Microsoft just shipped the first true control plane for AI agents, and it's priced like a productivity SKU. As of May 1, 2026, Microsoft Agent 365 is generally available for commercial customers at USD $15 per user per month, sold standalone or bundled into the new Microsoft 365 E7 suite. The pitch is uncomfortably specific: AI agents are already inside your tenant, you don't know where they all are, and the team accountable for risk has no idea what they can touch.
Agent 365 is Microsoft's bet that the next IT crisis won't be shadow SaaS — it'll be shadow agents. And the company is dragging its existing security stack — Defender, Entra, Intune, Purview — into the fight.
What Agent 365 actually does
The product is structured around three verbs Microsoft repeats relentlessly: observe, govern, secure. In practice, that means a single admin surface in the Microsoft 365 admin center where IT can see every agent operating in the tenant — whether it's a delegated Copilot agent, a SaaS agent operating with its own credentials, or a local coding agent like OpenClaw or Claude Code running on an employee's laptop.
"AI agents aren't coming — they're already in your environment. The problem isn't that agents exist. It's that they proliferate fast, span apps, endpoints and cloud, and often operate outside the visibility and control of the teams accountable for risk."
— Nirav Shah, Corporate Vice President, Agent 365
The May 1 launch covers two scenarios in general availability: agents acting on behalf of users with delegated access (e.g., an inbox-organizing assistant), and agents operating behind the scenes with their own credentials (e.g., an autonomous ticket-triage agent). A third scenario — agents participating in team workflows with their own access — landed in public preview today.
The shadow-agent problem is real
Microsoft's announcement doesn't mince words about what's already happening. Employees are installing local agents like OpenClaw, GitHub Copilot CLI, and Claude Code on managed devices. These agents read code, modify files, hit MCP servers, and reach into cloud resources — all outside traditional endpoint governance.
Agent 365 closes that gap by extending Microsoft Defender and Intune to discover and manage local agents. Customers in the Frontier program can already see which devices are running OpenClaw, identify the methods of execution, and apply Intune policies to block unmanaged invocations. Support for GitHub Copilot CLI and Claude Code is rolling out next.
| Capability | Status (May 1, 2026) |
|---|---|
| Delegated-access agents | Generally available |
| Autonomous agents (own credentials) | Generally available |
| Team-workflow agents | Public preview |
| Local agent discovery (OpenClaw) | Available via Frontier program |
| Defender asset context mapping | Public preview, June 2026 |
| Registry sync with AWS Bedrock & Google Cloud | Public preview |
| Windows 365 for Agents | Public preview, U.S. only |
A relationship map for every agent
The most interesting piece of the Defender integration lands in June 2026: an asset context map showing where each agent runs, which MCP servers it's configured to call, which identities it's associated with, and which cloud resources those identities can reach. This is the same blast-radius reasoning security teams already do for human accounts, applied to autonomous code.
If a managed agent starts exhibiting malicious patterns — for instance, exfiltrating sensitive files — Defender will be able to block coding agents at runtime and generate alerts with full incident context. Initial runtime enforcement targets OpenClaw via Intune.
Multicloud governance, finally
Agent sprawl isn't a Microsoft-only problem, and Microsoft knows it. Today's announcement includes a public preview of Agent 365 registry sync with AWS Bedrock and Google Cloud (the renamed Google Gemini Enterprise Agent Platform, formerly Vertex AI). The connector automatically discovers and inventories agents running on those platforms, with basic lifecycle controls — start, stop, delete — coming next.
This is the kind of integration that historically takes years to ship and ends up half-broken. That Microsoft is launching it on day one of GA suggests the multicloud agent governance market was a non-negotiable for enterprise buyers.
A real partner ecosystem, not a logo wall
Agent 365 launches with a meaningful partner roster. Software development companies whose agents are fully configured to be managed by Agent 365 include Genspark, Zensai, Egnyte, and Zendesk, plus agents built on factories like Kasisto, Kore.ai, and n8n. On the services side, Accenture, Bechtle, Capgemini, Insight, KPMG, Protiviti, and Slalom are launch partners offering workshops, governance enablement, managed services, and hardening for third-party agents.
Kore.ai's CEO Raj Koneru framed the value bluntly:
"Enterprises can easily build AI agents today, but scaling them with trust and governance is where most initiatives stall. With Kore.ai deeply integrated into Microsoft Agent 365, identity, security, and governance are built in from the start."
Network controls hit GA today
One quiet but important capability is also generally available right now: Agent 365 extends Microsoft Entra network controls to Copilot Studio agents and to agents running on user endpoints — including local agents like OpenClaw. That means security teams can restrict agent traffic to approved web destinations, filter risky file movement, and block prompt-injection-driven exfiltration at the network layer, before the harmful action ever fires.
For organizations that have spent the last 18 months staring at OWASP's Top 10 for Agentic AI and wondering what to do about it, this is the most concrete answer Microsoft has shipped.
Windows 365 for Agents
Companion to Agent 365 is Windows 365 for Agents, which entered public preview in the United States only. It's a new class of Cloud PCs purpose-built for agent workloads — managed in Intune, governed via the same identity and security policies you'd apply to a human employee. The bet here is that giving agents their own managed compute environment beats trying to retrofit governance onto whatever sandbox an agent happens to be running in.
What it actually costs
Agent 365 is $15 per user per month, available standalone or as part of Microsoft 365 E7. The license is per user — meaning each individual who manages, sponsors, or is served by agents — not per agent. That's a deliberate pricing decision: Microsoft is betting agent counts will explode while user counts stay flat. The economics work for Microsoft if every knowledge worker eventually employs a small fleet of bots.
There's also a live AMA scheduled for Tuesday, May 12, 2026, where the Agent 365 team will take direct questions from customers.
The Bottom Line
Most agent platforms today are about building agents. Agent 365 is about containing them. That's a meaningful pivot — and it tells you exactly where Microsoft thinks the enterprise market is in the maturity curve. If you're an IT or security leader still framing agentic AI as an experiment, Agent 365's GA is the moment that framing expires. The competition isn't "does our company use AI agents?" anymore; it's "do we know which agents are running, who owns them, and what they can reach?" Microsoft just shipped a $15-per-seat answer.
