Reference
Microsoft Agent 365
Monitors agents and apps in the Microsoft 365 tenant agent registry
Rencore Governance inventories 12 object types for Microsoft Agent 365 and ships 37 policies and 11 automations.
Inventories
| Object | Description | Properties |
|---|---|---|
| Agent Blueprint | Microsoft Entra agent identity blueprint - a template (inherits from application) that defines the configuration agent identities created from it inherit. Holds credentials (keyCredentials, passwordCredentials, federatedIdentityCredentials), inheritable permissions, owners, and sponsors. | 30 |
| Agent Blueprint Principal | Service principal record of an agent identity blueprint's addition to the tenant. Inherits from servicePrincipal; used for token issuance and audit. Linked to an agentIdentityBlueprint via appId. | 25 |
| Agent Identity | Microsoft Entra agent identity - the identity object (inherits from servicePrincipal) used by an AI agent to authenticate. Bound to one agentIdentityBlueprint via agentIdentityBlueprintId; has its own owners and sponsors. | 25 |
| Agent Action | Reusable action an agent can perform against an external system (e.g. sendEmail, createTask). Its relations list every agent that can perform it. | 7 |
| Agent Capability | Reusable capability (e.g. WebSearch, CodeInterpreter, GraphConnectors). Its relations list every agent that can use it. | 7 |
| Agent Element | Individual elements (Agent Builder agents, custom engine agents, bots, add-ins) contained within an agent package. | 13 |
| Agent | Agents and apps registered in the tenant agent registry (Microsoft 365 admin center > Agents > All agents). Each package may contain one or more elements (Agent Builder agent, custom-engine agent, bot, Office add-in). | 26 |
| Agent Knowledge Source | Reusable knowledge source an agent reads from (e.g. a SharePoint site or Graph connector). Its relations list every agent that reads from it. | 7 |
| Agent User | Microsoft Entra agent user - a specialized user (inherits from user) for AI agents that need a user account (mailbox, Teams presence). One-to-one with a parent agent identity via identityParentId. Has manager + multi-sponsor relationships to real users. | 30 |
| Agent Permission | A Microsoft Graph (or other resource) permission scope. Inheritable permissions on blueprints and grants on identities both link back to this entity so a single permission can be opened to see every agent that declares or holds it. | 10 |
| Shadow AI Agent | Unmanaged local AI tools and agents (chatbots, coding assistants, local models, agentic CLIs) detected on Intune-managed devices that were not approved by IT. | 16 |
| Shadow AI Detection | A detection of a shadow AI agent on a specific managed device, linked to the device's Microsoft 365 user. | 17 |