Governance of Microsoft AI Agents: What Agent 365 Changes, and What Decisions Need to Be Made

As of May 1, 2026, Microsoft Agent 365 is generally available for the commercial market, billed per user. Microsoft Entra Agent ID is available as of the same date. Together, they elevate AI agents from mere tools to identified entities in the corporate directory, with a designated human manager, defined permissions, and a record of their actions. The change is not primarily technical: it creates an additional population to manage, and a decision must be made regarding who is responsible for it before it grows any larger.

The Benefits of General Availability

Microsoft describes Agent 365 as a control framework organized around three capabilities: monitoring agents in the environment, establishing safeguards for both agents and people, and securing their identities and access to resources.

The foundation is Microsoft Entra Agent ID. An agent receives the same identity-driven protections as a user or a workload: adaptive access policies, real-time risk detection, and lifecycle management. All agent authentication and activity are logged for compliance and audit purposes.

There is a distinction regarding the budget, and Microsoft makes it clear in writing: Agent ID is available to all Microsoft Entra customers, but extending the security features of Microsoft Entra to agents requires a Microsoft Agent 365 license. Your agents can therefore receive an identity without any additional purchase, while the associated controls require a license.

The human factor: a decision that is not technical

The most fundamental mechanism for management is neither a portal nor a setting—it is the sponsor. Microsoft defines the sponsor of an agent identity as the person responsible for decisions regarding the agent’s lifecycle and access. When this sponsor leaves the organization, responsibility is automatically transferred to his or her line manager.

This automatic transfer prevents an agent from becoming “orphaned” overnight, which is a significant benefit. It also places the burden of adjudicating the rights of an agent—whom the manager has never seen in action—on the desk of a manager who did not request it. An organization that allows this mechanism to run its course ends up with agents whose purpose no one understands anymore and whom no one dares to shut down.

The decision to be made can therefore be stated as follows: Which internal rule requires that an agent have a written statement of use, a declared scope of data, and a review date before it can exist?

How much it costs

Three pricing tiers published by Microsoft provide the framework for the decision.

Two clarifications change the calculation. The license is assigned to human users, not agents: it covers agents acting on behalf of a licensed user. And managing the agent identity lifecycle requires either Microsoft 365 E7 or an Agent 365 license associated with at least Microsoft Entra ID P1 or Microsoft 365 E3.

In terms of usage, Microsoft replaced the message-based billing system with Copilot Credits on September 1, 2025. Usage covered by a Microsoft 365 are still free of charge, subject to fair use; custom agents, however, consume credits that must be budgeted for.

Microsoft 365 E7 has been available for purchase through partners since May 1, 2026, which means you can now compare the two options with your reseller.

What's Already Available Without Having to Buy Anything

An organization that has not yet decided between Agent 365 and E7 is not without options. Several controls are already in place, and some have been for a long time.

The data policies of the Power Platform platform have been applied to all tenants since the beginning of 2025. They make it possible to require authentication, block certain knowledge sources, prohibit agents from using connectors, and block publishing to certain channels. A policy can apply to the entire tenant.

Managed environments also enable the consolidation of environments, the restriction of sharing, and the application of these strategies at scale.

Microsoft has finally published an agent governance document—version 3.2, effective May 2026—structured around three pillars—rules, processes, and people—and organized into three areas, providing a useful basis for discussion by an executive committee.

In practical terms, these three areas correspond to groups of environments with different rules. An agent that a person creates for their own work is not subject to the same rules as an agent that interacts with customers.

Two documented limitations to be aware of before committing

The block caused by data protection rules is not visible to the agent. Microsoft states that Microsoft Purview ’s data loss prevention applies to agents by specifically naming them in the policy, just as one would name a user. However, the agent is not aware of the blocking action, so it is up to the policy owner to actively monitor the policy in question. An agent that has been blocked from acting will therefore not trigger any alerts on its own.

Content produced by an agent does not inherit the confidentiality labels of its source. A document generated from classified items does not carry their classification. This is an issue that should be addressed in the internal policy, not in a setting.

Our Reading

Two opposing viewpoints are currently clashing on this issue, and neither of them seems defensible to us.

The first option is to purchase the monitoring plan immediately. An organization with four agents—all built by the same team—doesn’t have a governance issue but rather a list to maintain. A five-column table—name, owner, affected data, usage, review date—covers it entirely and costs nothing. Agent 365 becomes useful when that list no longer fits on a single page, or when agents start coming from multiple teams. Paying fifteen dollars per user to monitor four agents is like buying a monitoring tool before you have anything to monitor.

The second approach is to ban everything until the situation becomes clearer. This is the decision that seems prudent but ends up being the most expensive, because the departments with a genuine need won’t give up: they’ll resort to personal accounts and tools outside your scope. You will then have turned a governance issue—which can be addressed—into a visibility issue—which can no longer be addressed.

Our recommendation is to control access rather than usage. Decide who can create an agent, what information must be provided for it to exist, and how often it will be reviewed. These three rules can be summarized on a single page, apply without the need for an additional license, and will remain valid regardless of which tool you purchase in the future.

There is one less-than-ideal issue, however, that we’d be wise to address proactively. The automatic transfer of the sponsor to the line manager will result in managers who did not request it being saddled with responsibility for agents they have never seen in action. The mechanism is automatic and will take effect as soon as the first agent leaves. It is best to notify these individuals in advance, because a manager who discovers this responsibility only when an incident occurs will have every reason to contest it.

What Needs to Be Decided

1. Name the function that allows you to create an agent for purposes other than strictly personal use, and specify a response time for it.
2. Require that each agent provide a written statement of use, a declared scope of data, a designated person in charge, and a review date. A handwritten list is better than a tool you haven’t purchased yet.
3. Decide on the three-zone system before opening agent creation to business lines—not after.
4. Decide between Agent 365 alone and Microsoft 365 E7 by comparing what you’re already paying: the issue isn’t the listed price, but how well it aligns with your current licenses.
5. Include the cost of custom agents in the budget, separate from the licenses.
6. Establish the rules governing content produced by an agent based on classified information.

The corresponding configuration work is divided between the identity and agent platform administrations, and your teams know how to carry it out; what usually causes delays is the lack of a decision on who authorizes and who is accountable. Lambert Consulting can facilitate this decision-making process and establish the governance framework before the number of agents grows, building on the environments Copilot Studio already in place. The same work on human access rights— to be carried out before Microsoft 365 Copilot goes live—remains a prerequisite: an agent inherits the permissions it finds. And if the question of license volume arises at the same time, the figures to be produced by a deadline also apply to this decision-making process.

Microsoft Sources

• Overview of Microsoft Agent 365
• Microsoft 365 E7 and Agent 365 are generally available
• What is Microsoft Entra Agent ID?
• Agent Identity Governance
• Microsoft Purview for Agent 365
• Data Strategies Copilot Studio
• Managed Environments Power Platform
• Licenses and Billing Copilot Studio
• Microsoft Agent 365 Pricing