What Microsoft agent governance actually is.
There is no single product by that name. It is a capability assembled from four products a large enterprise already owns, and much of it is new enough that it should be scored as it ships rather than as it was announced.
The four products
Each contributes a different layer, and the seams between them are where most of the evaluation happens.
- Microsoft Agent 365the registry and the operating surface. It inventories agents, syncs from Microsoft sources, maps their relationships, and frames the work as observe, govern, and secure. It is generally available for Commercial, licensed on a per-user basis.
- Microsoft Entra Agent IDagent identity as a real directory object, with a documented sponsor model, delegated and autonomous access patterns, and access packages with approval routing.
- Microsoft Purviewdata-loss prevention and audit for agent interactions — block or audit across Teams, OneDrive, SharePoint and email, with an audit record covering agent-to-human, human-to-agent, agent-to-tool and agent-to-agent activity.
- Microsoft Defenderreal-time protection that inspects agent activity through the agentic loop and can stop a risky action before it executes. The default rule audits; custom rules block.
Where the suite is strongest
Three of the twenty-eight rows below go to Microsoft. Each one follows from owning the productivity suite itself, which is an advantage no independent layer can buy.
- First-party depth inside the productivity suiteagents built on Microsoft's own stack run inside Teams and Outlook. We govern the suite from outside it, which is what lets one policy also reach agents built anywhere else — but where a scenario depends on being in the client, being the client wins.
- Network-layer enforcementEntra Internet Access is a genuine control point at a layer we do not operate. We govern the action rather than the path, and run alongside it.
- Ecosystem and marketplace breadtha partner ecosystem with admin-center deployment gives Microsoft a wider distribution footprint than ours today.
Three questions to put to the Microsoft stack
Each of the four products answers a different part of the governance question, so the useful test is not which product to look at but which question each one can close on its own. These three are the axes the table is organised around.
- Be at runtimeDefender can stop a flagged action before it executes, while Purview's audit records what happened afterwards. The question is which of your policies Defender can actually evaluate in the moment, given that its rules map onto four preset detection types.
- Know the identityEntra Agent ID records a sponsor for every agent it holds, and that is a real accountable human. The question is whether a single action — this export, this write — resolves to that person at the moment it happens, or only to an agent whose sponsor is on file.
- Cover everythingCopilot Studio and Foundry agents receive an Entra Agent ID automatically. The question is what happens to the agents that never got one — built on another stack, connected by a business team, or facing your customers rather than your employees.
Then there is the licence, which in a Microsoft estate usually settles the deal. Agent 365 is billed per user on top of an E5 or E7 tier, so the governance bill rises with every hire rather than with every agent you deploy.
Microsoft
