Microsoft Agent 365

What it is

Microsoft Agent 365 is the control plane for AI agents inside a Microsoft tenant. It holds a registry of every agent in the org, gives each one an identity through Entra Agent ID, maps what those agents connect to, and provides the hooks that let Conditional Access, Purview and Defender apply to software that acts on its own the way they already apply to employees. It reached general availability on 1 May 2026, and on the same date Microsoft retired the standalone Entra Agent Registry blade in the Entra admin center and folded it in — one control plane, not two.

The correction to make before anything else: Agent 365 does not build agents and does not run them. Copilot Studio and Microsoft Foundry build. Agent 365 governs what got built. Buying it because you want agents is the most expensive misread in this category, because the licence you actually needed was the base suite underneath it.

Why ops teams end up here

The trigger is rarely a security mandate. It is the moment someone asks how many agents can write to the CRM, the ATS or the contract repository, and nobody in the room can answer. Agents arrive one department at a time — a RevOps lead builds a routing agent, a recruiter wires a screening flow, legal ops stands up an intake triage — and each one authenticates as the person who built it. There is no list, no owner column, and no audit subject distinct from the human whose token it borrowed.

Agent 365 answers that question with an inventory. The registry covers Microsoft-built agents, agents built in Copilot Studio and Foundry, partner agents shipped pre-configured for it (Genspark, Zensai, Egnyte, Zendesk at launch), and agents from the agent factories on the launch list — Kasisto, Kore and n8n. Agents built on n8n are provisioned an Entra Agent ID automatically and appear in the admin center without identity work of your own, which is the cheapest path from a working automation to a governed one.

Pricing reality

• $15.00 per user per month, standalone, paid yearly.
• Bundled into Microsoft 365 E7 at $99/user/month — the Frontier Suite launched 1 May 2026 that packages E5, Copilot and Agent 365.
• Not included in E5. The June 2026 Product Terms require Microsoft 365 E5, Microsoft 365 Business Premium, or the Defender + Purview Suite Frontline Worker combination as a prerequisite.

The $15 is an add-on, not an entry price, and the real band depends entirely on what you already own:

• Already an E5 shop, 200 seats: $15 × 200 = $36,000/year on top of what you pay now.
• Business Premium shop, 200 seats: $22 + $15 = $37/user/month, or $88,800/year all-in.
• Not on a qualifying base at all, 200 seats: E5 at $60 plus $15 = $75/user/month, $180,000/year. At that point you are buying a security suite and getting agent governance with it, and you should evaluate the purchase on the suite.

The unit is what most budgets get wrong. Agent 365 is licensed per human user, not per agent — one licence covers every agent that person manages, sponsors, owns or is served by. Your fortieth agent is free. Your two hundred and first employee is $15 a month. Cost scales with headcount while risk scales with agent count, and only one of those two curves shows up on the invoice.

Execution is a second invoice. Building and running agents bills through Copilot Studio (capacity packs at $200/month per 25,000 credits, or $0.01/credit pay-as-you-go) or Microsoft Foundry on the Azure bill, and Windows 365 for Agents — the managed environment agents can work inside — is $0.40 per VM-hour pay-as-you-go, US only, in preview.

Best for

An IT or ops leader in a Microsoft-first enterprise already licensed at E5 or Business Premium, who needs to produce an owner-attributed inventory of every agent with write access to a system of record, and needs Conditional Access and Purview policy to apply to those agents rather than to the humans they impersonate. The scoped case where it wins outright: an ops org that has agents running in Copilot Studio, Teams and n8n, and a compliance review coming that asks who authorized each one.

Not for

A team of 5-30 running two or three agents on n8n or a workflow builder, with no Microsoft suite underneath. The prerequisite chain costs more than the agents do, and the same control — an owner per agent, an approval gate on writes, an execution log — comes from the AI agent ops stack at a fraction of the licence. It is also the wrong purchase if the agents that matter are Claude or ChatGPT sessions driven by a human: those are not on the partner list, do not land in the registry, and are governed in their own admin consoles or not at all.

Versus the alternatives

• Okta for AI Agents — generally available 30 April 2026, with an agent registry, short-lived credentials in place of static API keys, agent-activity system logs that ship to your SIEM, and Cross App Access (XAA), an open protocol for agents crossing app boundaries. Pick Okta when identity is already Okta-first and the agents that matter act across non-Microsoft SaaS. Microsoft’s control plane is strongest exactly where your tenant is, and thinnest everywhere else.
• Salesforce Agentforce — pick it when the agents worth governing live in Salesforce and act on Salesforce data. Governance that sits next to the record is easier to prove than governance that federates to it, and a Salesforce-centric revenue org will get further with the native controls than with a registry entry in another vendor’s admin center.
• Token Security and the independent non-human-identity platforms — pick these when the real problem is credential sprawl (service accounts, API keys, OAuth grants) rather than a roster of enterprise-sanctioned agents. Read the segment before you sign: Cisco acquired Astrix in May 2026, SailPoint closed Entro on 29 June 2026, and Cyera signed an LOI for Oasis on 28 July 2026. The independents are the shrinking half of this market.

Watch-outs

• The interesting scenarios are still in preview. Autonomous and non-OBO agents — agents acting with their own access rather than on behalf of a signed-in user — remain in public preview and carry no charge until GA. That covers most of what an ops team wants to deploy unattended. Guard: write the compliance narrative against GA capabilities only, and treat preview coverage as an accelerator you would still ship without. Re-check the preview list before any audit date you commit to.
• Per-user pricing hides agent sprawl. Nothing on the invoice moves when the count goes from 12 agents to 60, so no budget signal ever fires. Guard: review the registry monthly against a named-owner list and retire anything with no owner. Make the review a calendar item with a person on it, not a policy sentence.
• The prerequisite chain is the actual quote. A quote for “$15 a user” is accurate and incomplete; Conditional Access for agents needs M365 E3 as a floor, Identity Protection for agents needs E5, and threat hunting needs a separate Defender for Cloud Apps licence. Guard: before approving, price the full chain — base suite plus add-on plus the security SKUs behind the specific controls you are promising — and get the control-to-SKU mapping in writing from the reseller.
• The portal has no export history and no snapshot diffing. You can see the registry as it is today; showing an auditor how it changed over a quarter is your problem. Guard: pull the registry through the Graph API on a monthly schedule into your own store from day one. The first time you need the diff is the first time you cannot reconstruct it.

Related: the enterprise AI rollout stack builds on Agent 365 as its control plane and prices the surrounding layers.