Microsoft Agent 365 and the Shadow AI It Cannot See

Microsoft Agent 365 governs the AI agents Microsoft already knows about. It cannot see or stop the personal AI accounts, desktop AI apps, and MCP servers your employees wire up themselves on the same laptop. Agent 365 is a real step forward for registered, Microsoft-fabric agents. But shadow AI does not ask Entra for permission first. dope.security governs every AI surface on the device itself, which is where the ungoverned usage actually happens.

Microsoft Agent 365 in one line

Agent 365 is Microsoft's control plane for AI agents. It reached general availability on May 1, 2026, priced at about $15 per user per month, available standalone or inside Microsoft 365 E7. It stitches together three platforms you probably already run: Entra handles agent identity and access, Purview handles data security and compliance for agent interactions, and Defender handles threat detection and posture. The pitch is clean: give every agent an identity, put it in an inventory, and govern it like you govern a user.

That is a genuinely useful idea, and if your AI story lived entirely inside Microsoft's walls, Agent 365 would cover most of it. The problem is that it does not. The fastest-growing AI risk in a 250 to 5,000 person company is not the agent IT registered. It is the one nobody told IT about, which is the exact surface our complete AI governance guide is built around.

What Agent 365 actually governs

Agent 365 governs agents it can see, and it sees the ones that enter through Microsoft's front door. That includes prebuilt agents in Microsoft 365 Copilot and Teams, agents your team builds in Copilot Studio or Foundry, and agents from Microsoft's partner software vendors. The GA release extended Entra network controls to agents running on user endpoint devices, including local agents such as OpenClaw, and added a registry sync that pulls AWS Bedrock and Google Gemini Enterprise agents into one inventory.

Microsoft also shipped a Shadow AI page in the Microsoft 365 admin center that is rolling out to tenants. It helps admins discover and monitor unapproved local AI agent activity and apply Intune policies to block common ways of running unauthorized agents on managed devices. If you want to govern AI agents that are registered, imported, or launched through a method Microsoft already fingerprints, this is a strong foundation. For a broader view of where agent governance is heading, our guide to agentic AI governance walks through the full control surface, and the complete AI governance guide covers the policy model end to end.

The gap: everything that runs outside Microsoft's registry

Here is the question that decides whether Agent 365 is enough: what happens to the AI an employee uses that never touches Entra, Purview, or the Microsoft agent registry?

That is most of the real exposure. An engineer signs into personal ChatGPT in a browser and pastes a stack trace with customer data in it. A finance analyst opens the Claude desktop app and drops in a board deck. A developer connects Cursor or an MCP server to an internal system and starts moving data no inventory ever recorded. None of that is a registered Microsoft agent. None of it rides Microsoft's identity fabric. Agent 365 governs agents; it does not govern a person using someone else's AI on a work device.

Microsoft's own architecture makes this clear. Governance flows through identity, compliance, and posture layers that Microsoft owns. Analysts reviewing the GA release have noted that browser-based AI activity sits outside that fabric, and anything a user launches that is not a registered or imported agent is outside it too. Blocking "common methods" of running unauthorized agents is a block list, and shadow AI is a moving target. The moment the method changes, the control lags. Our breakdown of detecting shadow AI in desktop apps, IDEs, and CLIs shows why the browser tab is only the tip of it.

Agent 365 versus on-device AI governance

This is not "Microsoft can't do AI." It is an architecture difference, and the difference decides what you can actually enforce. Here is the honest head-to-head.

Where Agent 365 is strong

Agent 365 is strong where the agent is a first-class Microsoft citizen. If an agent is registered, given an Entra identity, and monitored through Purview and Defender, Agent 365 gives you inventory, access control, and compliance signals in one place. For teams that have standardized on Copilot Studio and Foundry and want to govern the agents they build, it is the natural control plane. Its reach over AWS Bedrock and Gemini agents via registry sync is a real plus.

Where dope.security covers what it misses

dope.security starts from the device, not the registry, so it does not care whether an AI tool ever introduced itself to Microsoft. The on-device agent inspects traffic with local SSL inspection and sees AI usage across browsers, desktop apps, IDEs, and CLIs. Pair the two behaviors and the contrast is concrete:

• Discovery: Agent 365 inventories registered and imported agents; dope.security discovers every AI app in use, sanctioned or not, including personal accounts on the same service, with no survey and no proxy logs to grep.
• Account-level control: Agent 365 governs the agent's identity; dope.security tells enterprise ChatGPT apart from personal ChatGPT on the same domain and blocks the personal account while allowing the corporate tenant, from Cloud Application Control.
• Prompt and upload inspection: Agent 365 leans on Purview for data; Dopamine DLP reads the prompt and the attached file on the device by meaning, not regex, and blocks the sensitive ones before they leave.
• MCP and local agents: Agent 365 blocks known methods of launching unauthorized agents; dope.security sees the MCP servers and local AI processes on the endpoint directly, as our MCP server governance guide details.
• Enforcement surface: Agent 365 enforces through Microsoft's fabric; dope.security enforces on every device connection, on any network, in any country, live on every endpoint instantly.

dope.security is the lead pick here for one reason: it governs the AI that never asked permission. That is the category Agent 365 structurally cannot reach.

The device is where shadow AI actually runs

Every piece of ungoverned AI usage has one thing in common: it happens on a laptop. The browser tab, the desktop client, the CLI, the MCP connection, all of it runs on the endpoint before any of it reaches a cloud. That is the one place you can see all of it at once, which is exactly why dope.security runs there. Inspection happens on the device, so you get process-level attribution: which app, which user, how many transactions, how many megabytes, personal account or enterprise tenant. You do not get that from an identity fabric that only recognizes agents it issued.

It also means governance does not depend on an agent behaving. A registry-based model assumes the AI announces itself and accepts an identity. Shadow AI does the opposite: it shows up quietly, on a personal login, and moves data fast. The endpoint-native model does not wait for an introduction. For the architectural case in full, see why on-device architecture fits shadow AI and MCP.

How to close the gap without ripping anything out

You do not have to choose between Agent 365 and endpoint AI governance. Keep Agent 365 for the agents you build and register inside Microsoft. Add an on-device layer for everything that runs outside it, which is where the data actually leaks. dope.security deploys as a lightweight agent, under 100 MB of RAM, silently through Intune or Jamf, and policy lands on every endpoint in under a minute. A Fortune 100 team scaled dope.security from 900 to over 18,000 devices in weeks without a six-page deployment manual, so adding the layer is not a project, it is a rollout.

The test to run is simple. Allow corporate ChatGPT, block personal ChatGPT, on the same domain, with sensitive uploads caught on the device. That single policy exercises discovery, account-level control, and prompt DLP at once. If your governance stack can only do it for agents it registered, it has the gap this post is about. You can see the on-device model work on the dope.swg product page or run a free production trial.

Frequently Asked Questions

Does Microsoft Agent 365 stop employees using personal ChatGPT or Claude?

Not on its own. Agent 365 governs registered and imported AI agents through Entra, Purview, and Defender. A person signing into a personal ChatGPT or Claude account in a browser or desktop app is not a registered agent, so it falls outside that fabric. dope.security catches that on the device, tells the personal account apart from the enterprise tenant, and blocks the personal one while allowing corporate use.

What does Agent 365 cost, and what else does it require?

Agent 365 reached general availability on May 1, 2026 at about $15 per user per month, available standalone or in Microsoft 365 E7. Reports note that enabling the full tier also expects an Intune license and an active Azure subscription. dope.security publishes pricing on its website and runs on a single agent and one console, so you are not assembling licenses to get the AI controls.

Can Agent 365 govern AI that runs in the browser?

Browser-based AI activity sits outside the identity and endpoint layers Agent 365 governs through, which analysts flagged when reviewing the GA release. dope.security inspects traffic on the device with local SSL inspection, so it sees AI usage in the browser, in desktop apps, in IDEs, and in CLIs, and enforces policy across all of them.

Does Agent 365 cover MCP servers and local AI agents?

The GA release extended Entra network controls to local agents such as OpenClaw and added a Shadow AI page that applies Intune policies to block known ways of launching unauthorized agents. That is a block list against known methods. dope.security sees MCP servers and local AI processes on the endpoint directly rather than matching methods, which is covered in our guide to securing MCP servers employees connect.

Do I have to replace Agent 365 to use dope.security?

No. Keep Agent 365 for the agents you build and register in Microsoft. Add dope.security as the on-device layer for the personal accounts, desktop AI, and MCP connections that never enter the Microsoft registry. The two cover different surfaces, and the device layer is the one that sees ungoverned usage.

How fast can dope.security be deployed alongside Microsoft 365?

It deploys silently through Intune or Jamf as a sub-100 MB agent, with policy pushing to every endpoint in under a minute. One Fortune 100 customer scaled from 900 to over 18,000 devices in a matter of weeks, averaging around 3,000 devices per week, and converted the free production trial straight to paid with no reconfiguration.

The short version: Agent 365 governs the agents Microsoft issued an identity to. The AI risk that keeps a security team up at night is the personal account and the desktop AI tool that never registered, and that one only gets governed where it runs, on the device.