The Shadow AI page in the Microsoft 365 admin center is where you find unmanaged local AI agents on your Intune-managed Windows devices and block the one Microsoft supports blocking today: OpenClaw. Detection comes from Microsoft Defender for Endpoint. Blocking is an Intune policy that the page creates for you. Everything else on this page (cloud agents, network controls, runtime protection) fills the gaps the Shadow AI page leaves.
I rewrote this guide on October 19, 2026 against current Microsoft Learn. A lot changed since Agent 365 went generally available on May 1, 2026. The license floor for the Shadow AI page is now Microsoft 365 E5, the detection list grew, and the Defender features Microsoft promised for June are now documented on Learn, though runtime protection still carries a preview label.
What Agent 365 is, and what it is not
Agent 365 is not an agent. It’s the control plane Microsoft sells for observing, governing and securing agents, and it works through consoles you already run: the Microsoft 365 admin center, Entra, Purview, Defender and Intune. Microsoft licenses it per user, at $15 per user per month standalone or included in Microsoft 365 E7. The licensing FAQ says agents don’t need their own licenses; you license the people tied to them (user, owner, sponsor or manager). It extends Defender and Purview and does not replace them, so tenants already running both get the most out of it.
Detect, block or govern: which tool does what
| Goal | Where you do it | What it covers today | Status |
|---|---|---|---|
| Detect local agents | Shadow AI page, fed by Defender for Endpoint | OpenClaw, ChatGPT Desktop, Ollama Desktop, Poe Desktop, Claw/ZeroClaw, OpenCode, Claude Desktop | Frontier public preview |
| Wider local agent inventory | Microsoft Defender portal (local AI agent discovery) | Dozens of agents on Windows, macOS in preview, including GitHub Copilot CLI and Claude Code | See Defender docs |
| Block local agents | Shadow AI page, enforced by Intune | OpenClaw only, Intune-managed Windows only | Frontier public preview |
| Stop malicious prompts at runtime | Defender AI agent runtime protection | Agents in the Defender support matrix | Preview |
| Govern network traffic | Entra network controls for agents | Agents on user devices and Copilot Studio agents | Agent 365 or E7 feature |
| Inventory cloud agents | Connected platforms in the Microsoft 365 admin center | Amazon Bedrock, Google Vertex AI and five other platforms | Read-only sync |
What counts as shadow AI
Microsoft defines shadow AI as “consumer-facing AI applications and standalone agents deployed across your organization without IT visibility or approval.” The local ones are the problem for endpoint teams. They run as the user, so they can read files, run commands and call MCP servers with whatever the user can reach, and none of that has to touch a managed cloud service.
OpenClaw is the example Microsoft leads with, and it’s still the only agent you can block from the Shadow AI page. Microsoft’s Shadow AI documentation lists the risks as data leakage, compliance violations, security vulnerabilities, and lack of auditability and governance.
Prerequisites
Microsoft Learn lists these requirements for the Shadow AI page:
- Frontier opt-in. Shadow AI is part of the Frontier preview program, and Learn calls it public preview: “Features, supported agents, and behaviors might change before general availability.” Opt in from the Microsoft 365 admin center. If your change control blocks preview features in production, decide that first.
- Microsoft 365 E5 to view Shadow AI agents. Older guidance, including the first version of this article, said E3. Current Learn says E5.
- Microsoft Defender for Endpoint on the devices. Detection comes from Defender’s local AI agent discovery, so devices that aren’t onboarded to Defender don’t show up.
- Intune enrollment for managed Windows devices. Blocking only applies to Windows devices enrolled in Intune.
- Global Secure Access (optional, recommended). Without GSA traffic forwarding, the Total traffic tile and the Users, Most recent activity and Last scanned fields stay empty.
- A role, at least one of: Security Administrator, AI Administrator, Global Reader, Security Reader, Security Operator, Reports Reader, User Experience Success Manager or Intune Administrator.
The Agent 365 service description adds the licensing detail for the endpoint controls. “Sync shadow AI endpoint agents” (Defender) and “Block unsanctioned local endpoint agents” (Intune) are marked as requiring Microsoft 365 E7/G7 or Agent 365, and neither is listed as available in GCC. So E5 gets you the view, but plan on Agent 365 or E7 licensing before you enforce.
If you co-manage devices with Configuration Manager, check which workloads you’ve moved to Intune before you pilot blocking. Microsoft’s Shadow AI docs don’t cover co-management, so test it in a pilot ring.
Step-by-step: detect shadow AI agents
Step 1: Opt in to Frontier and onboard devices to Defender. The Shadow AI (Frontier) page doesn’t show anything useful until both are in place. Likely failure point: devices enrolled in Intune but never onboarded to Defender for Endpoint.
Step 2: Open the page. Sign in to the Microsoft 365 admin center and select Agents > Shadow AI. The Shadow AI (Frontier) page is separate from All agents and lists the known shadow AI agents it can detect in your environment.
Step 3: Read the agent details. Select an agent, such as OpenClaw, and confirm Details is selected. You get four tiles:
- Details: First accessed, Most recent activity and Last scanned.
- Detections: Devices (count of devices running the agent) and Users (unique users).
- Security policies: whether a blocking Intune policy is applied.
- Total traffic: unique endpoints (FQDNs), requests, data sent and data received. This tile needs GSA.
Step 4: Review detected devices. Select the Detected devices tab. It shows Device name, Model (Desktop, Virtual Machine, Server, Laptop and so on), Operating system and Last Seen, which is the last time Defender detected the agent on that device. You can search by device name.
Treat this list as a baseline before you block anything. Some engineering teams may have approved uses, so check the list against your team directory first.
Defender’s discovery is activity based. Learn says “Installing an agent doesn’t by itself guarantee that the agent appears in the local AI agent inventory.” An agent shows up after Defender sees it run. It is not a software inventory; use Defender Vulnerability Management software inventory for that.
Step-by-step: block OpenClaw with Intune
Step 5: Apply the block. In the agent details pane, select Security policies, then Block > Apply Policies. This creates a new Intune policy, A365 - Block OpenClaw, that blocks common ways of running OpenClaw and propagates to all managed Windows devices enrolled in Intune.
Step 6: Allow time to apply. Microsoft says the policy can take anywhere from 15 minutes up to 8 hours to apply, depending on how your Intune is configured. Don’t judge the rollout in the first hour.
Step 7: Inspect and scope it in Intune. Search for A365 - Block OpenClaw in the Intune admin center; Microsoft points to Assign policies in Microsoft Intune for this. Learn says the policy can be edited in Intune to add more controls. It targets every Intune-enrolled Windows device at first, so if a development team has an approved use, change the assignment straight after it’s created.
Step 8: Monitor. Use normal Intune device configuration reporting to confirm the policy applied. Devices that report errors need individual follow-up.
Because anyone with enough Intune rights can edit this policy, document it as owned by the Shadow AI workflow and consider a scope tag so another admin doesn’t loosen it by accident.
What shipped after the June 2026 promises
At GA, Microsoft said context mapping, policy-based controls, and runtime blocking and alerts would arrive in public preview in June 2026. Here is what Learn documents as of October 19, 2026:
- Exposure map and MCP inventory. Defender’s local AI agent discovery shows a local AI agent inventory, an exposure map of agents, devices, identities and the resources those identities can access, and advanced hunting through the
AgentsInfotable. Defender also records configured local and remote MCP servers for supported agents. - Broader detection. The Defender support matrix lists GitHub Copilot CLI, Claude Code, Codex CLI, Cursor and many more on Windows. Discovery on macOS is in preview. The Shadow AI page’s own list is shorter (seven agents) and blocking is still OpenClaw only.
- Runtime protection (Preview). Defender’s AI agent runtime protection inspects the agent loop and can block malicious instructions before the agent acts. It uses agent-native events for agents such as Claude Code, Codex CLI and GitHub Copilot CLI, and network inspection for others. Network inspection doesn’t support agents that use certificate pinning or HTTP/3.
I cut the earlier claim of “18 agent types by end of June” because I couldn’t find it on any current Microsoft page.
Network controls: restricting what agents can reach
The Agent 365 service description lists an Entra feature to “Monitor and block malicious and noncompliant network traffic for agents, operating on user devices, and for Copilot Studio agents.” It requires Agent 365 or E7 and isn’t listed for GCC. Microsoft’s GA announcement describes the intent: keep agents away from risky web destinations and unsanctioned AI services, stop unsafe file handling and catch prompt-based attacks.
This is the control that still works for agents the Shadow AI page can’t block. If you already forward traffic through Global Secure Access, start there; GSA also fills in the Shadow AI page traffic tiles.
What about cloud and SaaS agents?
The Shadow AI page covers only local agents. For agents built on other clouds, use Connected platforms in the Microsoft 365 admin center to sync them into the agent registry. Learn lists Amazon Bedrock, Google Vertex AI, Salesforce Agentforce, Databricks Genie, Anthropic Claude Managed Agents, Oracle Generative AI Agents and Snowflake Cortex.
Know the limits before you build a process on it:
- Connections are read-only. Agent 365 never runs agents in the source platform and doesn’t change its resources, apart from an optional delete permission for removing a synced agent.
- Sync is manual. There’s no schedule, so re-run Sync agents before any review that depends on current data.
- Deletion isn’t guaranteed to reconcile. An agent removed at the source may stay in the registry until you remove it.
Registry sync is visibility, not enforcement. It doesn’t put Conditional Access or Intune profiles on a Bedrock agent. Defender can also discover cloud agents built with Copilot Studio, Microsoft Foundry, AWS Bedrock and GCP Vertex AI. For SaaS, Microsoft’s GA post named partner agents built to be managed by Agent 365, including Genspark, Zensai, Egnyte and Zendesk.
Windows 365 for Agents
If an agent needs a full Windows desktop to do its job, give it a Cloud PC instead of a user’s laptop. Windows 365 for Agents is a class of Cloud PCs for agent use. Agents check one out for a task and check it back in afterwards, and you manage them in the Intune admin center through provisioning policies (agents) and Cloud PC agent pools. Microsoft announced it in public preview, United States only, on May 1, 2026. Check current availability for your region before planning around it.
Limitations worth knowing
- Blocking is narrow. OpenClaw only, and only on Intune-enrolled Windows devices.
- It’s still preview. The Shadow AI page and runtime protection both carry preview labels and can change.
- Policy latency. Up to 8 hours for the block to apply. It isn’t an incident response tool; use Defender response actions for an active incident.
- Inventory is activity based. An agent that hasn’t run yet won’t appear.
- Licensing is split. E5 to view, Agent 365 or E7 for the Defender sync and Intune blocking features, and no GCC for those rows.
Admin checklist
- Confirm licensing: E5 for the page, and Agent 365 or E7 for the users tied to the agents you plan to govern.
- Onboard Windows devices to Defender for Endpoint and confirm they’re Intune enrolled.
- Decide whether Frontier is acceptable in your production tenant.
- Enable GSA traffic forwarding if you want the traffic and user data.
- Run detection only and review the device list with team owners.
- Write an approval process for local agents: who signs off, and who reviews their MCP server configurations.
- Block OpenClaw where you’ve decided to, then re-scope A365 - Block OpenClaw in Intune.
- For agents you can’t block, use Entra network controls and Defender runtime protection.
- Connect your cloud agent platforms and re-sync before each review.
My recommendation: run detection for a couple of weeks, then block. You’ll know the real scope before you break anyone’s workflow.
FAQ
Does the Shadow AI page work with Microsoft 365 E3?
Not according to current Learn, which lists a Microsoft 365 E5 license to view Shadow AI agents. The blocking and Defender sync features in the service description need Agent 365 or E7.
Can I block Claude Code or GitHub Copilot CLI from the Shadow AI page?
No. The page lists blocking for OpenClaw only. Defender discovers both agents, and runtime protection covers both through agent-native events, but neither has a Shadow AI block policy.
Does it cover macOS?
Blocking doesn’t. Defender’s local AI agent discovery on macOS is in preview.
How long does the block policy take?
Microsoft says 15 minutes up to 8 hours, depending on your Intune configuration.
Sources
- Understand Shadow AI in Microsoft 365 admin center: prerequisites, supported agents, tiles, blocking steps, A365 - Block OpenClaw, 15 minutes to 8 hours
- Local AI agent discovery with Microsoft Defender for Endpoint: activity-based discovery, exposure map, macOS preview
- Microsoft Defender for Endpoint AI agent support matrix: supported agents and MCP discovery
- AI agent runtime protection (Preview): inspection methods and limits
- Microsoft Agent 365 service description: feature-by-plan table
- Connected platforms in Microsoft Agent 365: supported platforms and limits
- What is Windows 365 for Agents?
- Microsoft Agent 365 overview: GA on May 1, 2026
- Microsoft Agent 365 licensing FAQ and plans and pricing: per-user licensing, $15 and $99 list prices
- Microsoft Agent 365 GA announcement: June 2026 commitments, partner agents, Windows 365 for Agents preview