Reference

Microsoft Agent 365

Monitors agents and apps in the Microsoft 365 tenant agent registry

Rencore Governance inventories 12 object types for Microsoft Agent 365 and ships 37 policies and 11 automations.

Inventories

ObjectDescriptionProperties
Agent BlueprintMicrosoft Entra agent identity blueprint - a template (inherits from application) that defines the configuration agent identities created from it inherit. Holds credentials (keyCredentials, passwordCredentials, federatedIdentityCredentials), inheritable permissions, owners, and sponsors.30
Agent Blueprint PrincipalService principal record of an agent identity blueprint's addition to the tenant. Inherits from servicePrincipal; used for token issuance and audit. Linked to an agentIdentityBlueprint via appId.25
Agent IdentityMicrosoft Entra agent identity - the identity object (inherits from servicePrincipal) used by an AI agent to authenticate. Bound to one agentIdentityBlueprint via agentIdentityBlueprintId; has its own owners and sponsors.25
Agent ActionReusable action an agent can perform against an external system (e.g. sendEmail, createTask). Its relations list every agent that can perform it.7
Agent CapabilityReusable capability (e.g. WebSearch, CodeInterpreter, GraphConnectors). Its relations list every agent that can use it.7
Agent ElementIndividual elements (Agent Builder agents, custom engine agents, bots, add-ins) contained within an agent package.13
AgentAgents and apps registered in the tenant agent registry (Microsoft 365 admin center > Agents > All agents). Each package may contain one or more elements (Agent Builder agent, custom-engine agent, bot, Office add-in).26
Agent Knowledge SourceReusable knowledge source an agent reads from (e.g. a SharePoint site or Graph connector). Its relations list every agent that reads from it.7
Agent UserMicrosoft Entra agent user - a specialized user (inherits from user) for AI agents that need a user account (mailbox, Teams presence). One-to-one with a parent agent identity via identityParentId. Has manager + multi-sponsor relationships to real users.30
Agent PermissionA Microsoft Graph (or other resource) permission scope. Inheritable permissions on blueprints and grants on identities both link back to this entity so a single permission can be opened to see every agent that declares or holds it.10
Shadow AI AgentUnmanaged local AI tools and agents (chatbots, coding assistants, local models, agentic CLIs) detected on Intune-managed devices that were not approved by IT.16
Shadow AI DetectionA detection of a shadow AI agent on a specific managed device, linked to the device's Microsoft 365 user.17

Last updated: 7/19/2026