Result

Microsoft native first

Key path: 1a, 2b, 4b

In short: if your agents live mostly inside Microsoft 365 and Copilot Studio, start with Entra Agent ID and Agent 365. You get sponsors, Conditional Access and governance in tools you already run. Add a governance layer only when agents start reaching non-Microsoft tools.

Identification

Your agents are built and used inside the Microsoft estate and your staff sign in through Entra ID. You start with Microsoft's native agent identity and management before buying anything else.

Field marks: what does this look like in practice?

• Most agents are Copilot Studio or Microsoft 365 Copilot agents.
• Your team already runs Conditional Access and Identity Governance.
• Few agents call tools outside Microsoft.

What should I require from a product?

1. Every agent has a sponsor recorded in the directory.
2. Conditional Access policies cover agents, not only users.
3. On-behalf-of agents fall under access reviews.
4. Licensing for Agent 365 is budgeted per user.
5. A trigger is defined for adding a governance layer when agents reach non-Microsoft tools.

Which products fit?

Listed by fit to the requirements above, using each vendor's public material. This is not a ranking.

What is this result confused with?

• Per-action approval alongside Entra: Pick that when a person must approve risky actions.
• Discovery first: Pick that when agents exist outside Microsoft and nobody knows how many.

What does your identity provider already cover?

• Entra Agent ID is available for all Entra customers. Microsoft Entra Agent ID, read 2026-11-03
• Agent 365 is GA since 1 May 2026 at $15 per user per month. Microsoft Agent 365 generally available, read 2026-11-03

An agent governance layer runs alongside your identity provider, never instead of it.