📌 Author's note: Independent, not affiliated with or endorsed by Microsoft. This site is a starting point — verify current product status against Microsoft documentation before architecture or purchasing decisions.

Microsoft AI agent estate

Where do your agents leave a trace?

Seven ways an agent gets created, the identity each one receives, and the fourteen places they emit telemetry. Dashed lines are the ones that matter — they only carry data if a licence or a per-agent setting is in place, which is where every blind spot in this estate lives.

Click any node to trace it. Each edge means emits to; identity is shown as a chip because telemetry does not route through it. Solid edges always carry data, dashed only under the stated condition. The grey tag on a table is its licence gate; select a node to see what each connection actually delivers.

Coverage, path by path

The same relationships as a table — useful when the question is “can this screen see that agent?” rather than “where does this agent land?”. Always · Conditional · Never.

Four screens, four counts

Ask a tenant how many agents it has and you can collect four defensible answers in one afternoon. The Agent Registry counts published titles — things people could run, whether or not anyone does. Defender's inventory counts what security tooling can see, and is the only screen that includes agents living on laptops. Entra counts what holds a directory principal — an identity that can actually be governed. And the registry's own catalog API has been observed disagreeing with the registry's portal tile for the same tenant, in Microsoft's own documentation.

The numbers disagree by design, not by defect. Each screen answers a different question: could it run (registry) · can we see it (Defender) · can we govern it (Entra) · what actually ran (the runtime tables on this map). Treating any one of them as the inventory is how an estate ends up confidently wrong.

So the reconciliation itself is the finding, and it's how I open every engagement. Present the spread, not a number — because each gap between two screens names its own work item. Registry-but-not-Entra is the ungoverned population (Classic Copilot Studio lives here). Defender-local-but-nowhere-else is the endpoint estate nobody put on the risk register. Entra-but-telemetry-silent means observability was never instrumented. A single count tells you none of that.

The rule that falls out: never quote an agent count without saying which screen it came from.

Surfaces are not interchangeable

A workbook tile queries exactly one surface. Querying a table on the wrong one fails — it does not degrade. And graceful degradation via union isfuzzy=true is a Log Analytics property only: on Advanced Hunting and the data lake, a table absent from the tenant schema returns a hard 400.

Advanced Hunting uses Timestamp. Log Analytics uses TimeGenerated. Streamed tables carry both — and if data arrives more than 48h late, ingestion overwrites TimeGenerated with now().

Seeing is free, governing is not

Microsoft: “Agent ID is available for all Microsoft Entra customers”, but “extending Microsoft Entra security features to agents requires Microsoft Agent 365”. So agent identities are readable at any tier; Conditional Access, ID Protection and governance are not.

AgentsInfo runs the other way: cloud agents need Agent 365, local agents need only Defender for Endpoint P2. So at E5 you hold three partial inventories — the registry (biggest number), Entra (the better identity inventory), AgentsInfo (the local agents) — and none is complete.

Blueprints outrank agents

Agent identities “don’t have credentials of their own — they authenticate using tokens issued by their agent identity blueprint.” Permissions granted to a blueprint are granted to every agent created from it, and inheritable permissions propagate consent automatically without appearing on the agent.

One leaked blueprint secret is therefore not one compromised agent. It is all of them, at once, at runtime, with their inherited permissions. Inventory blueprints before agents.

Read this before quoting a number

Preview surfaces: AgentsInfo, BehaviorInfo, BehaviorEntities, local agent discovery and much of Agent 365. BehaviorInfo is unavailable in GCC.

catalog/packages is a beta endpoint, and Microsoft’s own portal tile has been observed reporting a materially different count for the same tenant. Classic Copilot Studio agents (pre-May 2026) hold ordinary app registrations and appear in no agent view — find them by the service principal tag AgentCreatedBy:CopilotStudio.

Third-party is not one population

Agent 365 ships with preintegrated partners — 23 at launch, every one registered and observable. A partner agent is registered and its activity visible; an AI teammate also has its own user account, mailbox and Teams presence; an agent factory (Kore, n8n, Kasisto, NVIDIA NeMo) mints an Entra Agent ID for every agent it creates. Vertex AI and Bedrock agents can be registered with no development work.

So an onboarded partner agent emits the same OpenTelemetry spans as a Foundry agent. The SDK’s four capabilities are independent, and observability “can use either the agent identity blueprint or a standard Microsoft Entra app registration” — never infer an agent identity from the presence of telemetry, or the reverse.