Inventory before governance

The order in which organisations approach agent governance is almost always backwards. First comes a policy, then an approval process, then a committee. And then somebody asks the question you should have started with: how many agents are actually running here?

This dispatch is a reference on taking inventory. The date of the last review is at the top.

Why counting comes first

A policy without an inventory governs the agents that have yet to be built. It does not touch the ones already running. And those are the problem, because they came into being without rules, at a time when nobody was looking.

There is also a political effect I observe in every project: a number changes the conversation. As long as agent governance is discussed in the abstract, it is a line on a roadmap. The moment a list of 140 entries lands on the table, sixty of them with no identifiable owner, it becomes a topic with a deadline.

The classes I count in

Not every agent needs the same degree of control. Risk follows autonomy, and I sort into three levels.

Green: interactive. The agent answers when asked, reads from knowledge, does nothing on its own. A FAQ agent over a SharePoint library. Visibility is enough here.

Amber: acting. The agent writes into systems, calls connectors, sends things. It still acts on prompting, but the consequences leave the chat. Here you need an owner, a permissions review and logging.

Red: autonomous. The agent runs on a schedule or on an event, touches sensitive data, calls external APIs, delegates to other agents. Here you need all of it: identity, conditional access, DLP, record keeping, named accountability.

Most organisations today are predominantly green. The jump happens quietly: the moment somebody sets a schedule or adds a connector, an agent moves from green to amber or red without anyone having made a decision. That transition is exactly what you want to make visible.

Where you actually look

There is no single place where everything is listed. There are at least six.

Copilot Studio. Since May 2026 there is an agent inventory schema that lets you discover and audit all Copilot Studio agents in an organisation, from the admin center, through the API, or through Azure Resource Graph. The Azure Resource Graph route is the interesting one, because it can be queried and written into a report rather than living in a portal.

Microsoft 365 Copilot. Agents users built in Agent Builder. Those appear in nobody's list, because they were never perceived as software.

Agent 365. The registry as a cross-cutting inventory, plus Defender for Agents for shadow AI discovery. Foreign platforms such as AWS Bedrock AgentCore and Google Gemini Enterprise are included at GA through registry sync in preview, but without runtime enforcement.

Microsoft Foundry. Agents in Foundry projects, hosted agents, scheduled routines. The people responsible here usually sit in engineering rather than the modern work team, which is why this list gets forgotten in governance projects with some regularity.

Power Platform. Agent flows, flows with AI actions, prompts in Prompt Builder. Formally not agents, practically the same question: what runs automatically, with which permissions?

Everything outside. A script with an API key on a machine in a business department. A Zapier-like service with an account somebody created two years ago. You will not find this list with a tool. You find it by talking to people.

The fields a row needs

Keep it narrow enough that somebody actually fills it in.

Field

Why

Name and platform

Findability

Owner, a named person

Not a department, not a distribution list

Purpose in one sentence

Without it, the question of decommissioning cannot be answered

Class: green, amber or red

Drives the effort

Trigger: request, schedule, event

The transition to autonomous

Data access

Which sources, what sensitivity

Identity

Entra Agent ID, app registration or unknown

Credentials carried

API keys, MCP tokens, connector credentials

Last used

The column that clears out the most

Cost centre

Mandatory once billing is consumption-based

The "credentials carried" row is the one no tool fills in for you. Agent 365 governs who the agent is. What it carries in downstream grants, keys and secrets sits outside that scope and therefore inside your responsibility.

The "last used" row is the one with the most effect. In every inventory I have supported, a substantial share of the agents found had been unused for months. Switching things off is the cheapest governance measure there is.

The sequence

1. Technical collection from Copilot Studio, Agent 365, Foundry and Power Platform. That is an afternoon once you have the access.
2. Assign owners. Anything without an owner gets a deadline, then it is disabled rather than deleted. Disabling is reversible and produces exactly the feedback you need: whoever complains is the owner.
3. Classify into green, amber and red. In pairs, not alone.
4. Clear out. Unused and unowned gets switched off. That often shrinks the list by a third.
5. Only now write the rules. The policy you write at this point knows reality and fits it.
6. Repeat. Quarterly, with the same query. An inventory that happens once is a snapshot, not a control.

The questions I read maturity from

Four questions, and anyone who can answer them without hesitating is further along than most:

• Can you say how many agents are running in your tenant?
• Does each one have a named person as owner?
• Do you know which of them act without human prompting?
• Do you know which credentials they carry?

The fourth question is where it almost always goes quiet.

The honest postscript

An inventory is unspectacular. It is not a demo, it looks bad on a slide, and nobody gets promoted for it.

It is still the only measure on this list that works without a licence decision, without a project and without an approval. You can start on Monday. Everything else in agent governance assumes it exists.

Sources

• Use the agent inventory schema, Microsoft Learn, on collection through the admin center, API and Azure Resource Graph
• What is Microsoft Entra Agent ID?, Microsoft Learn
• Protect agent identities with Microsoft Entra, Microsoft Learn
• Agent 365 and Entra Agent ID compared, Oasis Security, 3 June 2026, secondary source on coverage limits, legacy agents and registry sync for foreign platforms
• Agent 365 Security Guide, 18 June 2026, secondary source on risk classification by degree of autonomy