Agent 365: Managing Shadow AI and Enterprise Security Risks

Microsoft’s Agent 365 addresses the emerging threat of shadow AI, providing a centralized platform for governance and security of enterprise AI agents.

Microsoft recently elevated its management platform for AI agents, Agent 365, from a preview phase to general availability. This transition indicates a significant acknowledgment from Microsoft that the governance challenges surrounding autonomous AI systems have become not only operational but also imperative for enterprise security.

Initially unveiled at Microsoft’s Ignite conference in November, Agent 365 is positioned as a unified control plane. It enables enterprise IT and security teams to observe and secure AI agents across various environments, including Microsoft’s own ecosystem, third-party cloud platforms such as AWS Bedrock, and Google Cloud, as well as locally on employee devices.

The pressing aspect of this launch is Microsoft’s proactive approach to manage local AI agents—those coding assistants and productivity tools that employees are often installing without IT oversight. This phenomenon, termed shadow AI, represents a novel category of enterprise security risk that organizations are only beginning to understand.

Shadow AI as an Emerging Security Crisis

The introduction of Agent 365 underscores a harsh reality: AI agents are evolving at a pace that exceeds the existing governance frameworks constructed for traditional cloud applications and SaaS solutions. Enterprises that had previously established controls face a new ecosystem characterized by autonomous software capable of invoking tools, accessing sensitive data, and performing actions autonomously.

David Weston, Corporate Vice President of AI Security at Microsoft, highlighted three primary categories of security incidents currently observed within enterprise environments:

• Inadvertent Exposure: Developers frequently connect agents to backend systems, risking exposure of sensitive infrastructure, which can lead to potential leaks of personally identifiable information (PII).
• Cross-Prompt Injection: Attackers exploit untrusted data sources to embed malicious instructions into data that AI agents are likely to consume, manipulating them to perform unauthorized actions.
• Inadequate DLP Systems: Agents that connect to data loss prevention (DLP) systems lacking agent awareness are exposing highly sensitive data to vendors unknowingly, increasing risk and potential cost to organizations.

Agent 365: A Centralized Control Plane

Agent 365 serves as a centralized registry and policy management engine for AI agents. It provides IT administrators with a comprehensive view of every agent deployed within their organizations, whether developed using Microsoft Copilot Studio, running on AWS Bedrock, or installed locally on users’ machines.

At launch, Agent 365 categorizes agents into three distinct groups, each with varying availability:

• Delegated agents operating with user permissions (e.g., inbox organizers) are available now.
• Autonomous agents working behind the scenes with their own credentials (e.g., ticket triagers) are also generally available.
• Agents participating in collaborative workflows enter public preview today.

This platform is part of the Microsoft 365 E7 suite or available as a standalone product priced at $15 per user per month. This pricing structure accommodates the reality that agent counts can vary greatly within enterprises, allowing for predictable scaling.

Discovery and Management of Shadow AI

A significant innovation within Agent 365 is its capability to discover and manage local AI agents, particularly those tools that employees install directly on their Windows devices. Organizations enrolled in Microsoft’s Frontier program can utilize Agent 365 to identify OpenClaw agents active on managed devices.

Admins can view devices running OpenClaw and implement policies through Intune to block certain execution methods. This capability responds to enterprise demands for control over new types of software that employees wish to leverage while establishing definitive boundaries within their operations.

Microsoft intends to expand local agent discovery capabilities to include a total of 18 different agent types by June 2026, encompassing tools like GitHub Copilot CLI and Claude Code.

Asset Context Mapping and Security Assessments

Scheduled for June, Microsoft Defender will incorporate an asset context mapping feature. This will create relationship graphs illustrating which devices an agent operates on, its connections to servers, and associated identities, as well as the cloud resources those identities can access.

This feature enables security teams to assess potential risks should an agent become compromised or misbehave. Weston described how the graph-based approach enhances visibility into connected assets and helps determine critical business dependencies.

Agent 365 also includes policy-based controls that will allow administrators to regulate the capabilities of agents. In instances where a managed agent displays malicious behavior patterns, like attempting to access sensitive data, Microsoft Defender can interfere in real-time, issuing alerts with comprehensive incident contexts for further investigation.

Cross-Platform Governance

In a strategic maneuver, Microsoft is extending the reach of Agent 365’s governance to rival cloud platforms. A public preview of Agent 365 registry sync now allows IT teams to connect with AWS Bedrock and Google Cloud. This integration facilitates the automatic discovery and inventory of agents across these platforms, while enabling basic lifecycle governance, such as starting or stopping agents.

Weston stated, “If we’re going to be a single control plane, we have to meet customers where they are, and many of them are multi-cloud.” This cross-cloud governance ensures that while available controls may differ by provider, consistency is expected, improving the overall security posture.

Windows 365 for Agents: Securing AI Workloads

Microsoft is releasing Windows 365 for Agents to provide enterprises with a secure environment for running AI workloads. This offering generates a new type of Cloud PC designed specifically for agentic functionalities, governed by the same identity and security controls applicable to human employees.

This segmentation principle enhances security by isolating agent operations from employee endpoints while allowing organizations to harness the advantages of autonomous agents.

Conclusion: Navigating the Future of AI Governance

Microsoft’s rollout of Agent 365 signifies a critical shift in the governance landscape of AI agents, addressing the urgent need for enterprises to manage shadow AI and its associated risks. By establishing a centralized control platform, Microsoft is not only responding to security challenges but is also shaping the future of how organizations interact with and regulate autonomous systems. As enterprises adapt to this evolving environment, the implications for operational efficiency, security, and AI governance are profound and will require ongoing monitoring.

Observation recorded.