Microsoft is now rolling out Agent 365 into tenants that are part of the Frontier preview program. It’s marketed as the “control plane for AI agents” that will let you register, monitor, and govern agents across Microsoft 365, Dynamics 365, Power Platform, and beyond.
To understand how Microsoft Agent 365 fits into the existing MS cloud product stack, I’ve created the following diagram to illustrate the different layers of services soon to be found in Microsoft customer tenants:
In short, Agent 365 is a separate Online Service governed by the usual Microsoft 365 subscription terms. Its licenses (the new A365 SKU) are intended to be assigned to agent instances only (Entra Agent IDs / agentic users), not humans. It does not replace your existing M365, D365, or Power Platform licenses, nor does it remove Copilot Studio or Azure OpenAI consumption costs.
The rest of this article expands each layer of the diagram and ties it back to licensing. Note that this is not directly taken from the official Microsoft documentation, but rather an interpretation of what we currently know about the coming services after the initial launch at the Ignite 2025 conference.
1. Tenant foundation: humans still pay the rent
At the top of the diagram, you’ve got the tenant foundation:
- Microsoft 365 / Office 365 plans (E3/E5/Business/etc.) that license your human users.
- Security and compliance add-ons like Defender and Purview that are either per-user or per-tenant.
Agent 365 doesn’t change any of this. Every real employee still needs their usual M365 license to access Exchange, SharePoint, Teams, OneDrive, and so on. The Agent 365 docs assume these entitlements already exist.
Think of this layer as the “regular world” that AI agents will be dropped into.
2. Workloads and human Copilots: where the data and actions live
The next layer down in the diagram is the stuff your users are actually using today:
- Exchange / SharePoint / Teams / OneDrive
- Dynamics 365 apps, Power Apps, Power Automate, Dataverse
- Microsoft 365 Copilot (per user)
Again, Agent 365 doesn’t replace any of these workloads. It sits alongside them, making it possible for properly licensed agentic workers to leverage the tools you’ve already made available to the human workers.
It’s worth noting that Microsoft 365 Copilot remains a human user centric license that unlocks more advanced AI features than the bundled Copilot Chat capabilities.
3. Agent creation and runtime: builders and tokens
Below that, you’ve got the agent creation & runtime layer:
- Copilot Studio, Agent Framework / SDK, other agent stacks – where agents are actually authored and orchestrated.
- Model/runtime capacity – Azure OpenAI, Copilot message capacity, etc., which are typically billed on a consumption basis.
From a licensing perspective:
- Copilot Studio and other “builder” products are covered by their own SKUs or usage-based plans.
- Tokens, messages, and model calls are still consumption costs even if an agent is registered in Agent 365.
Agent 365 plugs into this layer by providing tooling servers (MCP servers) that agents can call to interact with Outlook, Teams, SharePoint, Dataverse and other systems in a governed way.
But the core “who pays for the tokens?” question lives here. As of now, we don’t know whether seeded capacity in the form of Copilot Credits would be included in Agent 365 licenses.
4. Agent 365 control plane: per-agent licensing starts here
This is the new A365 piece.
The diagram breaks this layer into three boxes:
- Agent 365 licenses – per agent instance only
- Agent registry in the M365 admin center
- Entra Agent IDs (agentic users)
The official story:
- Microsoft describes Agent 365 as the control plane for AI agents that gives you a single place to register, organize, monitor, and govern agents, regardless of whether they were built on Microsoft platforms, open-source frameworks, or third-party tools.
- Entra Agent ID is the identity primitive that represents a non-human agent in Entra ID, with its own permissions, policies, and lifecycle separate from human users.
- When you “onboard” an agent into Agent 365, you assign it an Agent 365 license and an Entra Agent ID so it becomes a first-class citizen in your identity and security tooling.
So what does the license buy you? Microsoft hasn’t yet disclosed the specific entitlement, yet we can already tell that at minimum you get:
- The right to register that agent in the Agent registry and manage it there.
- Use of the Agent 365 control-plane features (inventory, ownership, lifecycle, policy bindings, analytics, etc.) for that agent.
- Access to the tooling gateway / MCP servers that sit behind Agent 365 for integrations with M365 apps and Dataverse, subject to whatever workload licenses your tenant already has.
In other words, the Agent 365 license is the “control-plane subscription” attached to an agent identity, just like an E3/E5 license is the subscription attached to a human identity.
Preview tenants get a bundle of 25 Agent 365 Frontier licenses automatically provisioned, with a Terms of Service dialog that explicitly says those licenses are “for assignment to agent instances only.” That’s the first clear signal that the billing unit is one license per agent.
5. Cross-cutting security and governance: Entra, Defender, Purview on top
The bottom layer of the diagram is all the cross-cutting security and governance that sits across both humans and agents:
- Audit, logging, analytics, RBAC
- Defender / Purview policies applied to human identities and Entra Agent IDs alike
Microsoft’s marketing leans heavily on this: Agent 365 brings agents into the same security and compliance perimeter as your people, using familiar tools like Entra, Defender, and Purview.
From a licensing angle, it’s safest to assume that simply buying A365 agentic seats isn’t sufficient to unlock these security capabilities for every user. If you want advanced DLP, eDiscovery, or threat detection applied to agents, you still need the right Defender and Purview SKUs in the tenant. Agent 365 will presumably be the thing that lets you target those capabilities at Entra Agent IDs; it doesn’t automatically grant the underlying security products.
What about the tools for the agentic workers?
Like Satya Nadella described Microsoft’s strategy around the commercial model of agentic AI (see my earlier post for details), the A365 agents will need an identity, tools, and a computer to use. Offering this infrastructure is how Microsoft aims to position themselves as a layer above the AI labs who mainly focus on model development and research.
The tools needed for participating in information work inside Microsoft 365 will most likely come included with the A365 license. As of today, though, if we try to review the product details inside M365 admin center to see what our Agent 365 Frontier trial license includes, the information is not too convincing:
These rows appear to be a copy-paste from some earlier M365 license for human employees, rather than a carefully crafted toolkit for AI agents in the year 2025. The commerce experience in Microsoft 365 admin center is notorious for having incorrect information about the entitlements of products for many years. It is therefore safe to assume that all of this will change by the time A365 hits general availability.
As for the computer that an AI agent would be assigned, the details remain sparse. At Ignite 2025, Microsoft launched Project Opal, again as part of the Frontier program and behind the Microsoft 365 Copilot user license. According to the documentation:
Opal uses advanced Computer-Using Agents (CUA) to automate and simplify routine complex, multi-step tasks that often take up valuable time for enterprise users. Opal helps users complete jobs with CUA on a secure, Entra-joined, and Intune-enrolled Windows 365 for Agents Cloud PC. The agent operates within a Microsoft Edge browser, and users can supervise the agent to complete the job, intervening when necessary.
It is to be expected that the same service would be powering the Agent 365 licensed AI workers, giving them the Cloud PC necessary to run M365 applications for completing tasks assigned to them. Such computer use capability would fall into the third layer of the diagram, providing agent runtime services.
