The agent action gate
The fictional bank records the exact action and approver.
Coming
See every demonstrationAGENT 365 READINESS
Are your AI agents covered?
Since July 1, 2026, Copilot Studio and Foundry agents have no Defender coverage without Microsoft Agent 365 (Microsoft Learn, checked Nov 5, 2026). A one-workshop readiness review tells you which of your agents are covered, who owns each one, and what to do first.
01 Source02 Boundary03 Human decision04 Evidence
HOW IT WORKS
The control path in practice.
- Inventory what is already running. Copilot Studio, Foundry, Agent Builder and SharePoint agents come from the Microsoft 365 agent registry; the platforms outside Microsoft that hold more are listed beside them.
- Answer the eight questions Microsoft FastTrack guidance asks before an Agent 365 deployment, with one owner per answer. They cover the platforms in use, how agents sign in, the data they reach, who owns each one, what they may do, how mature your data protection is, whether your security team is ready, and where a person must approve.
- Write the licensing position. Either Microsoft 365 E7, or Agent 365 as an add-on to an eligible E5, A5 or Business Premium plan. The admin-led trial is the path when you hold none yet.
- Sequence the plan: what to switch on first and what waits for a preview to end. Name the two rungs above the review, the Agent 365 deployment and the forward-deployed engineer.
THE ANSWER
Which of your agents lost Defender coverage on July 1, 2026?
Every Copilot Studio and Foundry agent in a Microsoft 365 environment without a Microsoft Agent 365 license. Finding agents and checking their posture, detecting threats, blocking risky actions as they happen, and hunting through agent activity all moved behind that license on that date.
Since July 1, 2026, agent security for Microsoft Copilot Studio and Microsoft Foundry agents (discovery and posture, threat detection and real-time protection, hunting over agent activity) requires a Microsoft Agent 365 license; Microsoft Defender for Cloud Apps and Microsoft Defender for Cloud licenses no longer cover it, and an admin-led Agent 365 trial runs 25 seats for 30 days. (Microsoft Learn, checked Nov 5, 2026)
Know the list before the review and the workshop spends its hour on owners and order. Learn it from an auditor and the first question is why nobody knew.
THE REVIEW
What is in a readiness review?
One workshop that answers the eight questions Microsoft FastTrack guidance asks before an Agent 365 deployment, with a named owner per answer. The questions cover the platforms in use, how agents sign in, the data they reach, who owns each one, what they may do, how mature your data protection is, whether your security team is ready, and where a person must approve.
You receive a written answer and an owner per question, and a licensing position for your Microsoft 365. You also get an inventory of the agents already running, read from the Microsoft 365 agent registry, and a plan of what to switch on first.
The free four-question Agent 365 readiness check on this site is the ten-minute version; the review is the one that produces the document your auditor reads.
THE MICROSOFT INSIGHT
Do you need Microsoft 365 E7 to be covered?
No. Agent 365 is also an add-on to an eligible Microsoft 365 E5, A5 or Business Premium plan, or to the Defender Suite with the Purview Suite. E7 bundles it with Microsoft 365 Copilot and the Microsoft Entra Suite.
Since June 1, 2026, a new Microsoft Agent 365 purchase requires Microsoft 365 E5, A5 or Business Premium, or the Microsoft Defender Suite with the Microsoft Purview Suite; Microsoft 365 E7 is unaffected because it includes Microsoft 365 E5, Agent 365, Microsoft 365 Copilot and the Microsoft Entra Suite. (Microsoft Learn, checked Nov 5, 2026)
Name the license path in the review and the plan starts on a Microsoft 365 plan that qualifies. Skip it and the first week of the deployment is a purchase request.
THE INVENTORY
What happens to agents built outside Microsoft?
They are registered through the documented paths at an agreed capability tier. Connected platforms bring supported outside platforms into the Microsoft 365 agent registry as a manual, read-only sync. The Agent 365 SDK covers agents you build yourself.
Connected platforms in Microsoft Agent 365 synchronize supported external agent platforms (seven at the date checked, from the large cloud, CRM and data vendors) into the Microsoft 365 agent registry; the synchronization is manual and read-only, and the registry shows the source platform. (Microsoft Learn, checked Nov 5, 2026)
Observability for those synced agents is a preview feature in the Frontier program, and registering your own MCP server with Agent 365 is in preview, so the review marks both as plan items with a date to re-check rather than controls you hold today.
THE RUNGS ABOVE
What comes after the review?
Two rungs. The Agent 365 deployment, which switches it on with the owners, policies and approval boundaries the review named. Then the forward-deployed engineer, who stays inside your team until the agents run governed.
- Review: the eight answers, the owners, the licensing position, the inventory and the plan.
- Deployment: Agent 365 switched on against the plan, pilot before waves, rollback written first.
- Forward-deployed engineering: an engineer in your team until governed agents are in production with evidence.
Climb the rungs in order and each one is scoped from the evidence of the last. Jump to the deployment and the engineer spends the first month doing the review.
AFTER TWO WEEKS
What will be working after two weeks?
- You hold a written list of which agents are covered and which are not, with an owner against each one.
- You hold the licensing position for your Microsoft 365 (your tenant): E7, the add-on path, or the trial as the first step.
- You hold the eight answers with a named owner per answer and a sequenced plan.
- The agents built outside Microsoft are listed with the registration path and tier agreed for each.
The work is delivered remotely inside your own Microsoft tenant, wherever your business is, and on site only when the work needs it.
HONEST ABOUT LIMITS
What this does not do yet
It does not assume the preview items will be where they are today. Observability for agents synchronized from connected platforms into Microsoft Agent 365 (sessions, exceptions, runtime and tool calls on the Activity tab) is a preview feature in the Frontier program, and the activity available varies by platform. (Microsoft Learn, checked Nov 5, 2026, preview) The review dates every preview it names and sets the re-check, because Microsoft moves these between quarters and the plan should move with them.
It does not switch Agent 365 on; that is the deployment rung, scoped from the review.
It does not promise observability for agents synced from other platforms or your own MCP servers while those are preview.
THE ONE THING TO REMEMBER
Since the July cutover, an agent without Agent 365 is an agent without Defender, so find out which ones you have first.
Said another way: the review is one workshop that tells you which agents are covered, who owns each one, and what to do first.
Said a third way: licensing and inventory before deployment, deployment before the engineer.
SHOW YOUR WORK
See the control path on a fictional bank.
DIRECT ANSWERS
Questions before you decide.
What does Agent 365 cover that Defender alone did not?
Agent inventory, identity through Microsoft Entra Agent ID, Purview policies on agent data, and Defender detections and hunting for agents, in one place, which Microsoft calls a control plane. Since July 1, 2026, the Defender part needs the Agent 365 license.
Do we need Microsoft 365 E7?
No. Agent 365 is also a standalone add-on on an eligible E5 tenant, and E7 bundles it with Microsoft 365 Copilot and the Microsoft Entra Suite.
What is in the readiness review?
The eight questions Microsoft FastTrack guidance asks before deployment, answered in one workshop with an owner per answer. They cover the platforms in use, how agents sign in, the data they reach, who owns each one, what they may do, data protection maturity, security team readiness, and where a person must approve.
What about agents built outside Microsoft?
They are registered through the documented paths at an agreed capability tier. Registry sync brings supported outside platforms into the Microsoft 365 agent registry as a manual, read-only synchronization. Observability for those synced agents and bring-your-own MCP servers are in preview.
NEXT STEP
Start with a boundary you can explain.
Choose a focused check, or speak with the team about the workflow you need to improve.