Microsoft Agent 365 - Simply Explained

0:00 Right now, your company has employees that nobody ever hired. They don't have desks, they don't take breaks. And most of them were built by one person on a Tuesday afternoon. These are AI agents, software that doesn't just answer questions but takes real actions across your email, your files, and your business systems. Most of us assume the hard part of AI is making it smarter, but the harder problem is keeping track of what it's allowed to do. Microsoft built agent three hundred sixty five to fix exactly that, giving an organization one place to see, govern, and secure every agent it runs. By the end, you'll know what an agent is, why companies suddenly need to manage them, and whether any of this touches your day. What an AI agent actually is. Welcome to the M365 FM podcast, where we explore the people, ideas and technologies shaping the future of work.

0:43 Today we're walking through agent three hundred sixty five in plain language, and you won't need an admin background to keep up. It helps to start with what an AI agent actually is. An agent is a piece of software that doesn't stop at an answer. It reads information, makes a decision, and then takes a real action inside the tools you already use every day. Think about the difference between getting directions and having someone drive you there. A chat bot hands you the directions and waits. An agent gets in the car, follows the route, and tells you when you've arrived. That gap sounds small until you see what it opens up. A support agent can read a customer email, look up the account, and draft a reply before anyone on the team opens their inbox. A finance agent can watch a spreadsheet and flag an expense the moment it looks wrong. A scheduling agent can find a gap in three calendars and send the invite.

1:23 None of that needs a developer sitting there typing commands. The reason agents multiplied so fast comes down to how easy they are to build. Putting one together is now about as hard as writing a clear set of instructions. Microsoft's own teams describe these agents as software that opens documents, calls other systems, sends email, and increasingly makes decisions for people. When the barrier to creating one drops that low, agents show up in every team and every department, often without anyone deciding that they should. A tool that once took a specialist and a budget can now come from one curious person over a lunch break. And that's exactly where the trouble starts. The problem nobody sees it begins the moment agents stop being toys and start doing real work. Every agent you build needs access to something, whether that's an inbox, a file library, a customer database, or another system entirely.

2:09 The more agents you have, the more doors you've quietly opened, and each door is a way in. Now picture how these agents actually get made. Someone in marketing builds one to summarize campaign results over in finance. A second agent chases down late invoices and an IT person builds one that resets passwords. Each of those people is solving a real problem, and every one of them is doing it without a central plan. No one is being careless on purpose. And that's the whole problem, because good intentions still add up to a company full of agents that nobody owns. That spread has a name. People call it agent sprawl, and it means agents are multiplying across the company with no clear owner and no clear list. There's a darker version too often called shadow AI. That's when employees install their own agents on their laptops, or sign up for agents from outside companies, and those agents run completely outside the view of the IT team because nobody wrote it down.

2:54 Nobody can tell you how many there are, what they can reach, or who is responsible when one of them misbehaves. This is where it turns serious. When an agent can call tools, reach data, and talk to other agents. A single helpful workflow can turn into data oversharing, tool misuse, or an action nobody meant to take, and it can happen in seconds. Microsoft's security team puts the risk plainly you can't govern what you can't see, and you can't secure what you don't understand. The scale is hard to picture. The research firm IDC, in a forecast sponsored by Microsoft, expects the world to be running more than a billion AI agents by twenty twenty eight. That figure is a prediction, not a measured result. But even the direction of it tells you why a company would want a grip on this before the number arrives.

3:35 The exact total matters less than the trend, which is that agents are arriving faster than the controls meant to keep them in line. Microsoft's answer to all of it comes down to one idea, and it borrows from something your company already does every single day. The big idea. Manage agents like employees. The instinct here is to reach for something technical, like a smarter model, a stronger firewall, or a stricter rule about who can use AI. Those things help, but they miss the real problem. A company suddenly has workers it never hired, never trained, and never gave a manager. So Microsoft borrowed an idea from the world of people treat agents the way you'd treat your staff. If that sounds strange. It shouldn't because your company already has a system for this. Every person who joins has a record, an identity, a set of permissions, and someone responsible for them.

4:18 Agent three sixty five applies that same system to agents. The phrase Microsoft uses for this is a control plane, and it's worth slowing down on, because it's the one piece of jargon that makes everything else click. A control plane is the dashboard where you see and steer everything, not the engine that does the work. Think of air traffic control. The controllers don't fly the planes. They watch every plane, keep them separated and step in the moment something drifts off course. Agent three sixty five is that tower and the agents are the planes. Microsoft describes the goal in a single line. Manage agents the way you manage people using the same infrastructure, apps and protections that power your business today. That line hides a clever detail. Agent three sixty five isn't one new product you have to learn from scratch. It's a layer that sits on top of tools your IT team already runs, so nobody has to abandon the systems they trust for those tools do for different jobs.

5:04 Microsoft Entra handles identity and access, which means it decides who and what is allowed in Microsoft Defender handles security. Watching for threats and attacks. Microsoft Purview handles data, making sure sensitive information doesn't leak, and the Microsoft three hundred sixty five admin Center is the front door, the place where an admin sees the whole picture at once. Notice what is missing from that list. There's no brand new system to learn and no migration to survive. That last point matters more than it sounds, because the tools doing the work are the same ones protecting your email and your files today. Agent three hundred sixty five simply extends them to cover a new kind of worker. The registry one list of every agent. Everything in agent three hundred sixty five starts with one thing every HR department already has, which is a list of who works here in this world.

5:48 That list is called the Agent Registry. The registry is a single source of truth for every agent in the company. Microsoft's own blog calls this the best way to prevent agent sprawl, because you can't manage what you can't count. Instead of hunting through a dozen tools to find out what is running, an admin opens one list and sees all of it in one place. That single view is what turns a mystery into something a person can actually manage. That list holds four kinds of agents. Some come straight from Microsoft, built into copilot and teams. Others are built by partner companies and published for broad use. Then there are the agents, your own organization published for everyone. And finally, the agents shared by individual creators, the ones a single employee built and passed around their team. The registry also surfaces three numbers that tell you how healthy your setup is.

6:29 The first is the total number of agents. The second counts agents without owners, which happens when the person who built a shared agent leaves the company and nobody picks it up. The third tracks unmanaged agents, the ones running outside agent three sixty five with none of its protections. Those three numbers are the health check, and they update as people join and leave. Then there's the part that turns a list into real control. If an admin finds an agent nobody sanctioned, they can quarantine it or block it outright so users can't discover it and it can't reach company resources or other agents. Quarantining is the quiet superpower here because it removes a risky agent without breaking the work around it. There's also an agent map that draws the connections between agents, people, and resources, so you can see how the whole thing fits together. Knowing an agent exists is only the beginning, though.

7:11 The next question is what that agent is allowed to do. Agent identity. Every agent gets its own ID. This is where a lot of people get the wrong mental picture. You might think an agent is just a feature inside an app, something that borrows your login and quietly acts as you. It's actually the opposite. An agent gets its own identity, its own account, and its own set of permissions, almost like an employee badge. Microsoft calls this Microsoft Entra Agent ID, and it gives every agent a first class identity the company can see and control behind the scenes. An admin can create a blueprint for a type of agent, then spin up individual agent identities from that blueprint. The same way a company hires several people for the same role that parent and child set up means one security policy can flow down to a whole family of agents at once. Once an agent has an identity, the rules of the road kick in.

7:54 The guiding principle is least privilege, which simply means an agent gets only the access it needs to do its job and nothing more. A tool that summarizes reports shouldn't also be able to delete customer records, even if it can technically reach them. Entra enforces that boundary, and it can adjust access in real time based on risk, which means one that suddenly looks compromised can be cut off from company resources before it does any damage. The identity layer also speaks. The language's agents actually use. It supports standard sign in with OAuth two point zero, and it supports the model context protocol, which is the common way agents connect to tools and data, along with agent to agent communication for agents that work together. None of those names need to stick. What matters is that the identity works the same way. Whether the agent was built by Microsoft or by someone else entirely.

8:37 There's a practical payoff hiding in all of this because every agent has its own identity. A company can answer basic questions that used to be impossible. Which agent did this? What was it allowed to reach and who is responsible for it? Those are the same questions you'd ask about a person, and now they have answers. Identity sets the boundary for what an agent can touch. Governance decides what happens over the agent's whole life. Guardrails and the life of an agent. An identity tells you what an agent is allowed to do today. Governance is about what happens from the day it's created, to the day it's retired. And that stretch is longer and busier than most people expect. The first piece is the starting line. When an admin brings a new agent into the company, they can apply a policy template, which is a pre-built set of security rules.

9:19 That way an agent starts secure, governed, and compliant from day one. Instead of getting locked down only after something goes wrong. It's a bit like a new hire getting their laptop, their email, and their access on the first morning rather than six months later. Getting that right on the first day saves months of chasing problems later. Companies also get to decide who is even allowed to create and manage agents in the first place. Not everyone should be able to spin up an agent that reaches the whole organisation, and not every agent deserves a permanent place in the company. It can set those guardrails. So building an agent becomes a process with a gate rather than a free for all that. Anyone can walk through that single decision who can build what is often where a company's real risk lives. Then there's the long haul. Agents have a life cycle, just like people do.

9:59 They get created, deployed, updated, and eventually retired. Agent three hundred sixty five lets admins track versions expire. Agents that have gone quiet, flag agents that lost their owner, and block agents that start looking risky. Much of this can run on rules, so the clean up happens on its own. Instead of piling up until someone finally notices a forgotten agent with old permissions, is exactly the kind of loose end that causes trouble at the worst possible time. The thinking behind this is easy to miss. A company doesn't want to ban agents because agents are useful. It wants them to behave the same way. A good workplace wants its people to do good work within clear limits. Guardrails aren't a fence around innovation. They're what let a company say yes to agents without losing sleep over it.

10:39 Watching agents in real time guardrails shape what agents are supposed to do. Security is what catches the moments they don't. If governance is the rule book, security is the referee. That job falls mostly to Microsoft Defender, which brings the same threat detection a company already uses for laptops and email into the world of agents. Defender watches for known attacks and new ones blocks behavior that looks unsafe and helps a security team investigate an incident by showing the whole chain of what actually happened. The point is to catch a problem while it's still small, rather than after a report has already gone out. That matters because an agent can act far faster than a person can react. The Datacite belongs to Microsoft purview. Its job is to stop sensitive information from leaking whether an agent is reading it, copying it, or sending it somewhere it shouldn't go.

11:21 Purview also keeps a record of what agents did, so a company can audit those interactions later and produce real evidence when a regulator or a lawyer comes asking. Data is usually where the damage shows up first, which is why this layer sits close to the information itself. The part leaders care about most is simply being able to see everything at once. Agent three sixty five pulls agent activity into a unified dashboard with analytics and reporting that's tailored to the role you hold. It sees what's running and how healthy it is. While security sees the risks and business leaders see performance and return so they can tell whether an agent is actually earning its keep or just sitting there. This is the shift from simply watching agents to actually running them. This coverage is meant to follow agents wherever they work. That includes agents acting on behalf of a person, and agents running with their own credentials.

12:05 Behind the scenes, it reaches out to cloud agents built on other platforms and down to local agents installed on laptops, which is the shadow AI we talked about earlier. Some of those newer pieces are still rolling out, so treat the far edges as a work in progress rather than a finished guarantee. The promise is simple even where the rollout is not, which is that an agent should be visible and protected no matter where it runs. Who needs it and what it costs. Now consider who all of this is actually for. On paper, it's built for the people who keep a company running. Which is it? And security leaders. In practice, it reaches everyone who touches an agent. And that includes you. That reach is built into the way it's licensed. Agent three sixty five is priced per person, not per agent. And that's a small detail with a big consequence.

12:46 One license can cover all the agents a single employee uses or sponsors, so a company isn't paying again, every time someone builds another helper, one price follows the person, not the tool count, and the control spreads across the company instead of sitting in one office. The recommended rule is that anyone who manages, sponsors, or uses agents to do work on their behalf should be covered. If you use an agent at work, you're part of the picture. Whether or not you ever open an admin portal, that's a deliberate choice because an agent's risk doesn't stop at the department that built it. Now for the numbers which are current as of this recording bought on its own agent three hundred sixty five runs fifteen dollars per user per month on an annual plan. It also comes bundled inside Microsoft three. Sixty five. E7 the top tier suite, which is listed at ninety nine dollars per user per month and it works best with Microsoft E5 underneath it with at least one qualifying license to switch the whole thing on.

13:34 If you're not an admin, this still touches your day. The agents you use at work are becoming visible, countable, and limited to what they actually need. That's the entire point. The goal isn't to slow agents down, it's to make sure the company knows they exist and that the right person is watching. For a beginner, that's the reassuring part of the story because it means the messy parts are someone's job. A quick recap and one question. The short version goes like this. AI agents are a new kind of worker inside Microsoft three hundred sixty five. They're multiplying faster than most companies can track, and agent three sixty five is Microsoft's answer. It's a control plane that lets a company see every agent, give each one an identity, set the rules it follows, and watch it in real time, all on top of the tools it already runs. So here's the question I'll leave you with.

14:15 If your company hired a new employee tomorrow and handed them your email, your files, and your customer data, you'd want to know exactly who they were. How many of the agents already working in your company could you name right now?