Microsoft Agent 365 is going Generally Available on May 1, 2026 — and the questions from customers are piling up fast -with or without M365 E7 License Plan. Whether you attended the recent product team AMA, caught the E7 announcement, or are simply trying to figure out what this means for your Microsoft 365 environment, this FAQ cuts through the noise.

What is Microsoft Agent 365?

Agent 365 is the control plane for AI agents in your organization. It is not an agent-building tool — that role belongs to Copilot Studio, Microsoft Foundry, or Agent Builder. Instead, Agent 365 gives IT and security teams a unified place to observe, govern, and secure every agent running in the tenant, whether built on Microsoft platforms or by third-party vendors. Think of it as the equivalent of what Microsoft Purview and Entra did for users and data — now extended to agents.​​

Two Authentication Flows: OBO vs. Agent Identity

This is where things get technically important. Microsoft Agent 365 supports two authentication flows powered by Microsoft Entra Agent ID — and they are not equal at GA.​

On-Behalf-Of (OBO) Flow — GA on May 1st
This is the launch model. The agent receives a user’s delegated token, exchanges it, and then performs actions as if the user is performing them, with the user’s own permissions and context. It is ideal for accessing user-specific data like emails, calendar entries, and files, for performing actions that require explicit user consent, and for any scenario where user context and permissions must be preserved. Strong auditing is built in, making this flow the compliance-friendly choice for reactive, user-triggered agent scenarios.​​

Agent Identity Authentication — Still in Preview
Here, the agent authenticates using its own credentials (agent blueprint credentials), operates independently with its own assigned permissions, and maintains a separate identity from any human user. This model is ideal for truly autonomous operations: scheduled tasks, monitoring jobs, sending emails or creating meetings from the agent’s own mailbox, creating and managing agent-owned resources, and background processing with no user interaction required. It is powerful — but it stays in preview beyond May 1st.​​

The distinction matters enormously for how you design and license your agents right now.

What Happened to the Per-Agent Licensing Model?

This is the question Jukka Niiranen at licensing.guide asked the moment the GA announcement landed — and it is a valid one. Early Frontier program documentation explicitly used a per-agent construct. That model has been replaced at GA with a per-user SKU at $15 per user per month, available standalone or as part of Microsoft 365 E7.​​

The reason, confirmed by the product team in the AMA (Agent 365 Ask me Anything), is budgeting predictability. Organizations know how many users they have. They have no reliable idea yet how many agents those users will eventually spin up — especially since Agent 365 itself is the tool you would use to discover that inventory in the first place. Making customers count agents before they even know what agents they have would be a chicken-and-egg problem that stalls adoption before it starts.​​

So What Does the License Actually Cover?

The per-user Agent 365 license covers all agents acting on behalf of that licensed user via the OBO flow. No separate license is required per agent in this model. Agents inherit the tools and skill sets from however they were built — Copilot Studio, Foundry, or third-party platforms — and Agent 365 adds the governance, identity, and security layer on top. If a user already has Microsoft 365 Copilot, their OBO agents can access Word, Excel, Outlook and more without additional licensing.​​

What is not covered at GA is the “AI teammate” scenario: agents with their own mailboxes, OneDrives, and independent identities. That scenario maps to the Agent Identity Authentication flow, which remains in Frontier preview — with Frontier trial licenses now extended to December 2026, a clear signal Microsoft is still building toward it.​

​

Is Agent 365 Included in E5?

No. Agent 365 is not part of Microsoft 365 E5. It is either purchased as a standalone add-on or included in the new Microsoft 365 E7 Frontier Worker Suite, which also bundles Microsoft 365 Copilot, E5 security and compliance, and Entra Suite.​​

What Should Organizations Do Right Now?

Start by mapping which agents in your environment are operating via the OBO flow today — those are the agents Agent 365 GA governs immediately. For autonomous or identity-owning agent scenarios, keep them in controlled Frontier preview and watch how the authentication and licensing story evolves post-May 1st. The agent identity authentication flow is coming — but it is not the GA story yet.

Agent 365 reaches GA on May 1, 2026. The OBO flow is live. Autonomous agent identity is next. The control plane is ready — the digital workforce is still loading.

PS: Ready to implement proper AI agent governance? Contact me, Ragnar Heil, for a consultation on Agent 365, SharePoint Advanced Management, Microsoft Purview (Information Protection, Data Loss Prevention Policies, DSPM for AI), Rencore Governance, EasyLife365 Collaboration, ShareGate Protect, Data&More or Agent 365 deployment strategies tailored to your organization’s needs. Find my calendar here at our HanseVision Governance Landing Page.

The post Microsoft Agent 365 FAQ: What You Need to Know Before May 1st first appeared on Ragnar Heil (MVP): Empowering M365 with AI.

Original Post https://ragnarheil.de/microsoft-agent-365-faq-what-you-need-to-know-before-may-1st/