Microsoft Agent 365: License, Agent Registry, and the Agent 365 SDK

Microsoft puts it in one sentence: Agent 365 "provides the ability to observe, govern, and secure the growing number of agents within organizations." Those three words are not marketing shorthand. They are the actual product structure, and each one maps to a different set of Microsoft tooling.

The thing to take from that table is that Agent 365 is not a new console you log into. It is a workload inside the Microsoft 365 admin center that pulls signals from Entra, Purview and Defender and puts them behind one view of your agents. Microsoft calls the Agent workload "the grounding control plane for all agents managed at your organization."

Availability and the E5 question

Microsoft states that "As of May 1, 2026, Microsoft Agent 365 is generally available for the Commercial segment on a per user basis." On prerequisites, the Learn documentation is deliberately soft: "Microsoft Agent 365 works best when using Microsoft E5 as a pre-requisite. At least one user must be licensed with a qualifying Microsoft Agent 365 license to enable Agent 365."

That wording matters, because licensing specialists reading the commercial terms describe something firmer: a standalone Agent 365 purchase requires Microsoft 365 E5, Microsoft Defender and Purview Suite Frontline Worker, or Microsoft 365 Business Premium as a base. If you are on E3 and planning a standalone Agent 365 buy, that is the gap to raise with your licensing partner before you budget, because "works best with" and "requires" are very different numbers when E5 lists at $60 a seat.

Yes and no, and the split is the single most useful thing on this page. There are two gates, they sit in different products, and buyers routinely think there is only one.

Gate one: seeing your agents is free

Microsoft answers this directly in the Entra documentation: "Viewing all agents in the Microsoft 365 admin center doesn't require a specific license. Administrators only need the appropriate role, such as AI Reader (recommended least-privilege role) or AI Administrator, to access the inventory view."

So the discovery step, finding out how many agents are actually running in your tenant and who owns them, costs nothing. Any organization worried about shadow agents can answer that question this afternoon without a purchase order.

Gate two: doing anything about them is licensed

Enforcement is what you buy. Microsoft notes that "Applying security and governance controls for agents, such as Conditional Access or identity governance policies, requires the appropriate licensing for Microsoft Entra Agent ID," and the Agent 365 license covers the control plane on top of that: advanced analytics, governance policies, security posture management, threat detection and data security controls.

It is per user, not per agent

This is where budgets go wrong in both directions. A single user license covers all agents that person interacts with, manages, owns or sponsors, whether the agent acts on their behalf or operates with its own access. Forty agents built by six people is a six-license question, not a forty-license one.

What the license does not include

Agent 365 governs agents. It does not build them, host them or pay for their inference. Budget these separately:

• Agent building and execution capacity, which meters through Copilot Credits or pay as you go. The rate card is worked through in Copilot Studio pricing.
• Microsoft Foundry capacity for agents built there.
• Windows 365 for Agents, which is its own purchase at $0.40 per Cloud PC hour plus a monthly fee.
• Microsoft 365 Copilot seats at $30 a user a month, if you want work-data agents rather than web-data ones. The full seat arithmetic is in our Microsoft 365 Copilot pricing and license cost breakdown.

Add those up and the governance line is often the smallest number in the stack, which is a useful thing to know before a $15 figure sets an expectation for the whole program.

This is the capability that makes Agent 365 interesting rather than merely administrative, and it moved recently. The Connected platforms page in the Microsoft 365 admin center lets an admin authenticate to an outside AI platform once and pull those agents into the same registry as the Microsoft ones. Microsoft's documentation for it was last revised on August 10, 2026, and it now lists six providers.

Two practical notes that are easy to miss. First, the connection is not read-only by default: the permission sets Microsoft documents for Bedrock and Vertex include DeleteAgent and reasoningEngines.delete, because the registry supports management actions and not just discovery. For Oracle, Microsoft actually documents a least-privilege option that restricts management to delete operations only, and recommends it. Read what you are granting before you paste a key, and see Agent 365 and non-Microsoft agents for what each connection does and does not reach.

Second, sync is manual today. After a connection validates, an admin triggers it with the Sync agents button, and Microsoft says you will be able to "configure future synchronizations to occur on a scheduled basis, in a future release." So the registry is as current as the last time somebody pressed the button.

Microsoft also reminds you that your use of these outside products stays subject to each provider's terms of use, and that you are responsible for complying with them. Connecting Bedrock to your Microsoft tenant does not move that obligation.

The registry classifies agents by how they were built, and the type decides what data and tools information Agent 365 can show you. Microsoft documents ten.

If you are choosing between the two easiest build paths, our comparison of Copilot Studio vs Agent Builder covers which one your workload belongs in and what each costs to license.

What the Agent 365 SDK actually adds

The tenth row is the one worth understanding, because it is the only type that describes something you do to an agent rather than a place you built it. Microsoft's definition: an agent extended using the Microsoft Agent 365 SDK becomes an "agent instance," and "Once extended, an agent instance has Entra-backed agent identity, enhanced notification capabilities, extended observability, covered MCP tooling, and an IT-approved template system."

Unpack that and it is five distinct things:

1. Entra-backed agent identity. The agent gets a first-class identity in Microsoft Entra Agent ID, so Conditional Access and identity governance apply to it the way they apply to a person.
2. Enhanced notification capabilities. The agent can reach people through Microsoft surfaces rather than only responding when spoken to.
3. Extended observability. Its activity shows up in the registry telemetry instead of being a black box.
4. Covered MCP tooling. Model Context Protocol tool calls fall inside the governance boundary rather than outside it.
5. An IT-approved template system. Makers start from shapes IT has already sanctioned.

The strategic read: the SDK is how an agent you built somewhere else, or bought from somebody else, becomes a governed citizen of your Microsoft tenant without a rebuild. That is a meaningfully different proposition from "build everything in Copilot Studio," and it is why the registry sync list above matters.

Roles here are stricter than most admin surfaces, and the distinction between watching and acting is enforced. Microsoft is blunt about it: "Important governance actions such as approving agent requests or assigning ownership can only be performed by users in the AI Administrator or Global Administrator roles. Other roles can monitor governance gaps but can't take administrative action."

Microsoft also warns that viewing the Agent overview "doesn't grant permission to install, modify, or manage agents," so an executive dashboard user is genuinely read-only. If your security team wants eyes on agent sprawl without touching production, AI Reader is the whole answer and it does not need a license.

Which portal for which job

Agent visibility used to be split across Microsoft Entra and the Microsoft 365 admin center, and Microsoft has been consolidating it. In its words: "Microsoft is converging these registry experiences under Agent 365," so that "Agent 365 becomes the unified registry and control plane for agents" while "Microsoft Entra continues to provide the identity foundation through Agent ID."

The consequence is a subtle inventory difference worth knowing. The Entra admin center shows only agents that have a Microsoft Entra Agent ID. The comprehensive inventory, including agents with no Entra identity at all, is available only in Agent 365. If you are auditing for shadow agents, the Entra list is the wrong list.

Every evaluation deserves the limits alongside the capabilities, and Microsoft documents these plainly enough that there is no excuse for being surprised by them in month two.

• The metrics do not backfill. Microsoft repeats this for active users, agent run-time and trending agents: "This metric begins when your organization activates Agent 365 licenses." Immediately after activation you see fewer than 30 days of data, and it fills in from there. There is no retroactive view of last quarter.
• Draft agents are mostly invisible. "Currently, you can only view draft agents from Copilot Studio. Support for draft agents from other platforms, such Agent Builder, Foundry, and SharePoint, aren't currently available." Half-finished agents on three of the four main Microsoft build paths do not appear.
• Foundry analytics cover V2 only. Microsoft notes that analytics currently support Microsoft Foundry V2 agents. Older Foundry agents are counted differently.
• The overview card truncates. The platform breakdown on the Agent overview shows only the top five most-used platforms to fit the card. The full list is on the Registry tab.
• Registry sync is manual. Scheduled synchronization is described as a future release, so outside platforms are only as current as the last manual sync.
• Numbers will not tie out exactly. Microsoft says metrics come from several systems and "Minor variances may occur due to differences in ingestion timing, update frequency, and system-specific processing." Do not build a chargeback model on the assumption that the registry count and the analytics count match to the unit.

When Agent 365 is the wrong tool

Agent 365 solves a specific problem: a large organization with agents appearing faster than IT can track them, and a compliance obligation to know what they touch. It is an excellent answer to that problem. It is a poor answer to three others.

1. You have three agents, not three hundred. The control plane, the E5 prerequisite and the annual commitment are overhead a small team pays for governance it does not yet need.
2. You need the agent, not the governance. Agent 365 does not give you a working agent. It gives you a registry entry for one you already have.
3. Your work is not Microsoft-shaped. Agents reasoning over Microsoft Graph are what this stack is built around. Specialist extraction, vertical workflows and anything with its own data model usually needs a purpose-built tool.

If what you actually want is an agent doing useful work this week, that is a different purchase. On Agentmarketplace you browse ready-made agents by category, see the integrations and permissions each one needs before you commit, and deploy without an E5 prerequisite or an admin approval queue. For how the vendor catalogs compare, see AI agent marketplaces; for what Microsoft's own catalog carries, see Microsoft Agent Store; and for the full Microsoft licensing picture, AI agents for Microsoft 365.