The agent action gate
The fictional bank records the exact action and approver.
Coming
See every demonstrationFREE CHECK
Agent 365 readiness
Check ownership, identity, inventory, and the approval path before agents scale.
01 Source02 Boundary03 Human decision04 Evidence
WHAT TO REVIEW
Four questions for the team that owns the decision.
- Can you name an owner for every active agent?
- Are agent identities and permissions reviewed on a schedule?
- Can a person approve the exact effect of a high-impact action?
- Can you trace a decision from request to outcome?
Take the PDF with you.
Enter a work email, company and role to request the PDF. This action records an SIT inquiry for follow-up. Marketing emails require a separate choice.
Download the PDF directlyTHE CHECK
What does the Agent 365 readiness check test?
Whether every active agent has an owner, whether identities and permissions are reviewed on a schedule, whether a person can approve the exact effect of a high-impact action, and whether a decision can be traced from request to outcome.
Four questions, one PDF, no email required. Answer them with the people who own the decision and you will know which control is assumed rather than tested.
THE MICROSOFT INSIGHT
Which agents does Microsoft Agent 365 already know about?
Agents built with Microsoft Foundry, Copilot Studio and Agent Builder join automatically; agents built elsewhere join through registry sync or the SDK.
Agents built with Microsoft Foundry, Copilot Studio and Agent Builder are integrated with Microsoft Agent 365 automatically; agents built elsewhere join through registry sync or the Agent 365 SDK. (Microsoft Learn, checked Oct 31, 2026)
Register the outside agents and the inventory is complete. Leave them out and the inventory is the list of agents that will not surprise you.
THE METHOD
What happens after the four answers?
Each answer maps to a control, each control is marked tested or assumed, and the first assumed control is the one to fix or assess next.
- Owner: every agent in scope has a named person.
- Identity: each agent's permissions are reviewed on a date, not when something happens.
- Gate: a high-impact action waits for a person who sees the exact effect.
- Trace: a decision can be followed from the request to the outcome record.
THE NEXT RUNG
What is the Agent 365 Identity and Security Assessment?
A read-only engagement inside your tenant that produces the inventory, the first permission rows and the one-page Tested or Assumed record.
It is scoped separately from remediation and from Managed AI and Agent Operations, and quoted after a scoping call. Microsoft-funded where you qualify.
Assess before agents scale and the rows are a design. Assess after and the rows are a cleanup.
THE LICENSE
What does the agent estate cost to govern?
Microsoft Agent 365 is licensed by user rather than by agent, which changes how agent sprawl reaches the invoice.
Microsoft Agent 365 became generally available for commercial customers on May 1, 2026, is licensed by user rather than by agent, is included in Microsoft 365 E7, and is sold as an add-on to Microsoft 365 E5, A5 and Business Premium or to the Defender Suite with the Purview Suite. (Microsoft Learn, checked Nov 4, 2026)
Know the model before the agents multiply and the budget line is a plan. Learn it after and the budget line is a surprise.
AFTER TWO WEEKS
What will be working after two weeks?
- You hold the PDF and the four controls are marked tested or assumed.
- The agents in scope are listed with owners, or the missing owners are named as the gap.
- The first high-impact action without a gate is identified.
- You have booked, or decided not to book, the read-only assessment.
HONEST ABOUT LIMITS
What this does not do yet
It does not give an agent its own governed identity: the four questions find out whether one exists. Microsoft Entra Agent ID is generally available to every Microsoft Entra customer and gives each AI agent its own identity with owners and sponsors, Conditional Access templates for high-risk, autonomous and on-behalf-of agents, and sponsor lifecycle workflows; extending Entra security features to agents needs a Microsoft Agent 365 license, and the admin center creation wizard and agent user accounts remain in preview. (Microsoft Learn, checked Nov 4, 2026) Microsoft Entra Agent ID is generally available, the agent security controls need a Microsoft Agent 365 license, and the answer records which of the two you hold.
It does not test the controls: four questions find the assumption, the assessment tests it.
It does not create a lead unless you ask for the PDF by email and say so.
THE ONE THING TO REMEMBER
An agent without an owner is an incident waiting for a name.
Said another way: owner, identity, gate, trace.
Said a third way: find the assumed control before the auditor does.
SHOW YOUR WORK
See the control path on a fictional bank.
DIRECT ANSWERS
Questions before you decide.
Who should answer the four questions?
The people who own the decision: the security lead, the IT director and whoever sponsors the agents in the business. Answers that differ between them are the finding.
Is the PDF gated?
No. Download it directly. Asking for it by email is optional and creates an inquiry with Simplicity IT; marketing email is a separate box.
What if we have no agents yet?
Then the check is early and that is the point: the owner, identity, gate and trace controls are easier to design before the first agent than after the twentieth.
What comes after the check?
The Agent 365 Identity and Security Assessment, read-only, which produces the inventory, the first permission rows and the Tested or Assumed record.
How is the assessment priced?
Quoted after a scoping call and scoped separately from remediation or a managed service.
NEXT STEP
Start with a boundary you can explain.
Choose a focused check, or speak with the team about the workflow you need to improve.