Since July 1, 2026, a quiet licensing change has been making this question urgent: agent discovery, posture management, and threat detection for Copilot Studio and Microsoft Foundry agents in Defender now require Agent 365-eligible licensing, and tenants without it lose those capabilities. Organizations that assumed agent visibility came with their existing Microsoft security stack woke up in July to find it was now a product decision. So: what does Agent 365 actually cover, what does it genuinely do well, and where do third-party agent-security platforms still earn their line item?
The one-paragraph answer: Agent 365 is the right system of record for agents living inside the Microsoft ecosystem: registry, identity via Entra Agent ID, posture, and M365-native controls, now extending to cross-cloud registration. It is not a runtime enforcement layer for the agent behaviors that cause incidents, it is thin outside the Microsoft perimeter, and its visibility is now license-gated. Most enterprises with serious agent estates will run it and an independent runtime layer, for the same reason they run both a CMDB and an EDR.
Last verified: August 6, 2026. Disclosure: we build in the third-party category being compared.
What Agent 365 covers well
- Registry and identity. A tenant-wide agent inventory built on Entra Agent ID (GA since April 2026), agents as first-class identities rather than shared service accounts, now targetable by Conditional Access. This is foundational and Microsoft is genuinely ahead here.
- Reach beyond Azure. The May 2026 update added cross-cloud registry support (agents on Bedrock and Google Cloud can register) and endpoint agent controls, a real step out of the walled garden.
- Governed citizen development. The Agent Store's "built by your org" flow gives Copilot Studio agents an approval path, an owner of record, and a distribution channel that is not a Teams message with a link.
- Defender and Purview integration. For licensed tenants: posture assessment, threat detection, prompt-injection protections (preview), and audit flowing into the tooling your SOC already runs.
Where the gaps are
1. The licensing wall is the first gap
Visibility that arrives with licensing departs with licensing. The July 1 change is worth reading precisely: unlicensed tenants lose agent discovery in Defender, the "am I safe by default?" assumption is now answered no. And the schema migration that came with it (AIAgentsInfo → AgentsInfo) silently broke existing hunting queries, which is its own small lesson about building your only visibility on a platform's product decisions.
2. Registration is not observation
A registry knows what agents are; incidents are caused by what agents do. The July–August incident record, an autonomous agent traversing Hugging Face's production systems, credential exfiltration through a coding agent at Roblox, injection persisting across framework memory at Black Hat: happened at runtime, in the tool-call layer. Independent runtime inspection of every action, argument, and retrieved context, with policy enforced inline, is a different discipline from posture scoring, and it is where our product lives.
3. Outside the ecosystem, coverage thins fast
LangChain, CrewAI, and custom Python agents on developer laptops; MCP servers in dotfiles; agentic browsing that just folded into ChatGPT itself; local models with tool access. Cross-cloud registration helps the agents someone chooses to register, the 1Password finding that 40% of organizations have agents reaching data beyond approved scope describes exactly the population that never gets registered.
4. The referee problem
Microsoft governing Microsoft agents has the same structural tension as any platform grading its own homework. For regulated deployments where deployer oversight duties need independent evidence (EU AI Act Article 26 being the obvious case) an audit trail that exists outside the platform being audited is not paranoia; it is the assignment.