The governance crisis hiding in plain sight, and what the Microsoft control plane actually solves.

Enterprises are deploying AI agents at a pace that has outrun every governance framework designed to manage them. Agents are being spun up inside Copilot Studio, built on Azure AI Foundry, embedded into third-party SaaS platforms, and running locally on employee devices. Nobody has a complete inventory. Nobody knows what data they are touching. And in most organisations, nobody has been asked to find out.

This is agent sprawl. It is not a future risk. It is happening now.

IDC projects that 1.3 billion AI agents will be in circulation by 2028. Microsoft's own data from early Agent 365 preview programmes showed tens of millions of agents appearing in enterprise registries within just two months of availability. The scale of deployment has fundamentally outpaced the scale of oversight.

Everyone wants an AI agent. Nobody is entirely sure what they want it for. But they know they want a lot of them.

That tension sits at the heart of the agent sprawl problem. The enthusiasm for agentic AI is genuine and well-founded. But enthusiasm without structure creates risk, not value. The question for enterprise IT and security leaders is no longer whether to adopt agents, but how to govern them when they are already everywhere.

What Agent Sprawl Actually Looks Like

Agent sprawl is not a single problem. It is the convergence of several governance gaps that compound each other.

1. Ownerless agents. An employee builds an agent in Copilot Studio to automate a procurement workflow. It has access to SharePoint, reads financial documents, and sends Teams messages on the employee's behalf. When that employee leaves the organisation, the agent keeps running. Nobody knows it exists.

2. Shadow AI on endpoints. A developer team builds a local AI agent on their workstations using an open-source framework. It reads files, executes code, and calls external APIs. The security team has no visibility into any of it.

3. Cross-cloud fragmentation. Agents built on Microsoft Foundry, AWS Bedrock, and Google Vertex AI are all operating across the same enterprise environment. There is no single registry, no shared governance framework, no consistent access controls.

4. No telemetry or accountability. Business units are measuring agent usage by feel rather than by data. There is no telemetry on performance, no audit trail for decisions made, and no ROI tracking for the investment.

Each of these situations is independently manageable. All of them happening simultaneously, in an organisation that is scaling agent adoption quickly, creates the governance crisis that most enterprises are now quietly sitting inside.

Why Traditional IT Governance Does Not Transfer

Organisations that have mature governance for devices, applications, and users often assume that same framework will extend to agents. It does not, for three structural reasons.

First, agents are not passive. Unlike a piece of software that responds to user input, an agent acts autonomously. It makes decisions, takes actions, and sometimes interacts with other agents without human intervention at each step. Governance models built around human-initiated actions do not map cleanly onto autonomous behaviour.

Second, agents proliferate much faster than devices or applications. A single employee with access to Copilot Studio can create dozens of agents in an afternoon. The creation velocity is orders of magnitude higher than anything IT governance was designed to track.

Third, agents blur the line between identity and tool. An agent can be granted permissions, hold credentials, access data, and take actions as if it were a user. But it is not a user. It has no employment contract, no performance review, and no natural lifecycle unless one is deliberately enforced. Without an explicit governance model that treats agents as first-class identities, alongside humans, they operate in a permissions gap.

What Microsoft Agent 365 Actually Does

Agent 365, which reached general availability in May 2026, is Microsoft's answer to this problem. It is not a tool for building agents. That is the job of Copilot Studio and Microsoft Foundry. Agent 365 is the control plane that sits above all of it.

Microsoft organises the platform around three pillars: Observe, Govern, and Secure.

Observe: Seeing the Full Agent Estate

The foundation of any governance programme is inventory. Agent 365 provides a centralised Agent Registry that surfaces every agent operating across the Microsoft 365 environment, including agents built with Microsoft tools, agents from ecosystem partners, and self-registered agents from other platforms.

The registry does not just list what exists. It maps relationships between agents, visualises how they connect, tracks performance over time, and surfaces risk signals. Business leaders can see adoption rates and ROI metrics. Security leaders can see exposure and access patterns. IT administrators can see the full operational picture from a single hub.

Cross-cloud registry sync extends this visibility to agents running on AWS Bedrock and Google Cloud, acknowledging the reality that enterprise environments are rarely single-vendor. The aspiration is a genuine, comprehensive view of the entire agent estate regardless of where each agent was built or where it runs.

Govern: Lifecycle, Access, and Accountability

Governance without teeth is just reporting. Agent 365 enforces lifecycle policies through automated rules. Inactive agents can be set to expire automatically. Ownerless agents can be reassigned through defined workflows. Risky agents can be blocked before they create problems rather than after.

Access control is managed through Microsoft Entra Agent ID, which extends the same identity model used for human users to AI agents. This means conditional access policies, least-privilege permissions, and consistent access reviews apply to agents in the same way they apply to employees. An agent can only use the data, tools, and MCP servers that it has been explicitly authorised to access.

Policy templates allow IT teams to apply standardised security, compliance, and access configurations at the point of onboarding rather than retroactively. Every agent starts governed, not every agent gets retrofitted for governance later.

Secure: Protecting Agents and the Data They Touch

The security surface created by AI agents is genuinely new. Prompt injection attacks, data exfiltration through agent interactions, and compromised agent identities are threat vectors that did not exist at meaningful scale three years ago.

Agent 365 extends Microsoft Defender to treat agents as first-class security entities. Defender provides context mapping that shows where an agent runs, which MCP servers are configured, which identities are associated with it, and which cloud resources those identities can reach. If an agent exhibits malicious behaviour patterns, such as attempting to access or exfiltrate sensitive data, Defender can block it in real time and generate incident alerts with full contextual detail.

Microsoft Purview extends data loss prevention and compliance controls to cover agent interactions. Information protection policies apply to the data agents create and consume, not just the data humans create and consume. This closes a compliance gap that most organisations have not yet fully quantified.

The Partner and Managed Service Opportunity

Agent 365 is a platform, not a programme. The technology handles the infrastructure of governance. But the hard work of designing governance frameworks, assessing readiness, configuring policies, managing onboarding workflows, and keeping pace with the ongoing expansion of the agent estate is implementation and advisory work. That is where partners come in.

For organisations that are already deep into Microsoft deployments, the Agent 365 conversation connects directly to existing investments. Organisations on Microsoft 365 E5 are already licensed for many of the Entra, Purview, and Defender capabilities that Agent 365 draws on. The governance question becomes: are you using what you have already paid for to govern what you are rapidly acquiring?

The organisations that will derive the most value from the agent era are not necessarily the ones that deploy the most agents. They are the ones that deploy agents with the most deliberate structure around accountability, performance, security, and lifecycle management. Governance is not the brake on AI adoption. It is the foundation that makes sustained adoption possible.

What Enterprises Should Be Doing Right Now

The agent sprawl problem compounds over time. Every month of ungoverned deployment is a month of accumulated risk, orphaned assets, and untracked data exposure. The practical steps are not complex, but they do require a deliberate decision to start.

5. Conduct an agent inventory before assuming you know what you have. The gap between what IT believes is running and what is actually running is typically significant.

6. Establish an ownership model for agents before scaling deployment. Every agent should have a named owner, a defined purpose, and a planned lifecycle from the point of creation.

7. Evaluate Agent 365 licensing in the context of existing Microsoft agreements. For many organisations on E5, the governance infrastructure is already accessible.

8. Extend security policy to cover agents explicitly, including prompt injection protections, data access boundaries, and audit logging requirements.

9. Build governance habits early. The organisations retrofitting governance onto hundreds of deployed agents are finding it substantially harder than those who defined the model before the deployment scaled.

The Bigger Picture

Microsoft's launch of Agent 365 is not just a product announcement. It is a signal about where enterprise AI is heading. The Copilot era was about augmenting individuals. The agent era is about automating workflows at the organisational level. That shift carries different stakes, different risks, and a fundamentally different requirement for oversight.

The organisations that treat governance as an afterthought will find themselves managing AI risk rather than AI value. The organisations that get ahead of it will have the structural foundation to scale agent adoption confidently, demonstrate compliance, and capture the productivity gains that agentic AI genuinely makes possible.

Agent sprawl is not inevitable. It is a governance choice. And the tools to make a better choice are now generally available.

Want to understand where your organisation stands on agent governance readiness?

VE3 works with enterprise teams across the UK and beyond to design, implement, and manage Microsoft AI governance frameworks. Get in touch to start the conversation.