Microsoft Agent 365 GA Is Coming: What .NET and Azure Developers Need to Know Now

TL;DR: On March 9, 2026, Microsoft announced that Agent 365 — a centralized control plane for AI agents — will reach General Availability on May 1, 2026, priced at $15/user/month. It ships alongside Microsoft 365 Copilot Wave 3 and a new enterprise bundle, M365 E7. For .NET and Azure developers, this is the governance layer you’ve been waiting for (and the one your InfoSec team has definitely been demanding).

The Problem: Agents Without Guardrails Are a Liability

AI agents have been proliferating at a pace that’s making IT and security teams sweat through their polo shirts. According to Microsoft’s Cyber Pulse report, more than 80% of Fortune 500 companies are actively using AI agents built with low-code and no-code tools, and IDC projects 1.3 billion agents in circulation by 2028. The speed of agent development and proliferation tells us customers see value, but without guardrails the pace of adoption turns into blind spots, diminished ROI, and real security risk. As AI agents become more capable and autonomous, trust is nonnegotiable. Microsoft itself is living this reality at scale: the company now has visibility into more than 500,000 agents running across its own corporate environment, with the most widely used focused on research, coding, sales intelligence, customer triage, and HR self-service. —

What Is Agent 365, Exactly?

Agent 365, priced at $15 per user per month, serves as what Microsoft calls the “control plane for agents” — a centralized system for IT, security, and business teams to observe, govern, and secure AI agents across an enterprise. Agent 365 organizes its capabilities around three pillars: observability, security, and governance. Each extends Microsoft’s existing security infrastructure — Defender for threat protection, Entra for identity and access, and Purview for data security — to non-human entities. Think of it as giving your agents the same identity, lifecycle, and audit trail that human employees have had in Azure AD/Entra for years. A new capability called Agent ID gives each agent a unique identity in Microsoft Entra, enabling conditional access policies, least-privilege enforcement, and audit trails. Importantly, the system is not merely a passive observer: on whether Agent 365 can intervene in real time or merely observes after the fact, Microsoft confirmed it does both — the system surfaces risk flags and anomalous behavior, and security teams can block risky agents through the Defender portal. —

Key Developer Dimensions

SDK and CLI Support

Use the Agent 365 SDK to extend agents built using any agent SDK or platform, with enterprise‑grade identity, observability, notifications, security, and governed access to Microsoft 365 data. The Agent 365 CLI is the command-line backbone for Agent 365 throughout the agent development lifecycle — automating setup, identity, configuration, MCP integration, publishing, and Azure deployment for enterprise-ready agents. A few things the CLI handles out of the box:

# Scaffold a new agent blueprint with identity + MCP wiring
agent365 blueprint create --name "invoice-processor" \
  --mcp-server "https://my-mcp.azurewebsites.net" \
  --policy dlp-standard

# Deploy agent code to Azure and publish to the admin center
agent365 deploy --env production
agent365 publish --admin-center

Platform Agnosticism (Yes, Really)

One of the more pragmatic engineering decisions here: Agent 365 works with agents built on any agent SDK or platform. This includes low-code platforms like Copilot Studio and Azure AI Foundry, as well as pro-code options such as Microsoft Agent Framework, Microsoft Agents SDK, OpenAI Agents SDK, Claude Code SDK, and LangChain SDK. Even better for polyglot shops: Agent 365 also works with agent code hosted on any endpoint, whether Azure, Amazon Web Services (AWS), Google Cloud Platform (GCP), or any other cloud provider. Your agents don’t have to live in Azure to be governed by Agent 365. That’s a meaningful concession to real-world enterprise architectures.

MCP Integration Is First-Class

Agent 365’s agentic tools expose consistent MCP interfaces and SDKs. Developers can use agentic tools for Outlook, Teams, and SharePoint and business integrations — accelerating delivery while inheriting enterprise-grade security and compliance. This ties neatly into the broader Azure MCP story. Microsoft has moved its Model Context Protocol (MCP) support for Azure Functions to General Availability, signaling a shift toward standardized, identity-secure agentic workflows. By integrating native OBO authentication and streamable HTTP transport, the update aims to solve the security pain point that has historically prevented AI agents from accessing sensitive downstream enterprise data. The MCP extension now supports .NET, Java, JavaScript, Python, and TypeScript, while a new self-hosted option lets developers deploy existing MCP SDK-based servers without code changes. Here’s a minimal C# snippet for wiring an MCP-backed agent in Azure AI Foundry using the .NET SDK:

using Azure.AI.Projects;
using Azure.Identity;

var client = new PersistentAgentsClient(
    endpoint: Environment.GetEnvironmentVariable("AZURE_FOUNDRY_PROJECT_ENDPOINT"),
    credential: new AzureCliCredential());

var mcpTool = new MCPToolDefinition(
    serverLabel: "my_mcp_server",
    serverUrl: "https://my-mcp.azurewebsites.net");

var agent = await client.Administration.CreateAgentAsync(
    model: "gpt-5.2",
    name: "MyEnterpriseAgent",
    instructions: "You are a helpful enterprise assistant.",
    tools: [mcpTool]);

⚠️ Note: the .NET and Java SDKs for Foundry Agent Service MCP integration are currently in preview. Treat them accordingly in production planning.

Latency and Cold-Start Considerations for MCP Hosts

If you’re hosting your MCP server on Azure Functions (the most common pattern for .NET teams), pay attention to your hosting plan choice. When MCP tools sit idle, costs drop to zero while maintaining fast wake-up times. The Premium plan supports “always-ready” instances that remain pre-initialized, eliminating cold-start latency, which is critical for mission-critical tools where initialization delays can cause SSE connection timeouts and poor agent response times. Experts recommend setting two to three always-ready instances for critical 24/7 tools to ensure failover capacity. Also keep this hard limit in mind: non-streaming MCP tool calls have a timeout of 50 seconds. If your MCP server takes longer than 50 seconds to respond, the call fails. Ensure your MCP server responds within this limit. —

The Pricing Stack (Know Before Your CFO Asks)

Microsoft 365 Enterprise 7, dubbed the “Frontier Worker Suite,” bundles Agent 365 with Microsoft 365 Copilot and the company’s most advanced security stack into a single $99-per-user-per-month license. At $99 per user, E7 costs less than purchasing the components individually — E5 currently runs $57 per month (rising to $60 in July), Copilot adds $30, and Agent 365 adds $15. So the bundle math does work out, assuming you want (and can justify) the full stack.

⚠️ Action Items Before May 1

Get on the Frontier Preview. You need to be part of the Frontier preview program to get early access to Microsoft Agent 365. Frontier connects you directly with Microsoft’s latest AI innovations. Sign up now so you’re not scrambling at GA.
Audit your agents today. Start cataloging what agents your team has deployed — on Azure or otherwise. The Agent 365 Registry will want to know about all of them.
Migrate off AzureML SDK v1. Unrelated but time-sensitive: the Azure Machine Learning SDK v1 reaches end of support on June 30, 2026. After this date, existing workflows may face security risks and breaking changes without active Microsoft support.
Pin your MCP tool call durations. Add integration tests that assert your MCP tool responses return well under 50 seconds. Timeouts are silent killers in agentic pipelines.
Choose your hosting plan deliberately. For .NET Azure Functions MCP servers, the Flex Consumption plan is fine for dev/test; use Premium with always-ready instances for anything customer-facing.