Microsoft puts AI agents in Entra, which makes agent sprawl an identity team problem

Microsoft has announced Agent 365, which it describes as a control plane for AI agents, covering agents built on Microsoft platforms, open-source frameworks or third-party platforms ^[1][2]. The stated design principle is to manage agents the way you manage people, using the same infrastructure, apps and protections a company already runs ^[3]. That is the consequential part: if agents become directory objects with policies and audit trails, the cost and headcount land on identity, security and compliance teams, not on the innovation budget.

The product is organised around five capabilities: registry, access control, visualization, interoperability and security ^[4]. The registry is pitched as the single source of truth, an inventory in Microsoft Entra of agents holding an Entra agent ID, agents an organisation chooses to register in the Microsoft Teams Store, and, Microsoft says, shadow agents at some later point ^[5]. Admins can quarantine unsanctioned agents so they cannot be discovered by users or connect to other agents and organisational resources ^[6]. Read the sequencing plainly: on the described roadmap the registry begins as an inventory of agents that already declared themselves, and detection of the ones nobody registered arrives later ^[17]. The blind spot Microsoft says it eliminates is the one that closes last.

Access control is where the operating cost shows up. Every agent is required to have a unique agent ID, and IT sets guardrails over who creates, onboards and manages agents ^[7]. Policy templates are meant to apply standard security policy from the start ^[8], Entra applies adaptive, risk-based access decisions and blocks agents that may have been compromised ^[9], and agents are supposed to run under least privilege ^[10]. Each of those is a queue with a human at the end of it: provisioning requests, exception reviews, access recertification, decommissioning. Organisations that run joiner-mover-leaver processes for staff now need an equivalent lifecycle for software that requests resources on its own.

Compliance follows the same pattern. Microsoft says Agent 365 provides detailed logging, reporting and e-discovery, plus policies to detect, retain and investigate what it calls unethical agent interactions ^[11]. In practice that makes agent activity a retained, discoverable record class, which is a legal and records-management commitment rather than a dashboard feature. The visualization layer maps connections among agents, users and resources with role-based reporting ^[12], and includes performance measurement intended to support ROI assessment and deployment decisions ^[13]. Interoperability gives agents access to the same applications and business data people use, including Word, Excel, SharePoint and Dynamics 365 ^[14], and to Work IQ, described as an organisation's own data, relationships and context ^[15].

For scale, Microsoft cites an IDC prediction of 1.3 billion agents by 2028 ^[16]. Treat that as a vendor-selected forecast rather than a planning input, but note what it implies about unit economics: governance priced or staffed per identity behaves very differently at four agents per employee than at one.

Three things to watch. First, pricing and licensing terms, which the announcement as published does not set out ^[18], because per-agent identity is the natural place for a meter. Second, whether shadow agent discovery actually ships, and whether quarantine is default-deny for unregistered agents or an admin action taken after the fact ^[5][6]. Third, who inside your organisation owns the agent lifecycle queue. If the answer is still the team that also handles employee access reviews, the pilot has already created an unfunded workload.