Agent Governance Is the New Application Governance

For years, IT administrators focused on managing application sprawl: which apps could access the tenant, who approved them, and what permissions they held. That mental model still applies, but it no longer covers enough ground. Agents have entered the picture, and they bring a significantly more complex set of questions with them.

The shift matters because agents are not just applications. They carry identity questions (who created it, who can use it, what permissions it holds), data access questions (what can it retrieve, transform, or pass to another system), lifecycle questions (who owns it, what happens when the creator leaves), and security questions (prompt injection, risky connectors, privilege mismatches). An application with an OAuth grant is a known quantity; an agent that reasons over your data and takes actions on a user’s behalf is not. Wrap all of that together, and agent governance becomes one of the more demanding management challenges organizations face right now.

What Microsoft Agent 365 Gives You Today

Microsoft Agent 365 is Microsoft’s attempt to provide a unified control plane for this problem. It went generally available on May 1, 2026, is licensed per user, and Microsoft is candid that it works best sitting on top of Microsoft 365 E5. It is also a headline component of the new Microsoft 365 E7 bundle, which we broke down when it was announced. The pitch is organized around three pillars: observe, govern, and secure. Observation lives in the agent registry in the Microsoft 365 admin center, governance spans the registry plus Microsoft Entra and Microsoft Purview, and security extends Microsoft Defender’s threat detection to agents. Agents built with Microsoft Foundry, Copilot Studio, and Agent Builder in Microsoft 365 Copilot integrate automatically; everything else takes more work, which we will get to.

Opening the agent registry without any special configuration often surfaces a surprisingly large number of agents, including Microsoft first-party agents, Dynamics 365 agents, custom agents built in Copilot Studio, and registered third-party agents from platforms like Canva, Miro, Databricks, and HubSpot. The registry shows each agent’s platform origin, active user count, session volume, and a risk rating based on Microsoft’s criteria.

Sorting that list by active users or session count is a fast way to identify agents that have gained traction without formal approval. An unfamiliar project management agent sitting at the top of the usage list is exactly the kind of signal worth investigating before it becomes a data governance problem.

Drilling Into an Individual Agent

The registry list is triage; the agent details view is where the real evaluation happens. The details view shows when the agent was created, who published it, which channels it is available in (Teams, Outlook, Copilot), and any linked environments for Copilot Studio agents. That creator and publisher information matters more than it might seem: agents are frequently built by individual users rather than central IT, and knowing who owns what is the first step toward answering the lifecycle question of what happens when that person changes roles or leaves.

The users tab controls availability and installation, functioning similarly to the required versus available distinction in Microsoft Intune: administrators can pre-install an agent for a security group or simply make it discoverable for users who choose to add it themselves. If you have managed app deployment through Intune, the mental model transfers directly.

The permissions tab surfaces the Microsoft Graph scopes the agent holds, split between delegated and application permissions, and labels each by privilege level. That privilege column is genuinely useful for quick triage: a cluster of high-privilege scopes on an unrecognized third-party agent warrants closer attention than a low-privilege read scope on a vetted internal tool. This is the same discipline app governance always demanded, just applied to a category of software that acquires permissions much faster and with far less ceremony.

Where the Gaps Are

The picture is not complete. Agents created outside the Microsoft ecosystem require additional steps to appear in the registry. Registry sync, currently in preview, allows supported third-party platforms including Amazon Bedrock, Google Vertex AI, Salesforce Agentforce, and Databricks Genie to push their agents into Agent 365. But that sync requires deliberate configuration: you create a connection per platform, authenticate against that environment, and then trigger synchronization manually with a sync button. Scheduled synchronization is promised in a future release, but today an out-of-date connection means an out-of-date registry. Agents built without those hooks simply do not show up, though Microsoft does offer an Agent 365 SDK for wiring custom-built agents into the control plane.

The shadow AI detection feature, available to organizations enrolled in Microsoft’s Frontier program, adds visibility into agentic harnesses running outside sanctioned environments, such as local AI agents, MCP servers, and agentic CLIs installed directly on user devices. As desktop agents like Microsoft Scout and a wave of agentic CLIs move onto end-user machines, this category is only going to grow. Coverage is limited for now: during the preview it detects and blocks exactly one agent, OpenClaw, and only on managed Windows devices enrolled in Intune. Blocking works by generating an Intune policy that propagates to managed devices, which can take anywhere from fifteen minutes to eight hours depending on your Intune configuration. One supported agent is not a shadow AI program, but the direction is clear, and the architecture (detection plus Intune-enforced blocking) is the right shape for the problem.

Certification is another area worth treating with appropriate skepticism. The agent details view includes compliance attestations for HIPAA, SOC 2, and similar standards, but many of these are publisher self-assessments rather than independently verified audits. A checkmark next to a compliance framework tells you the publisher claims alignment; it does not tell you an auditor confirmed it. If an agent touches regulated data, treat those attestations as a starting point for your own due diligence, not a substitute for it.

Getting Ahead of It

If agents are already showing up in your tenant, and they almost certainly are, a few practical steps go a long way:

1. Open the registry and look. Before writing a single policy, see what is actually there. Sort by active users and session count, and flag anything unfamiliar with real usage behind it.
2. Triage by privilege, not by name. An agent with high-privilege application permissions deserves review regardless of how benign it looks. The permissions tab makes this a five-minute check per agent.
3. Answer the ownership question now. For every custom Copilot Studio agent with meaningful adoption, identify the owner and decide what happens to the agent if that person leaves. Orphaned agents are the new orphaned SharePoint sites, except they hold Graph permissions.
4. Configure registry sync for platforms you already use. If your organization builds agents in Bedrock, Vertex AI, Agentforce, or Databricks, connecting those environments is the difference between a registry and a partial inventory.
5. Write the intake process before you need it. Decide who approves new agents, what permission levels trigger extra review, and how compliance claims get validated. Doing this at twenty agents is far easier than doing it at two hundred.

Conclusion

Agent governance is following the same arc application governance did, just compressed into a much shorter timeline and with higher stakes, because agents do not just hold permissions, they act on them. Microsoft Agent 365 gives administrators a genuinely useful control plane for the Microsoft side of the house today, with visibility into third-party and shadow agents arriving in previews. The organizations that will handle this well are the ones treating it as a governance discipline now, not the ones who wait until an unapproved agent with high-privilege Graph scopes becomes an incident report. It is the same lesson we drew about data governance in the age of AI: AI amplifies whatever practices you already have in place. If you want help inventorying the agents already in your tenant, or building an agent governance strategy before the sprawl gets ahead of you, reach out and let’s talk.