How to inventory AI agents in Microsoft 365: Find every agent, owner, permission and identity

Most Microsoft 365 tenants now hold agents that nobody listed: shared Copilot Studio and Agent Builder agents, partner agents installed from the store, Foundry agents and agents with their own Entra identity. No single screen used to show all of them, and the views that exist count them differently. This runbook builds one reconciled inventory from the Microsoft 365 admin center agent registry, the Microsoft Graph package API, the Power Platform inventory, the Entra agent identities list and the Purview audit log. It covers read-only discovery first, then ownership fixes, blocking and soft deletion with a rollback. It is for Microsoft 365, Entra and Power Platform administrators and the security engineers who own AI governance. For the operating model behind a registry, see the AI agent registry guide.

This is an independent guide from NHI Mgmt Group, based on Microsoft's public documentation as of November 2026. It is not sponsored or reviewed by Microsoft. Agent 365 features are changing quickly, so confirm menu names and licensing against Microsoft's current documentation.

Key takeaways

• Start in the agent registry. Agents > All agents in the Microsoft 365 admin center is Microsoft's unified inventory, including agents without an Entra agent identity, and viewing it needs no specific licence.
• Use the least privileged role. AI Reader is the documented least-privilege role for viewing agents in Agent 365 and Entra Agent ID; keep AI Administrator and Agent ID Administrator for the change steps.
• Reconcile four sources, not one. The registry, the Power Platform inventory, the Entra Agent identities list and Purview audit records each see a different slice, and duplicate rows in the registry are by design.
• Fix owners before you block. Shared agents become ownerless when their creator is deleted; Assign new owner is the documented fix for shared Agent Builder and Copilot Studio agents.
• Prefer reversible actions. Block and soft delete can be undone (soft deleted agents can be restored for 30 days); Permanently delete cannot.

When you need this

• Before broad Copilot or Agent 365 rollout: establish a baseline so that every later agent is a change you can see, review and attribute.
• After a leaver wave or reorganisation: the registry's Agents without owners tile shows shared agents whose creator has left.
• For an audit or AI register request: NIST SP 800-53 CM-8 and NIST CSF 2.0 ID.AM-02 expect a maintained inventory of software and services; agents are part of that estate. The AI Register and AI Inventory Template gives the governance record this inventory feeds.
• After a consent phishing or agent abuse report: you need to find every agent with a given connector, permission or authentication pattern quickly. The CoPhish 2025 case showed Copilot Studio agents being used to wrap OAuth consent phishing in a trusted Microsoft domain, which is the kind of agent an inventory must surface.

Where agents show up in Microsoft 365

Microsoft is converging agent visibility under Agent 365. The Microsoft 365 admin center becomes the unified registry and control plane, while Entra continues to provide identity through Agent ID and lists only agents that have an Entra agent identity. In practice you still need several views, because each answers a different question.

The registry groups agents by publisher type. Treat each type differently in the inventory, because the available admin actions differ.

Before you start

• Roles: grant AI Reader to the people running discovery. For the Entra sign-in log steps, Reports Reader is the documented minimum. Keep AI Administrator (registry actions), Agent ID Administrator (agent identity changes) and Power Platform Administrator in a separate, approved group for steps 7 to 9. The Microsoft Entra Agent ID Guide explains the identity model behind those roles.
• Licensing: viewing the registry needs no specific licence. Risk signals, the registry Security tab and the Graph package API need a Microsoft E7 or Agent 365 licence. Check Billing > Licenses > Subscriptions before you plan around them.
• Conditional Access: if MFA is enforced for Azure Resource Manager, the Power Platform inventory may not load until the Power Platform admin center application and Microsoft Azure Management are included in that policy, as Microsoft documents.
• Record format: agree the fields first: agent name, IDs (package ID, Copilot Studio ID, Entra object ID), publisher type, platform, environment, owner, sponsor, channels, deployment scope, permissions, knowledge sources, tools, last activity and decision. Store it with your AI register.

Step-by-step

Steps 1 to 6 are read-only. Steps 7 and 8 change ownership or access but are reversible. Step 9 is destructive.

1. Export the registry. In the Microsoft 365 admin center go to Agents > All agents > Registry, clear any saved filter (Microsoft notes that a leftover filter is the usual reason an agent seems missing), then choose Export with All agents. Note the summary tiles: Total agents, Agents without owners, Unmanaged agents and Agents at risk. Export the active users report too; it lists each user's total agents used, sessions and last activity for the last 30 days.
2. Pull the same list from Microsoft Graph. Scripting the list gives you a repeatable baseline and fields the export may not include, such as isBlocked, deployedTo and agentIdentityId. Microsoft's documented pattern uses Graph PowerShell with paging:

   Connect-MgGraph -Scopes 'CopilotPackages.Read.All'
   $uri = "https://graph.microsoft.com/v1.0/copilot/admin/catalog/packages"
   do {
     $response = Invoke-MgGraphRequest -Method GET -Uri $uri
     $response.value | ForEach-Object { $_ } | Export-Csv packages.csv -Append -NoTypeInformation
     $uri = $response.'@odata.nextLink'
   } while ($uri)

   Useful documented filters include $filter=supportedHosts/any(h:h eq 'Copilot'), elementTypes values DeclarativeAgent and CustomEngineAgent, platform values Copilot Studio and Microsoft 365 Copilot Agent Builder, and lastModifiedDateTime ge for changes since the last run. The API rejects or, ne and contains with 400 Bad Request, so filter further offline.
3. Open the details of every agent that matters. For agents published by your org, shared agents and partner agents, open the details pane and record: the Users tab (Installed for and Available to), the Data & Tools tab (Can read capabilities, knowledge sources, tools such as Microsoft 365 connectors, MCP servers and custom actions, and the Agent ID), and the Permissions tab, which separates application and delegated permissions. Flag any application permission such as Group.Read.All or RoleManagement.Read.Directory for review. Data & Tools is read-only and can be empty if metadata has not synced, so an empty tab is not proof of no access.
4. Export the Power Platform inventory. In the Power Platform admin center open Manage > Inventory, filter to agents, and choose Download, which exports the whole inventory to CSV rather than just the loaded rows. Add Environment type and Connectors columns first. Check Manage > Copilot Studio > Classic chatbots separately. For a scheduled job, Microsoft documents pac resource-query query-resources (preview), the Power Platform API and Azure Resource Graph; the Query Power Platform resources connector action needs delegated user authentication and returns 403 for service principals. Agents sitting in the default environment deserve a closer look; the Securing Microsoft Copilot Studio Agents Guide covers why.
5. List agent identities in Entra. Go to Entra ID > Agents > Agent identities, use Choose columns to show Blueprint App ID, Owners and Sponsors and Uses agent identity, and export. A value of No in Uses agent identity means the agent uses an ordinary service principal. Then open Agent blueprints and use View linked agent identities for each blueprint. To see which agents actually authenticate, filter Entra ID > Monitoring & health > Sign-in logs with Is Agent = Yes, or query Graph:

   GET https://graph.microsoft.com/beta/auditLogs/signIns?$filter=signInEventTypes/any(t: t eq 'servicePrincipal') and agent/agentType eq 'AgentIdentity'

   This is a beta endpoint, so treat its shape as subject to change.
6. Add usage from Purview audit. In the Purview portal choose Audit and search the operation CopilotInteraction (Microsoft Copilots) and ConnectedAIAppInteraction (custom-built agents registered in your organisation) for 30 to 90 days. Export and group by AgentId, whose prefix shows the category (for example CopilotStudio.Declarative. or CopilotStudio.CustomEngine.), and by AgentName. Microsoft advises filtering on AppIdentity offline after export. Admin operations such as CreatePlugin and DeletePlugin show changes to the estate.
7. Reconcile and assign owners (reversible). Join the sources on agent ID and name. Classify each agent as approved, needs owner, needs review or remove. For ownerless shared Agent Builder and Copilot Studio agents use Assign new owner; the new owner gets full edit and delete rights and the previous owner loses all access. For Agent Builder agents with an owner, Add owner gives a second owner; groups are not supported. Set owners and sponsors on Entra agent identities as well, and see Agent Identity Recertification for the review cycle.
8. Contain what you cannot justify (reversible). Use Block in the registry or the Power Platform inventory for published agents, or Uninstall for agents installed for users. Know the scope: blocking a Foundry or SharePoint agent affects only Microsoft 365 Copilot Chat, while blocking an Agent Builder or Copilot Studio agent also affects Copilot and other host apps. For an agent identity, use the Entra disable control, which blocks its sign-ins. Hold this state for a full business cycle. If the Power Platform Firewall is in active enforcement mode, admin center actions fail and Microsoft directs you to the Power Platform API instead.
9. Delete (soft, then permanent). Delete agent soft deletes: the agent is unavailable but retained, and Restore agent works for 30 days, after which Microsoft 365 deletes it permanently. Permanently delete removes the agent and its resources at once and cannot be undone, so use it only after the hold period and owner sign-off. Foundry agents also have Stop, which deallocates compute and needs the Azure AI Owner role.

Verify it worked

• Counts reconcile: every registry row maps to an inventory record, and every Entra agent identity with sign-ins maps to a registry or Power Platform agent. Unmatched identities are your shadow agents.
• Owner tile: Agents without owners falls to zero, or each remaining item has a ticket.
• Blocked state is real: the Graph package shows isBlocked true, the Entra identity status shows Disabled, and Purview shows no new CopilotInteraction records for that AgentId.
• No breakage: the help desk and the agent owners report no failed business process during the hold period.

Rollback and common errors

Common failure patterns

• Trusting one view: the Entra list misses agents without an agent identity, and the registry does not show which agents actually sign in. Reconcile both.
• Reading an empty Data & Tools tab as safe: Microsoft states coverage is incomplete. Check the authoring platform for knowledge sources and connectors.
• Ignoring the default environment: maker agents built there are easy to share widely and hard to attribute later.
• Blocking without checking scope: a block on a Foundry agent leaves it reachable outside Copilot Chat; stop or remove its access at the source too.
• Deleting first: permanent deletion removes the evidence you need if the agent turns out to be part of an incident such as the consent abuse pattern in CoPhish 2025.

Hardening afterwards

• Schedule the Graph pull: run the package query weekly with lastModifiedDateTime ge the last run date, and review every new or changed agent.
• Gate publication: review pending requests (requestStatus eq 'pending') and use Publish to store or Reject submission deliberately, not by default.
• Bring agents under identity controls: where agents have Entra agent identities, apply Conditional Access and lifecycle workflows. See the Agent Identity and Access Guide.
• Feed detection: alert on new agent identities (audit Create service principal events for agents) and on Risky Agents findings in ID Protection.

Small tenant or large enterprise

A small tenant can work from the registry export and the Entra list in a spreadsheet each quarter, at no extra licence cost. A large enterprise should script the Graph package API and the Power Platform inventory into its CMDB or AI register, use AI Reader for a dedicated discovery account, and route new agents to environment owners automatically. The Agent 365 licence that unlocks risk signals and the package API is usually justified once agents number in the hundreds.

Metrics

Framework mapping

Practitioner checklist

• Grant AI Reader for discovery and keep change roles in a separate approved group.
• Export the registry with filters cleared and record the four summary tiles.
• Pull /copilot/admin/catalog/packages with paging into a dated baseline.
• Record users, data, tools and permissions for every org, shared and partner agent.
• Download the Power Platform inventory and check classic chatbots separately.
• Export Entra agent identities and blueprints, and filter sign-in logs on Is Agent.
• Group Purview CopilotInteraction records by AgentId to show real use.
• Assign owners, block before deleting, and hold for a business cycle.
• Schedule a weekly delta pull and review pending publish requests.

Standards and references

• Microsoft Learn: Agent registry in the Microsoft 365 admin center
• Microsoft Learn: Understand agent details in Microsoft 365 admin center
• Microsoft Learn: Governance and lifecycle actions for agents
• Microsoft Learn: List Copilot packages API
• Microsoft Learn: Agent registry convergence
• Microsoft Learn: Manage agent identities in your organization
• Microsoft Learn: Power Platform inventory
• Microsoft Learn: Audit logs for Copilot and AI applications

Related NHI Mgmt Group resources: AI agent registry · Microsoft Entra Agent ID Guide · Securing Microsoft Copilot Studio Agents Guide · Microsoft 365 Copilot Security Deep Dive · How to inventory AI agents in AWS Bedrock