Agent 365: The Control Plane for AI Agents

Updated: June 2026

Microsoft Agent 365 is a governance, identity, and security layer for AI agents, generally available since 1 May 2026 at $15 per user per month standalone or $99 as part of Microsoft 365 E7. The standalone licence requires Microsoft 365 E5, Microsoft Defender + Purview Suite Frontline Worker (FLW), or Microsoft 365 (M365) Business Premium as a prerequisite. A single user licence covers all agents that person interacts with, manages, owns, or sponsors, whether the agent acts on their behalf or operates with its own access. Full "agent user" identities (own mailbox, OneDrive, org chart presence) remain in the Frontier preview programme.

Key takeaways:

• Agent 365 is a governance and security layer, not an agent builder. It registers agents, gives them Entra identities, and extends Purview and Defender to cover agent activity.

• $15 per user per month standalone, or $99 as part of M365 E7. A paid licence is required for users who interact with, manage, or sponsor agents that use premium capabilities (advanced analytics, governance policies, security posture, threat detection, data security).

• The per-seat price covers governance and security. Building and running agents costs extra via Copilot Studio or Foundry consumption, billed separately on the Azure invoice.

• One user licence covers all agents that person uses, owns, sponsors, or manages, with no per-agent fee. The per-user model applies to both delegated and own-access agents. Full agent user identities are still in Frontier preview.

• A free foundational plan (agent identity, inventory, basic insights) is available to all Microsoft Cloud customers. The paid plan adds advanced governance, security, and compliance.

• Several Defender and Purview security features remain in public preview. Microsoft offers per-agent cost estimators but no end-to-end TCO model for the combined governance-plus-consumption stack.

What Agent 365 Actually Is

Agent 365 is not an agent builder. You don't use it to create AI agents; you use Microsoft's agent-building tools (Copilot Studio, Microsoft Foundry) for that. Agent 365 is the governance and security layer. It registers agents, gives them identities, controls what they can access, and lets you see what they're doing.

It extends Entra ID (Microsoft's identity service) to cover agents, under the capability Microsoft calls "Entra Agent ID". The licensing model is per user, not per agent. A single licence covers all agents that person interacts with, manages, owns, or sponsors, whether the agent uses delegated access or its own access. Agents do not need their own licence.

Microsoft's longer-term vision goes further. The Agent 365 identity documentation describes "agent users", a specialised identity type where agents get their own mailbox, OneDrive storage, organisational chart presence, and unique principal name (e.g. agent@yourtenant.onmicrosoft.com). That capability is still in the Frontier preview programme and is not part of the current generally available (GA) licence.

Every agent in your organisation gets registered and controlled centrally through the Agent Registry. You can see which agents exist, what they're allowed to access, and what they're actually doing. If an agent misbehaves or someone deploys one without approval, you can shut it down.

Whether you built your agent with Copilot Studio, Microsoft Foundry, the M365 Agents Toolkit, Agent Framework, Agent 365 Software Development Kit (SDK), or an open-source framework, Agent 365 is where you register and manage it.

The Problem Agent 365 Solves

Before Agent 365, Microsoft's security stack had a blind spot. Entra ID manages human identities, Conditional Access controls what human users can do based on device, location, and risk level, Purview tracks what data human users touch, and Defender watches for threats targeting human-driven workflows. None of these tools was designed for non-human actors.

Once AI agents start acting on behalf of users, those controls stop working. You cannot apply a Conditional Access policy to a process that has no device, location, or session. You have limited visibility into what data an agent reads or modifies during a multi-step task. There is no built-in audit trail for autonomous actions. If an agent sends an email, updates a record, or accesses a confidential document, existing compliance tools may not capture these activities in a way that satisfies regulatory requirements.

The governance gap is not theoretical. A KPMG AI Quarterly Pulse Survey (September 2025, 130 US C-suite and business leaders at organisations with $1 billion or more in revenue), cited by Microsoft on the Entra Agent ID product page, found that 42% of organisations surveyed have deployed at least some agents, 76% of leaders expect employees to manage agents within two to three years, and 78% are concerned about cybersecurity for agents.

Agent 365 governs agents but does not build or run them. Building and execution require separate tools (Copilot Studio, Microsoft Foundry) with their own consumption costs.

Agent 365 extends Entra, Purview, and Defender to treat agents as first-class identities alongside humans.

Pricing: $15 Per User Per Month

Agent 365 is available as a standalone product at $15 per user per month, generally available since 1 May 2026 through Enterprise Agreement (EA), Enterprise Agreement Subscription (EAS), Microsoft Customer Agreement for Enterprise (MCA-E), and Cloud Solution Provider (CSP). You do not need Microsoft 365 E7 to use it, but you do need a qualifying base licence: the June 2026 Product Terms (source) require Microsoft 365 E5, Microsoft Defender + Purview Suite FLW, or M365 Business Premium as a prerequisite.

It is also included in the Microsoft 365 E7 bundle at $99 per user per month, alongside M365 E5 ($60 effective July 2026), Microsoft 365 Copilot ($30), and Entra Suite ($12). Buying these separately would cost $117, so the bundle saves up to 15%.

🖐 Need help navigating Microsoft licensing for your enterprise? Learn more: Microsoft Licensing Services for Enterprises.

Sources: component prices from Microsoft 365 pricing blog, Entra pricing, Agent 365 announcement

A note on the 15% claim. Microsoft uses $12 for Entra Suite in this calculation, which is the published add-on price for Entra ID P1 customers. However, E5 includes Entra ID P2, and Microsoft's pricing page states that "special pricing is available for Microsoft Entra ID P2 and Microsoft 365 E5 customers". The discounted amount is not published. Since E7 is built on E5, the actual savings for the target customer may be lower than 15%.

What Agent 365 Provides

Observability

The Agent Registry is the central inventory. It shows every agent deployed across the organisation: who built it, what framework it uses, what data it can access, and how actively it runs. An agent map visualises relationships between agents, the users they serve, and the resources they interact with. Behaviour and performance reports provide role-specific oversight. A compliance officer sees different signals than a security analyst or an IT administrator.

Risk signals from Defender, Entra, and Purview flow into the registry, so a flagged agent appears in a single place rather than requiring manual correlation across three separate consoles. Security policy templates, starting with Entra, let administrators apply baseline governance rules to new agents without having to configure each one from scratch.

Identity and governance

Entra Agent ID (included in Agent 365) extends the Entra directory (previously Azure Active Directory, Azure AD) to cover agents alongside human user accounts. The identity documentation describes two authentication flows. The On-Behalf-Of (OBO) flow lets an agent receive a user's delegated token and act with that user's permissions. The agent identity flow lets an agent authenticate with its own credentials and operate with its own access. Both flows are covered by the GA per-user licence. Both flows enable enrolling agents in Identity Protection (risk-based sign-in policies, anomaly detection) and Conditional Access (scoped permissions based on context).

Identity Governance extends lifecycle management to agents. Access packages (bundles of permissions that can be requested, approved, and time-limited) now apply to agents as well as humans. An agent that needs access to a SharePoint site for a specific project can receive a scoped, time-limited grant that automatically expires. The same approval workflows that govern human access requests can also gate agent permissions.

Compliance and security

On the Purview side, Agent 365 extends several capabilities to agent activity:

• Data Security Posture Management: visibility into what sensitive data agents can access

• Information Protection: agents inherit sensitivity labels, so a document marked "Confidential" retains that classification when an agent processes it

• Inline Data Loss Prevention (DLP): DLP policies apply to Copilot Studio agent prompts, blocking agents from leaking sensitive data through their interactions

• Insider Risk Management: agent behaviour patterns feed into the same insider risk signals used for human users

• Data Lifecycle Management: retention and deletion policies apply to agent-generated content

• Audit and eDiscovery: agent actions are captured in the compliance audit log and are searchable through eDiscovery, which matters for regulated industries where every action on certain data must be traceable

• Communication Compliance: agent interactions (what an agent says to users, what it writes in documents) can be monitored for policy violations

• EU Data Boundary: as of the June 2026 Product Terms, Agent 365 is included in the EU Data Boundary Services table. For customers configured for the EU Data Boundary, inclusion in that table means core agent data processing stays within the boundary, subject to the standard exclusions (support, security, directory data, network transit) that apply to all EU Data Boundary services

On the Defender side, purpose-built detection covers prompt manipulation (attempts to trick an agent into ignoring its instructions), model tampering (interference with the underlying AI model), and agent-based attack chains (where a compromised agent is used as a stepping stone to access other resources).

What remains in preview

Agent 365 reached GA on 1 May 2026, and the SDK is now generally available. However, several areas remain in preview. Autonomous agent identities, the "agent user" model where agents get their own mailbox, OneDrive, and org chart presence, are still in the Frontier preview programme. On the security side, security posture management for Foundry and Copilot Studio agents and Defender runtime threat protection remain in public preview as of 9 June 2026. Registry sync for automatic discovery of third-party cloud agents (Google Vertex AI, Amazon Bedrock) is also in preview.

From 1 July 2026, agent security capabilities previously in Defender for Cloud (Foundry agents) and Defender for Cloud Apps (Copilot Studio agents) transition to the Agent 365 licence. Agent protection in Defender will be powered by Agent 365 observability logs and the M365 agent registry, and Azure portal Foundry agent experiences are migrating to the Defender portal. Organisations using Foundry or Copilot Studio to build agents will need Agent 365 licensing for the security layer, not just for governance.

Not Every Agent Needs Agent 365

All Microsoft Cloud subscription customers receive foundational Agent 365 capabilities at no additional cost: agent identity, inventory visibility, basic usage insights, and core admin governance. The premium plan ($15/user/month standalone, or included in E7) adds advanced analytics, governance policies, security posture management, threat detection, and data security controls.

The licensing FAQ states that an Agent 365 licence is required for users who interact with, manage, or sponsor agents that use premium capabilities. If unlicensed users benefit from those capabilities, the organisation may be out of compliance. Microsoft acknowledges that this guidance is difficult to operationalise today, as visibility into user-level agent interactions is still limited.

In practice, casual agents built by individual users in Copilot Chat or Teams are unlikely to trigger premium capabilities. But from 1 July 2026, Foundry and Copilot Studio agent security capabilities move from Defender for Cloud and Defender for Cloud Apps to Agent 365, which means organisations building agents in Foundry or Copilot Studio will need Agent 365 licensing for the security layer regardless of whether they need the governance features.

An organisation might have thousands of lightweight personal agents (a sales rep's email summariser, a manager's meeting prep assistant) but only dozens that genuinely need governed identities, compliance audit trails, and DLP enforcement. The premium Agent 365 licence applies to the latter group.

The precedent is Managed Environments for Power Platform, where Microsoft created a licensing boundary between simple apps and governed apps that required Power Apps Premium. With Power Platform, the boundary was defined by whether the app ran in a managed environment. For Agent 365, Microsoft has not yet drawn an equivalent bright line.

The Hybrid Cost Model

Agent 365 follows a hybrid model combining per-seat licensing with consumption-based costs. $15 per user per month (or $99 in E7) is not the full cost of running AI agents.

Layer 1: Per-seat (governance and security)

Agent 365 covers the governance layer for agents: registration, identity, security, compliance, and observability. It does not build or run them.

Layer 2: Consumption (building and execution)

To build and run agents beyond the zero-rated usage included with a Microsoft 365 Copilot licence, organisations need Copilot Studio (pricing), Microsoft Foundry, or both. Both carry their own costs.

Sources: Copilot Studio billing and licensing, Copilot Credit Pre-Purchase Plan

Credits in capacity packs expire monthly, while annual P3 credits expire annually, which is better for planning but still use-it-or-lose-it since neither rolls over.

🖐 Planning a Microsoft Enterprise Agreement negotiation? We provide independent support. Learn more: Microsoft Enterprise Agreement Negotiation.

Nicole Dezen's partner blog frames the E7 bundle as a sales motion: "Together, Microsoft 365 E7 and Agent Factory provide a clear path to move customers from early adoption to durable Frontier transformation". E7 and Agent Factory are two separate purchases.

A third consumption vector is Windows 365 for Agents, now generally available. It provides Entra-joined, Intune-managed Cloud PCs for AI agent workloads, designed for UI-driven automation of legacy applications that lack APIs. Agents check out Cloud PCs on demand and release them when done. It is metered as a First-Party Consumption Service per the Product Terms and listed as a Copilot Studio add-on. Windows 365 for Agents is not included in Agent 365 and must be purchased separately.

Two control planes, two bills

The same agent can sit under two separate control planes, billed under different models and managed by different teams.

Agent 365 (per-seat, on the M365 invoice) handles the IT administration side: identity, governance, compliance, and security through the Microsoft Admin Centre. The governance side is the domain of IT administrators, compliance officers, and security teams. They see the agent in the Agent Registry, manage its Entra identity, monitor its Purview compliance signals, and respond to Defender alerts.

Azure AI Foundry (consumption-based, on the Azure invoice) handles the developer side: building, testing, deploying, and running agents. The execution side is the domain of developers and platform engineers. They manage the agent's code, model configuration, API integrations, and compute resources.

Both control planes apply to the same agent simultaneously, and the boundary between them is shifting. From 1 July 2026, Foundry agent security moves from the Azure side (Defender for Cloud) to the M365 side (Agent 365). An organisation deploying agents at scale would see Agent 365 costs on their M365 invoice and Foundry execution costs on their Azure invoice, managed by different teams, under different budget lines, with different cost dynamics. The governance team sees a predictable per-seat cost while the engineering team sees a variable consumption bill, and neither has full visibility into the other's spend without deliberate cross-team coordination.

The same agent appears on two separate invoices: Agent 365 governance on the M365 bill (per-seat) and execution costs on the Azure bill (consumption). Budget owners on each side may not see the other's spend.

The two-invoice split also applies between Power BI Pro (per-seat, M365) and Fabric (consumption, Azure), or between Purview in E5 (per-seat) and Purview extended scanning (consumption). For AI agents, Microsoft offers per-agent cost estimators but no formal end-to-end TCO model, so neither team can forecast the combined cost without building their own model.

Zero-rated agent usage

Microsoft 365 Copilot (included in E7 at $30) provides a limited zero-cost agent capability. Copilot Studio lite for internal agents allows zero-rated agent usage within Copilot Chat, Teams, and SharePoint for classic answers, generative answers, and Microsoft Graph tenant grounding. Publishing to external channels or using premium connectors requires a standalone Copilot Studio subscription or pay-as-you-go Azure billing.

🖐 Need help optimising your Microsoft 365 investment? Learn more: Microsoft 365 Planning and Optimisation.

The Copilot Studio licensing page and a separate licensing guide PDF document these boundaries, but the full picture is spread across multiple documents and references "fair usage limits" for employee-facing scenarios without specifying numbers.

What the Licence Covers and What It Doesn't

Third-Party and Open-Source Agent Support

Agent 365 extends governance to agents built with third-party and open-source frameworks, not just Microsoft's own tools. The Agent 365 SDK is generally available as a free, framework-agnostic package with published integrations for LangChain, OpenAI Agents SDK, Claude Code SDK, Microsoft Agents SDK, and Microsoft Agent Framework. Over 20 launch partners (including Zendesk, Box, Figma, and n8n) offer ready-to-deploy agents or agent factories that plug into the Agent Registry.

The SDK provides Entra-backed identity for any-framework agents, OpenTelemetry-based observability that flows into Purview, and governed MCP tool access. The Agent Registry supports automatic discovery of agents running on Google Vertex AI and Amazon Bedrock with no code changes (registry sync is currently in preview). Entra Agent ID configuration for third-party agents is now documented.

What We Still Don't Know

As of 9 June 2026:

• Education, government, and nonprofit pricing. No Agent 365 or E7 variants have been announced for these sectors.

• Consumption cost guidance. Microsoft now offers an Agent Usage Estimator and a Copilot Agents Cost Calculator for modelling per-agent credit consumption, but has published no formal end-to-end TCO model for the combined governance-plus-consumption stack. Organisations can estimate individual agent costs but not the full deployment picture.

• Zero-rated usage in practice. Copilot Studio lite boundaries are now partially documented, but "fair usage limits" for employee-facing scenarios lack specific numbers.

• The licensing boundary. The free foundational plan and paid premium plan exist, but what precisely triggers the requirement for paid Agent 365 governance versus what the free plan covers is still principle-based, not prescriptive.

• Agent user licensing. The GA per-user model covers both delegated and own-access agents. The Frontier preview for agent user identities (own mailbox, OneDrive, org chart) uses per-agent-instance licensing during preview. How Microsoft will price agent users when they reach GA is undetermined.

• Frontier preview timeline. The SDK has reached GA, but agent user identities have no published GA date and are still in Frontier preview.

Our View on Discounting

Microsoft is already discounting E7. CSP promotional discounts for Microsoft 365 E7 are published: 10% off annual at 10 to 9,999 seats, 15% off annual at 100 to 9,999 seats, and 15% off triennial at 300 to 9,999 seats, all through 31 December 2026. No standalone Agent 365 promotional pricing has been published, but Copilot went through the same cycle. Microsoft ran 15% and 20% and even 30% promotional discounts throughout 2025 and 2026 without meaningfully moving adoption numbers. By the Q3 FY2026 earnings call (April 2026), Copilot had reached over 20 million paid seats, up from 15 million in Q2 (source), still under 5% penetration among over 450 million M365 commercial seats.

The $15 per-seat price is a governance floor, not the full cost of deploying AI agents. Microsoft now offers per-agent cost estimators, but no end-to-end TCO model for the combined governance-plus-consumption stack. If you need help modelling the real cost, get in touch. We don't sell Microsoft licences or cloud services, so our advice is independent.