agent Builder, which build the agents. Microsoft says agents from those three tools integrate with Agent 365 automatically. Agents built elsewhere come in through registry sync or the Agent 365 SDK. It also doesn’t replace Defender or Purview; it extends them to agents. If you don’t run those products, you get much less out of it.
At GA Microsoft split agents into those acting on behalf of a user (delegated access) and those running with their own credentials (own access). Both were GA on May 1. Agents participating in team workflows were public preview at that point.
What you get with which license
The Agent 365 service description has a feature-by-plan table, and it’s the most useful page Microsoft has published on this product. In short:
| Capability | Console | Included in Microsoft 365 plans | Needs Agent 365 or E7 |
|---|---|---|---|
| Agent inventory in the registry | Microsoft 365 admin center | Yes | Yes |
| Basic governance (publish, deploy, block, delete, approve, assign, reassign owner) | Microsoft 365 admin center | Yes | Yes |
| Rule-based lifecycle automation | Microsoft 365 admin center | Yes | Yes |
| Sync agents from external platforms | Microsoft 365 admin center | Yes | Yes |
| Policy templates, observability, tenant-wide tool (MCP) control | Microsoft 365 admin center | No | Yes |
| Access packages, sponsor lifecycle policies, Conditional Access for agents | Entra | No | Yes |
| Network traffic controls for agents on user devices and Copilot Studio agents | Entra | No | Yes |
| Audit, eDiscovery, DLP, sensitivity labels, Insider Risk for agents | Purview | No | Yes |
| Shadow AI endpoint sync, exposure mapping, alerts and tool-invocation blocking | Defender | No | Yes |
| Device compliance for agent CA, policy-controlled runtime, blocking local agents | Intune | No | Yes |
GCC availability varies by row. The network controls, the Purview rows and most Defender rows aren’t listed for GCC.
On price, Microsoft lists Agent 365 at $15.00 per user per month and Microsoft 365 E7 at $99.00 per user per month, both paid yearly. The licensing FAQ says agents don’t need licenses. You license the user associated with the agent, whether that’s the user, owner, sponsor or manager, across both delegated and own-access flows. If an agent is tied to an unlicensed user, its activity isn’t entitled to Agent 365 protections. Get your account team to confirm how they’ll count covered users before you size a purchase.
The overview also says Agent 365 “works best when using Microsoft E5 as a pre-requisite,” and Entra Conditional Access for agents needs either E7 or an Agent 365 license paired with at least Entra P1 or Microsoft 365 E3. E3 tenants can buy Agent 365, but expect to need more add-ons for the full set of features. The Shadow AI page needs E5 to view.
Windows 365 for Agents compute is separate from the Agent 365 license, so model it on its own if you plan to use it.
How each product plugs in
Entra. Conditional Access for agents uses the same policy engine as for users and evaluates user and agent context, device, location and risk before Entra issues a token. An agent can act for a signed-in user, use its own agent identity, or use its own agent user account, and you target those differently in policy.
Purview. Learn lists auditing, data classification, sensitivity labels, DLP, Insider Risk Management, communication compliance, eDiscovery, data lifecycle management and Compliance Manager as supported for Agent 365. Audit and sensitive-data detection turn on automatically when you create an agent instance; for the rest, you include the agent instance in policies the same way you’d include a user.
Defender. Local AI agent discovery in Defender for Endpoint inventories agents it sees running on onboarded Windows devices (macOS is in preview), with an exposure map and advanced hunting. Runtime protection, still in preview, inspects the agent loop and can block malicious prompts before the agent acts. Defender also discovers cloud agents built with Copilot Studio, Microsoft Foundry, AWS Bedrock and GCP Vertex AI.
Intune. Intune enforces the shadow AI block policy for OpenClaw, supplies device compliance to Conditional Access for agents, and manages Windows 365 for Agents Cloud PCs.
Entra network controls for agent traffic
Agents move faster than people, and Microsoft’s GA post points to the risks: risky web destinations, unsanctioned AI services, unsafe file handling and prompt-based attacks. The service description lists the Entra capability as “Monitor and block malicious and noncompliant network traffic for agents, operating on user devices, and for Copilot Studio agents.” It needs Agent 365 or E7.
This is the first enforcement control I’d turn on, because it covers agents the Shadow AI page can’t block. If you already forward traffic through Global Secure Access for users, extend that model to agents before you write per-agent rules.
Local agents and shadow AI
The Shadow AI page in the Microsoft 365 admin center is still a Frontier public preview. It detects seven agents and blocks only OpenClaw, through an Intune policy named A365 - Block OpenClaw. Defender’s own inventory goes much wider, with GitHub Copilot CLI, Claude Code, Codex CLI, Cursor and dozens more on Windows. The shadow AI guide has the prerequisites and steps.
Agents on other clouds
Use Connected platforms in the Microsoft 365 admin center to sync agents from Amazon Bedrock, Google Vertex AI, Salesforce Agentforce, Databricks Genie, Anthropic Claude Managed Agents, Oracle Generative AI Agents and Snowflake Cortex. Observability is available for some of these and listed as coming soon for others.
The connections are read-only, sync is manual and deletion isn’t guaranteed to reconcile. You get inventory, not runtime policy, for those agents. Agents built outside Microsoft can also use the Agent 365 SDK for identity, notifications, security and governed access to Microsoft 365 data, which is the route to real control.
Windows 365 for Agents
Windows 365 for Agents provides Cloud PCs for agent use. An agent checks out a Cloud PC for a task and checks it back in. For Agent 365 you set it up with a provisioning policy (agents) in Intune, and management is pool-based through Cloud PC agent pools. Microsoft announced it in public preview, US only, on May 1, 2026. Check current availability before you plan around it.
Security Copilot comes with E5 and E7
Microsoft says Security Copilot is included for eligible Microsoft 365 E5 and E7 customers. Rollout started November 18, 2025 and continues in phases. Eligible tenants get it through zero-click activation, with no Azure setup or capacity provisioning. Microsoft names phish triage, alert triage, access reviews and vulnerability remediation as tasks the included agents can automate, across Defender, Entra, Intune and Purview. It’s a separate product from Agent 365, but if you’re licensing E7 for Agent 365 you should know you already have it.
A practical rollout order
- Inventory. Open Agents > All Agents > Registry in the Microsoft 365 admin center. Note the Agents without owners and Unmanaged agents counts. These features come with Microsoft 365 plans, so you can start before you buy.
- Fix ownership. Reassign owners for orphaned agents and decide which ones to block or delete.
- Connect other platforms. Add your Bedrock or Vertex AI connections and run Sync agents.
- License the people tied to agents. Size it with your account team.
- Turn on network controls for agents on devices and Copilot Studio agents.
- Add Conditional Access for agents and Purview policies for the data classes that matter most.
- Run shadow AI detection, then block where you’ve decided to.
- Tune Defender alerts and evaluate runtime protection on a test device first.
Limitations
- Shadow AI and runtime protection are still preview, and blocking covers OpenClaw on Intune-managed Windows only.
- External-platform sync is inventory. Those agents don’t get Microsoft runtime policy unless you integrate them with the SDK.
- Several premium features aren’t listed for GCC.
- The licensing is additive on E3 and E5. Run the numbers for the users actually tied to agents.
FAQ
Is Microsoft Agent 365 generally available?
Yes. It has been GA for the commercial segment, licensed per user, since May 1, 2026. Some features in it, such as the Shadow AI page, are still in preview.
How much does Agent 365 cost?
Microsoft lists $15.00 per user per month (annual commitment) standalone. It’s also included in Microsoft 365 E7, listed at $99.00 per user per month.
Do agents need their own licenses?
No. Microsoft’s licensing FAQ says you license the user associated with the agent, such as its user, owner, sponsor or manager.
Can I use the agent registry without buying Agent 365?
Yes. The service description marks the registry inventory, basic governance actions, rule-based lifecycle automation and external platform sync as included with Microsoft 365 Enterprise, Business, Education and Front Line Worker plans.
Sources
- Microsoft Agent 365 overview: observe, govern, secure; GA May 1, 2026; E5 recommendation
- Microsoft Agent 365 service description: feature-by-plan and GCC table
- Microsoft Agent 365 licensing FAQ and plans and pricing: per-user model, $15 and $99 list prices
- Agent Registry in Microsoft 365 admin center
- Conditional Access for agents: licensing and evaluation
- Use Microsoft Purview for Agent 365: supported capabilities
- Local AI agent discovery with Microsoft Defender for Endpoint and AI agent runtime protection (Preview)
- Understand Shadow AI in Microsoft 365 admin center
- Connected platforms in Microsoft Agent 365 and Connect existing agents
- What is Windows 365 for Agents?
- Security Copilot for Microsoft 365 E5 and E7 customers
- Microsoft Agent 365 GA announcement: agent access types at GA, network-control risks, Windows 365 for Agents preview