Microsoft wants to manage AI agents like employees. What Agent 365 actually does.
Microsoft says more than 50 million AI agents have been registered in its new control plane. The pitch: treat software agents with the same identity and access rules you already apply to staff.
Key points
- Microsoft says more than 50 million AI agents have been registered in Agent 365, the company's new control plane for AI agents, since its launch earlier this year.
- Every agent gets a unique Entra Agent ID tied to a human owner, a stated purpose, and access rules that tighten or loosen as risk changes.
- Agent 365 plugs into non-Microsoft systems including Salesforce Agentforce, Amazon Bedrock, Anthropic, Databricks, Google Gemini and Google Vertex, with OpenAI, ServiceNow and Snowflake listed as planned.
- Gartner named Microsoft a Leader in its first Magic Quadrant for AI Agent Management Platforms, published 27 October 2026.
- Microsoft plans to expand automatic discovery to 60 types of local AI agents running on company devices, adding 35 to the types it covers today.
Microsoft has pushed Agent 365 into general availability and says more than 50 million agents have already been registered. The company announced that milestone alongside a Leader placement in Gartner's first Magic Quadrant for this category, dated 27 October 2026.
An AI agent, in plain terms, is a piece of software that acts on a person's behalf: booking a meeting, pulling a report, filing a ticket. Unlike a chatbot that answers questions, an agent takes actions inside real business systems. That's the part that worries security teams.
What is Agent 365 actually for?
It's a registry and a rulebook for AI agents inside a company. If an agent can log into your file store or your CRM, it should be tracked like an employee who can do the same, with an owner, a job description and access that can be yanked.
Microsoft's own description calls Agent 365 a control plane to observe, secure and govern AI agents. It ties into four existing admin consoles most Microsoft shops already run: Entra for identity, Defender for threat protection, Purview for data governance, and the Microsoft 365 admin center for day-to-day management.
How does it stop a rogue agent?
Through identity, not monitoring. Every agent is issued a Microsoft Entra Agent ID, a unique account record linked to a named human owner and a stated purpose. Access policies attached to that ID can tighten automatically when risk signals change, the same way conditional access works for staff logins today.
That matters because the common failure mode with AI agents isn't a dramatic hack. It's an agent built by one team, forgotten, still holding credentials to systems it no longer needs. Agent 365's Action Center is pitched at exactly that problem: cleaning up inactive agents, reassigning ones whose owner has left, blocking agents that start behaving oddly.
We first covered Agent 365's identity-first approach on 19 October 2026, when Microsoft's guardrail pitch was still mostly theoretical. The general availability announcement is the first concrete measure of adoption.
Who else plugs in?
Agents built outside Microsoft's own stack. The product supports a registry covering Salesforce Agentforce, Amazon Bedrock, Anthropic, Databricks, Google Gemini and Google Vertex. OpenAI, ServiceNow and Snowflake connections are planned but not yet shipping.
| Area | Today | Planned |
|---|---|---|
| Agents registered | 50 million+ | Not stated |
| Local agent types discovered | Current total reaching 60 with 35 added | 60 |
| Third-party integrations | 6 named clouds and frameworks | OpenAI, ServiceNow, Snowflake |
| Gartner MQ placement | Leader (27 Oct 2026) | n/a |
For agents without a native connector, there's an SDK and a sensor-based discovery mode that spots agents running quietly on company laptops.
What should a normal IT shop take from this?
Two things. First, the 50 million number is a registration count, not a measure of agents under meaningful control. Registering an agent and actually governing what it can touch are different jobs, and Microsoft concedes policy coverage for third-party and unmanaged agents is still being built out.
Second, the licensing. Agent 365 ships inside the Microsoft 365 E7 bundle or as a paid add-on to E5. If your organisation is already paying for the E5 security stack, this is another line item on top. Companies on lower tiers get nothing automatic.
My read: the identity-first framing is right, and it's the piece most agent-governance startups have been missing. The question for 2027 is whether the discovery sensors actually find the shadow agents that developers are already spinning up without telling anyone.
