Agent 365: what it governs and who actually needs it

Most organisations can name every server they run and every SaaS product they pay for. Very few can name every AI agent operating inside their tenant. Copilot Studio makes agents buildable by business users, Microsoft Foundry makes them buildable by developers, and SaaS vendors now ship their own agents into customer environments. The gap between how fast agents appear and how slowly inventory catches up is exactly the gap Microsoft built Agent 365 to close.

Agent 365 reached general availability on 1 May 2026 at US$15 per user per month. Microsoft calls it the control plane for AI agents, and the scale claims around its launch were striking: tens of millions of agents registered during the preview period, and Microsoft reporting visibility into more than 500,000 agents inside its own tenant as its first customer. This guide covers what the product actually governs, the licensing prerequisite that took effect on 1 June 2026, and a practical answer to the question most IT leaders are really asking: at what point does this beat the Entra and Purview controls we already own?

What Agent 365 actually is

That framing is the key design decision. Rather than inventing a parallel management stack for agents, Agent 365 extends the tools already governing human users. Its main working parts:

• An agent registry: a unified inventory of every agent operating in the organisation, covering agents from Microsoft platforms, agents from partner platforms integrated through the Agent 365 SDK, and synced or self-registered agents from platforms Agent 365 does not directly manage.
• Identity through Microsoft Entra: agents receive their own governed identities (Entra Agent ID), so an agent's actions are attributable to a named principal in the directory rather than a shared service account.
• Data security through Microsoft Purview: sensitivity labels, data loss prevention and compliance controls apply to what agents touch, not only to what people touch.
• Threat protection through Microsoft Defender: agent-level risk signals surface alongside the rest of the security estate.
• Operations through the Microsoft 365 admin centre: risk flags and management for agents live where admins already work, with a unified view of risky agents drawing on Defender, Entra and Purview signals.

The registry deserves emphasis because it covers non-Microsoft agents. An organisation running agents built in third-party platforms alongside Copilot Studio agents can bring them under one inventory and one set of risk flags. That is the part no combination of individual Microsoft security products delivers on its own today.

The licensing prerequisite that took effect in June

From 1 June 2026, new Agent 365 purchases require one of the following base licences: Microsoft 365 E5, A5 or Business Premium, or the Microsoft Defender suite together with the Microsoft Purview suite (education and frontline variants exist). Microsoft's stated reasoning is that Agent 365's core functionality depends on the security, identity, compliance and management foundations those licences provide, which is consistent with how the product works: it orchestrates Entra, Defender and Purview rather than replacing them.

Two practical consequences. First, an organisation on Microsoft 365 E3, even with Copilot deployed, cannot add Agent 365 without stepping up its base licensing. Second, Business Premium qualifies, which keeps the door open for Australian small and mid-sized organisations without an E5 budget. Microsoft 365 E7 customers are unaffected, since E7 includes E5, Agent 365, Microsoft 365 Copilot and Entra Suite in one bundle.

Note the pricing model while budgeting: Agent 365 is priced per user, not per agent. The bill scales with licensed headcount, not with how many agents the organisation runs.

When Entra and Purview alone are still enough

There is no magic agent count at which Agent 365 switches from optional to necessary, and any vendor or partner quoting one is guessing. What holds up in practice is a set of indicators. Entra and Purview alone are a defensible position while all of the following remain true:

• Agents are interactive assistants rather than autonomous actors: they respond to prompts inside a session instead of running unattended with their own credentials.
• One team builds them, in one platform, and a current list of every agent could be produced from that platform's own admin view in an afternoon.
• Agents touch a bounded data scope that existing Purview DLP policies and sensitivity labels already cover.
• No third-party or vendor-shipped agents operate against tenant data.

The indicators that tip the decision

Frontrow's working test is that any two of the following justify pricing Agent 365 seriously, and any three make the case hard to argue against:

1. 1Agents now act autonomously: they run scheduled or always-on workloads, hold their own identities, and take actions no human reviews in real time. Microsoft's own Autopilot category, beginning with Scout, is built on this pattern and assumes Agent 365-style governance around it.
2. 2More than one platform produces agents: Copilot Studio plus Foundry, or either plus a SaaS vendor's agents. Per-platform admin views stop adding up to an inventory.
3. 3Nobody can answer 'how many agents do we have and what can each one reach?' from a single pane. If assembling the answer takes a week, discovery is the problem Agent 365 solves first.
4. 4Agents touch regulated or high-sensitivity data: financial records, health information, or anything within scope of APRA or Privacy Act obligations, where attributable identity and auditable agent actions stop being nice-to-have.
5. 5Offboarding has no agent equivalent: when a staff member leaves, their accounts get disabled, but nobody disables or reassigns the agents they built. Orphaned agents are this decade's orphaned service accounts.

The cost lens matters too. At US$15 per user per month across a whole licensed workforce, Agent 365 is not an impulse purchase, and for an organisation with a dozen interactive Copilot Studio agents it is genuinely premature. The honest comparison is against the internal cost of building agent inventory, identity hygiene and action audit manually across Entra, Defender and Purview: workable for a small, static agent estate, and increasingly not workable once agents multiply across platforms and teams.