Agent 365: The Control Plane for AI Agents

Updated: 20 March 2026

Microsoft previewed Agent 365 at Ignite in late 2025 as a governance and identity layer for AI agents, then quietly withdrew key details. On 9 March 2026, as part of the Microsoft 365 E7 announcement, Agent 365 was confirmed at $15 per user per month, with general availability from 1 May 2026, both as a standalone product and as part of the new E7 bundle at $99 per user per month. At GA, the licence covers agents acting on behalf of licensed users. Autonomous agents with their own identities remain in the Frontier preview programme.

Key takeaways:

• Agent 365 is a governance layer, not an agent builder. It registers agents, gives them Entra identities, and extends Purview and Defender to cover agent activity.

• $15 per user per month standalone, or $99 as part of M365 E7. Not every agent needs it. Only business-critical agents require the paid licence.

• The per-seat price covers governance only. Building and running agents costs extra via Copilot Studio or Foundry consumption, billed separately on the Azure invoice.

• At launch, Agent 365 covers agents acting on behalf of (OBO) licensed users. All OBO agents are covered under that user's licence. Autonomous agents with their own identities, mailboxes, and credentials remain in the Frontier preview programme.

• Several security features remain in public preview at launch. No consumption cost guidance, no Product Terms entry, and no documented licensing boundary between free and paid tiers.

What Agent 365 Actually Is

Agent 365 is not an agent builder. You don't use it to create AI agents; you use Microsoft's agent-building tools (Copilot Studio, Microsoft Foundry) for that. Agent 365 is the governance layer: it registers agents, gives them identities, controls what they can access, and lets you see what they're doing.

It extends Entra ID (Microsoft's identity service) to cover agents. Microsoft calls this capability "Entra Agent ID". At GA, agents operate on behalf of licensed users using their delegated permissions. The user's Agent 365 or E7 licence covers all agents acting on their behalf, and those agents do not need their own licence.

Microsoft's longer-term vision goes further. The Agent 365 identity documentation describes "agentic users," a specialised identity type where agents get their own mailbox, OneDrive storage, organisational chart presence, and unique principal name (e.g. agent@yourtenant.onmicrosoft.com). That capability remains in the Frontier preview programme and is not part of the 1 May GA release.

What is available at launch: every agent in your organisation gets registered and controlled centrally through the Agent Registry. You can see which agents exist, what they're allowed to access, and what they're actually doing. If an agent misbehaves or someone deploys one without approval, you can shut it down.

Whether you built your agent with Copilot Studio, Microsoft Foundry, the M365 Agents Toolkit, Agent Framework, Agent 365 SDK, or an open-source framework, Agent 365 is where you register and manage it.

The Problem Agent 365 Solves

Before Agent 365, Microsoft's security stack had a blind spot. Entra ID manages human identities. Conditional Access controls what human users can do based on device, location, and risk level. Purview tracks what data human users touch. Defender watches for threats targeting human-driven workflows. None of these tools was designed for non-human actors.

Once AI agents start acting on behalf of users, those controls stop working. You cannot apply a Conditional Access policy to a process that has no device, location, or session. You have limited visibility into what data an agent reads or modifies during a multi-step task. There is no built-in audit trail for autonomous actions. If an agent sends an email, updates a record, or accesses a confidential document, existing compliance tools may not capture these activities in a way that satisfies regulatory requirements.

The governance gap is not theoretical. A KPMG AI Quarterly Pulse Survey (September 2025, 130 US C-suite leaders at organisations with $1 billion or more in revenue), cited by Microsoft on the Entra Agent ID product page, found that 42% of large organisations have already deployed agents, 76% of leaders expect employees to manage agents within two to three years, and 78% are concerned about cybersecurity for agents.

Agent 365 governs agents but does not build or run them. Building and execution require separate tools (Copilot Studio, Microsoft Foundry) with their own consumption costs.

Agent 365 is Microsoft's answer: extend Entra, Purview, and Defender to treat agents as first-class identities alongside humans.

Pricing: $15 Per User Per Month

Agent 365 is available as a standalone product at $15 per user per month from 1 May 2026. You do not need Microsoft 365 E7 to use it.

It is also included in the new Microsoft 365 E7 bundle at $99 per user per month, alongside M365 E5 ($60 from July 2026), Microsoft 365 Copilot ($30), and Entra Suite ($12). Buying these separately would cost $117, so the bundle saves up to 15%.

🖐 Need help navigating Microsoft licensing for your enterprise? Learn more: Microsoft Licensing Services for Enterprises.

A note on the 15% claim: Microsoft uses $12 for Entra Suite in this calculation, which is the published add-on price for Entra ID P1 customers. However, E5 includes Entra ID P2, and Microsoft’s pricing page states that “special pricing is available for Microsoft Entra ID P2 and Microsoft 365 E5 customers” — the discounted amount is not published. Since E7 is built on E5, the actual savings for the target customer may be lower than 15%.

What Agent 365 Provides

Observability

The Agent Registry is the central inventory. It shows every agent deployed across the organisation: who built it, what framework it uses, what data it can access, and how actively it runs. An agent map visualises relationships between agents, the users they serve, and the resources they interact with. Behaviour and performance reports provide role-specific oversight: a compliance officer sees different signals than a security analyst or an IT administrator.

Risk signals from Defender, Entra, and Purview flow into the registry, so a flagged agent appears in a single place rather than requiring manual correlation across three separate consoles. Security policy templates, starting with Entra, let administrators apply baseline governance rules to new agents without having to configure each one from scratch.

Identity and governance

Entra Agent ID (included in Agent 365) extends the Entra directory (previously Azure Active Directory, Azure AD) to cover agents alongside human user accounts. The identity documentation describes two authentication flows. The On-Behalf-Of (OBO) flow lets an agent receive a user's delegated token and act with that user's permissions, which is the model covered by the GA licence. The agent identity flow lets an agent authenticate with its own credentials and operate autonomously, which remains in the Frontier preview. Both flows enable enrolling agents in Identity Protection (risk-based sign-in policies, anomaly detection) and Conditional Access (scoped permissions based on context).

Identity Governance extends lifecycle management to agents. Access packages (bundles of permissions that can be requested, approved, and time-limited) now apply to agents as well as humans. An agent that needs access to a SharePoint site for a specific project can receive a scoped, time-limited grant that automatically expires. The same approval workflows that govern human access requests can also gate agent permissions.

Compliance and security

On the Purview side, Agent 365 extends several capabilities to agent activity:

• Data Security Posture Management: visibility into what sensitive data agents can access

• Information Protection: agents inherit sensitivity labels, so a document marked "Confidential" retains that classification when an agent processes it

• Inline Data Loss Prevention (DLP): DLP policies apply to Copilot Studio agent prompts, blocking agents from leaking sensitive data through their interactions

• Insider Risk Management: agent behaviour patterns feed into the same insider risk signals used for human users

• Data Lifecycle Management: retention and deletion policies apply to agent-generated content

• Audit and eDiscovery: agent actions are captured in the compliance audit log and are searchable through eDiscovery, which matters for regulated industries where every action on certain data must be traceable

• Communication Compliance: agent interactions (what an agent says to users, what it writes in documents) can be monitored for policy violations

On the Defender side, purpose-built detection covers prompt manipulation (attempts to trick an agent into ignoring its instructions), model tampering (interference with the underlying AI model), and agent-based attack chains (where a compromised agent is used as a stepping stone to access other resources).

What is not ready at launch

The GA release on 1 May is not the full Agent 365 vision. The licensing FAQ confirms that the GA licence covers agents acting on behalf of licensed users (OBO). Autonomous agents with their own identities, the "agentic users" described in the developer documentation, remain in the Frontier preview programme. The entire Agent 365 SDK and developer tooling carries the Frontier preview banner.

On the security side, some capabilities are not yet production-ready. Security posture management for Foundry and Copilot Studio agents, along with detection and response, will continue in public preview on 1 May. Runtime threat protection via the "Agent 365 tools gateway" is entering public preview in April 2026, meaning it will not be generally available at launch. Organisations buying Agent 365 at GA should understand that the security detection story is incomplete on day one.

Not Every Agent Needs Agent 365

Microsoft recommends that only business-critical agents, those shared broadly within the organisation, handling sensitive or regulated information, or performing autonomous actions, need Agent 365 governance. Casual agents built by individual users in Copilot Chat or Teams do not.

The distinction matters for cost planning. An organisation might have thousands of lightweight personal agents (a sales rep's email summariser, a manager's meeting prep assistant) but only dozens that genuinely need governed identities, compliance audit trails, and DLP enforcement. Agent 365 licensing applies to the latter group.

Not every agent needs a paid licence. Microsoft draws a line between casual personal agents and business-critical ones, but the exact licensing boundary has not been documented yet.

The precedent is Managed Environments for Power Platform, where Microsoft created a licensing boundary between simple apps and governed apps that required Power Apps Premium. With Power Platform, the boundary was defined by whether the app ran in a managed environment. For Agent 365, the equivalent boundary for triggering the requirement for a paid licence versus what remains in the free tier has not been precisely documented.

The Hybrid Cost Model

The 9 March announcements confirmed what we expected: a hybrid model combining per-seat licensing with consumption-based costs. $15 per user per month (or $99 in E7) is not the full cost of running AI agents.

Layer 1: Per-seat (governance)

Agent 365 covers the governance layer for agents: registration, identity, security, compliance, and observability. It does not build or run them.

Layer 2: Consumption (building and execution)

To build and run agents beyond the thin free tier included with Copilot, organisations need Copilot Studio (pricing), Microsoft Foundry, or both. Both carry their own costs.

Credits in capacity packs expire monthly. Annual P3 credits expire annually, better for planning, but still use-it-or-lose-it. Neither rolls over.

🖐 Planning a Microsoft Enterprise Agreement negotiation? We provide independent support. Learn more: Microsoft Enterprise Agreement Negotiation.

Nicole Dezen's partner blog says it directly: "Together, Microsoft 365 E7 and Agent Factory provide a clear path to move customers from early adoption to durable Frontier transformation." E7 and Agent Factory are two separate purchases.

Two control planes, two bills

The same agent can sit under two separate control planes, billed under different models and managed by different teams.

Agent 365 (per-seat, on the M365 invoice) handles the IT administration side: identity, governance, compliance, and security through the Microsoft Admin Centre. The governance side is the domain of IT administrators, compliance officers, and security teams. They see the agent in the Agent Registry, manage its Entra identity, monitor its Purview compliance signals, and respond to Defender alerts.

Azure AI Foundry (consumption-based, on the Azure invoice) handles the developer side: building, testing, deploying, and running agents. The execution side is the domain of developers and platform engineers. They manage the agent's code, model configuration, API integrations, and compute resources.

Both control planes apply to the same agent simultaneously. An organisation deploying agents at scale would see Agent 365 costs on their M365 invoice and Foundry execution costs on their Azure invoice, managed by different teams, under different budget lines, with different cost dynamics. The governance team sees a predictable per-seat cost. The engineering team sees a variable consumption bill. Neither team has full visibility into the other's spend without deliberate cross-team coordination.

The same agent appears on two separate invoices: Agent 365 governance on the M365 bill (per-seat) and execution costs on the Azure bill (consumption). Budget owners on each side may not see the other's spend.

The two-invoice split is not unique to Agent 365. The same pattern exists between Power BI Pro (per-seat, M365) and Fabric (consumption, Azure), or between Purview in E5 (per-seat) and Purview extended scanning (consumption). But for AI agents, where the consumption portion could dwarf the per-seat cost, the split has more significant budgeting implications.

The thin free tier

Microsoft 365 Copilot (included in E7 at $30) provides a limited zero-cost agent capability. Copilot Studio lite for internal agents allows zero-rated agent usage within Copilot Chat, Teams, and SharePoint. Anything beyond those boundaries costs credits.

🖐 Need help optimising your Microsoft 365 investment? Learn more: Microsoft 365 Planning and Optimisation.

Nobody yet knows how restrictive that free tier will be.

What the Licence Covers and What It Doesn't

E5 includes a capped allocation of 400 SCUs per 1,000 users, with overages at $6 per Security Compute Unit (SCU)

Third-Party and Open-Source Agent Support

Microsoft states that Agent 365 extends governance to agents built with third-party and open-source frameworks, not just Microsoft's own tools. The Agent 365 product page and Dezen's partner blog both reference this capability, and the supported frameworks list includes Copilot Studio, Microsoft Foundry, M365 Agents Toolkit, Agent Framework, and the Agent 365 SDK.

The practical scope of third-party support at launch remains unclear. Registering a Copilot Studio agent in the Agent Registry is straightforward because Microsoft controls both products. Registering an agent built with LangChain, CrewAI, or another open-source framework raises questions: how does the agent authenticate with Entra Agent ID? How does Purview track data access for an agent running outside Microsoft's ecosystem? How does Defender detect prompt manipulation in a model it does not host?

Microsoft lists an Agent 365 SDK among the supported frameworks, which should bridge the gap, but how much third-party integration actually works at launch versus what arrives later has not been documented.

What We Still Don't Know

As of 19 March 2026:

• Channel availability. Cloud Solution Provider (CSP) incentives have been confirmed, but availability through Enterprise Agreement (EA), Microsoft Customer Agreement for Enterprise (MCA-E), or other commercial channels has not been announced.

• Education, government, and nonprofit pricing. No Agent 365 or E7 variants have been announced for these sectors.

• Consumption cost guidance. Microsoft has published no expected costs per agent, no reference architectures, and no total cost of ownership models. Organisations cannot meaningfully budget for agent building and execution costs today.

• The thin free tier in practice. How much agent capability the Copilot Studio lite tier actually provides, and how quickly organisations will hit its boundaries, is unknown.

• Product Terms. No E7 or Agent 365 SKU appears in the Microsoft Product Terms yet.

• Preview capabilities at launch. Several Agent 365 security features will remain in public preview on 1 May. The security detection story is incomplete on day one.

• The licensing boundary. What precisely triggers the requirement for a paid Agent 365 licence versus what stays in the free tier has not been documented with the same clarity as, say, Power Platform's managed environment boundary.

• Autonomous agent licensing. The GA per-user model covers OBO agents. The Frontier preview uses per-agent-instance licensing. How Microsoft will price autonomous agents when they reach GA is undetermined.

• Frontier preview timeline. The developer SDK, agent identity authentication, and agentic user capabilities all remain in Frontier preview with no published GA date beyond the OBO control plane shipping 1 May.

Our View on Discounting

We expect significant discounting on Agent 365 and E7. Microsoft has been running 15% and 20% and even 30% promotional discounts on Copilot throughout 2025 and 2026 without meaningfully moving adoption numbers. Copilot has just over 3% penetration among approximately 450 million M365 business subscribers, a figure we explored in detail after the Q2 FY2026 earnings. A $99 list price for E7 and a $15 list price for Agent 365 leave substantial room for incentive programmes, and we expect Microsoft to use it.

Dezen's partner blog references "promotional offers aligned to Microsoft 365 E7" with CSP incentives starting 1 April 2026, though the specifics have not been published yet.

Until Microsoft publishes consumption cost guidance and the Product Terms list E7 and Agent 365 SKUs, the $15 per-seat price is a governance floor, not the full cost of deploying AI agents. If you need help modelling the real cost, get in touch. We don't sell Microsoft licences or cloud services, so our advice is independent.