# What Microsoft Agent 365 governs, and what an open source register keeps

> Microsoft Agent 365 is the control plane Microsoft sells for governing AI agents: a per-user service over an agent registry in the Microsoft 365 admin center, with identity, access and audit handled by Entra, Defender and Purview. Kortix is the open-source AI Operating System, and its agent register lives in a git repo the company owns.

URL: https://opensourcecopilotalternative.com/microsoft-agent-365

## The register is one file

`kortix.yaml`

```yaml
agents:
  kortix:
    file: agents/kortix.md
    connectors: all
    secrets: all
    kortix_permissions: all
```

Source: https://github.com/kortix-ai/suna/raw/dev/packages/starter/templates/base/kortix.yaml

A new Kortix project declares its agents, and what each one may reach, in the manifest it ships with.

## Two ways to keep a register of agents

What a company holds, and what stays with the vendor, in each model.

| | Kortix (recommended) | Microsoft Agent 365 |
| --- | --- | --- |
| Open source | Yes, code you can read and fork | No, a closed Microsoft cloud service |
| Agent register | kortix.yaml and agents/*.md in your git repo | Registry in the Microsoft 365 admin center |
| Where permissions live | On the agent's entry in your repository | In Entra, on the agent's identity |
| Audit trail | The repo history and the project audit log | Audit logs and eDiscovery in the tenant |
| Agent definition portability | Clone, fork, or run on another host | Solutions export between Power Platform environments |
| Self-hosting | Kortix Cloud, VPC, or on-prem | Microsoft's cloud only |

## What Microsoft Agent 365 is

Microsoft Agent 365 is the control plane Microsoft sells to IT and security teams for the agents running in their organization. One registry lists the agents, and Microsoft Entra, Defender and Purview supply the identity, threat protection and data controls around them. Microsoft's overview names the three jobs as observe, govern and secure, and places the registry in the Microsoft 365 admin center ([Microsoft Agent 365 overview](https://learn.microsoft.com/en-us/microsoft-agent-365/overview)).

The product has been generally available for commercial customers since 1 May 2026 ([Microsoft Security blog](https://www.microsoft.com/en-us/security/blog/2026/05/01/microsoft-agent-365-now-generally-available-expands-capabilities-and-integrations/)). Microsoft's case for it is sprawl. Agents turn up in Copilot, Teams, line-of-business apps and SaaS tools, and a helpful workflow can become data oversharing or an over-privileged action quickly. Agent 365 answers with inventory and policy.

## Is Agent 365 included with Microsoft 365 Copilot?

No. Microsoft's own Agent 365 pricing FAQ says teams that already pay for Microsoft 365 Copilot still need Agent 365 to manage and secure agents beyond Copilot ([Agent 365 pricing FAQ](https://www.microsoft.com/licensing/faqs/122)). Microsoft draws the line itself: Copilot is about what AI can do, and Agent 365 is about controlling what it is allowed to do.

The commercial shape matters more than the feature list. Agent 365 is sold per person, not per agent, and one subscription covers every agent that person interacts with, owns, manages or sponsors. It is available standalone or inside Microsoft 365 E7, and Microsoft states that it is not included in Microsoft 365 E3 or E5. List prices when checked in October 2026 were $15 per person a month standalone and $99 inside E7.

Some capabilities come with any Microsoft cloud subscription: agent identity, the registry, basic usage insights, admin actions, and audit logs and eDiscovery for agent activity. Advanced analytics, the agent map, lifecycle policies, conditional access and data loss prevention need Agent 365. Microsoft also notes that visibility into who interacts with which agent is limited today, which makes a per-person rule awkward to enforce.

## Where the agents governed by Agent 365 actually run

Agent 365 is a control plane. Agents stay where they were built, and the registry reads them there. A Copilot Studio agent is created inside a Power Platform environment, and Microsoft documents moving it between environments as a solution export and import ([Copilot Studio solutions](https://learn.microsoft.com/en-us/microsoft-copilot-studio/authoring-solutions-import-export)).

The registry reaches further. Microsoft lists connections to Amazon Bedrock, Google Vertex AI, Salesforce Agentforce, Databricks Genie, Anthropic Claude Managed Agents, Oracle Generative AI Agents and Snowflake Cortex; a connection discovers agents and adds them to the registry ([Connected platforms in Agent 365](https://learn.microsoft.com/en-us/microsoft-agent-365/admin/connected-platforms)). The connection is read-only by design. Agent 365 never invokes or executes those agents, and synchronization is manual today. That is useful for visibility. It also means the governance record describes agents whose behavior, credentials and hosting remain somewhere else.

## What a team hands over when Agent 365 governs its agents

Start with the register itself. The Microsoft 365 agent registry lists Microsoft agents, partner agents, agents your organization published and agents shared by individual creators, plus an "unmanaged agents" count for agents created or managed outside Agent 365 ([Agent registry](https://learn.microsoft.com/en-us/microsoft-365/admin/manage/agent-registry)). Administration runs through the Microsoft 365 admin center, Entra, Defender and Purview, each with its own admin role.

Then the identity layer. Each agent gets an Entra identity, and access policy, conditional access and data controls attach to it. For connected systems, Microsoft stores the credentials entered for a connection as encrypted data inside Microsoft 365 ([Connected platforms](https://learn.microsoft.com/en-us/microsoft-agent-365/admin/connected-platforms)). The audit record, the permission model and the inventory are tenant objects, held under the tenant's retention settings and read through Microsoft's consoles.

The company gets a strong control surface quickly, built on tools its IT team already runs. What it does not get is the register itself.

## The agent register can be a file instead

Kortix keeps its register in a manifest in the project's git repository. The starter manifest above is the real file a Kortix project starts with: one `agents:` map, and each entry names the agent's markdown file plus the connectors, secrets and permissions it enables. Behavior lives in `agents/<name>.md`; the manifest holds the grants. Open source. Read it, fork it, audit it.

A register in git also leaves a trail. The agent's commits sit in [the public Kortix repository](https://github.com/kortix-ai/suna) beside everyone else's, each one a diff with an author and a date. An audit that starts from a commit does not need a vendor console to answer who changed what.

## What portability means when the register is yours

Microsoft's documented portability is a solution that moves between Power Platform environments. That is a real convenience for development, test and production. It is not a way out of Microsoft's cloud, and Microsoft documents no export of a Copilot Studio agent to run on a runtime it does not operate.

When the register is a file, portability is a clone. The same manifest and the same agent files run on another host, and a fork copies the company's agent layer without a support request. Kortix runs on Kortix Cloud, in your VPC, or on your own on-prem network. Self-host is free.

## What the same governance looks like when you own the layer

Three things move into the repository. The register becomes a reviewed file, so a change to an agent's reach is a diff someone approves. Permissions become project objects. Per-resource permissions for people and agents. Roles, groups, and an audit trail. And the record stays where the work happened. Every action is recorded. Reading, exporting and streaming the audit log depend on the plan.

A security reviewer can open the manifest, read the grant on one agent and follow the commit that changed it. The same reviewer can read session history against the project rather than file a request with a vendor. The trade is real in both directions: a team that owns the register also owns the review work.

## Which one fits your team

If the agent estate is mostly Copilot Studio and Foundry, IT already runs Entra, Purview and Defender, and a per-person subscription fits the budget, Agent 365 gives a registry and policy quickly. If agents will outlive a tenant change, call systems outside Microsoft, or the register needs to be reviewable like code, own the layer. The two are not exclusive. A team can govern its Microsoft agents in Agent 365 and keep the agents it builds in a repo it owns.

For the console side of that split, the page on [managing Copilot agents](/copilot-agent-management) covers the admin view. If the confusion is which Microsoft builder produced a given agent, [Copilot Studio compared with Microsoft 365 Copilot](/microsoft-copilot-vs-copilot-studio) sorts that out, and [self-hosting](/self-hosting) covers what running the register on your own network involves.

## Questions buyers ask about Agent 365

### What is Microsoft Agent 365?

Microsoft's control plane for AI agents: one registry in the Microsoft 365 admin center, plus identity, access, security and audit through Entra, Defender and Purview. It observes, governs and secures agents. It does not host them.

### Is Agent 365 included with Microsoft 365 Copilot?

No. Microsoft's pricing FAQ says Agent 365 is needed in addition to Microsoft 365 Copilot to manage agents beyond Copilot. It is sold per person, standalone or in Microsoft 365 E7, and it is not part of E3 or E5.

### Where do the agents governed by Agent 365 actually run?

Where they were built. Copilot Studio agents run in a Power Platform environment, and Microsoft can connect agents from Bedrock, Vertex AI, Agentforce and other systems into the registry without running them.

### Can agents built in Microsoft's tools be run outside Microsoft 365?

The documented path moves a Copilot Studio agent between Power Platform environments as a solution. Agent 365 also reads agents from other systems into its registry. Microsoft documents no export to a runtime it does not operate.

## Put the agent register in a repo you own

Start with one project, read every grant before an agent runs, and keep the history.

[Try Kortix](https://kortix.com)