🛡️ Onboard an AI Agent into Microsoft Agent 365

Deploy a Foundry-hosted AI agent and onboard it into Microsoft Agent 365 with full enterprise governance — own Entra identity, license, audit trail, and threat protection.

⏱️ ~15 minutes end-to-end | 🐳 No Docker required | ✅ Verified April 10, 2026

🔑 What is Agent 365?

Agent 365 is Microsoft's enterprise governance layer for AI agents. It doesn't build agents — it governs them.

graph LR
    A[🤖 Your Agent] --> B[🛡️ Agent 365 Governance]
    B --> C[🆔 Entra Agent ID]
    B --> D[📋 Admin Center Registry]
    B --> E[🔍 Purview Audit]
    B --> F[🛡️ Defender Threat Protection]
    style B fill:#0078D4,color:#fff

Every onboarded agent gets:

🏛️ Governance Pillar	Platform	What it does
🆔 Identity	Entra ID	Own Agent ID, Conditional Access, Lifecycle Management
📋 Observability	M365 Admin Center	Registry, Agent Map, Ownerless Detection
🔍 Data Protection	Purview	Audit trail, Sensitivity Labels, DLP
🛡️ Threat Defense	Defender	Risk Detection, Prompt Shield, Advanced Hunting

Prerequisites

1. Licenses

License	Purpose	Minimum
Microsoft 365 (Business Standard/Premium, E3, or E5)	Base plan	1
Microsoft 365 Copilot (add-on or bundle)	Enables Frontier access	1
Agent 365 Frontier Trial (25 licenses)	Assigned per agent instance	Activated in Step 1 below

A Business Standard + Copilot bundle is sufficient. E-licenses are not required.

2. Azure Subscription

Requirement	Details
Subscription type	Pay-As-You-Go or Enterprise Agreement
Required role	Owner on the subscription
Region	Resources must be in North Central US (only region supporting Hosted Agents)

Estimated Azure Costs

Resource	SKU	Estimated Cost
AI Services (Foundry Account)	S0	Pay-per-use (GPT-4o: ~$2.50/1M input tokens)
Container Registry	Basic	~$5/month
Bot Service	F0 (Free)	$0
Hosted Agent Container	Managed by Foundry	Included in AI Services
Total (idle/demo)		~$5-10/month + token usage

For a demo or pilot with light usage, expect under $20/month. The main cost driver is GPT-4o token consumption.

3. Tenant Permissions

Permission	Who needs it	Why
Global Administrator (or Copilot Administrator)	Person running the setup	Enable Frontier, approve blueprints, manage licenses
Azure Subscription Owner	Person running `azd provision`	Create Azure resources
Teams Administrator (optional)	Same or different person	Configure Teams Developer Portal

For a pilot, one person with Global Admin + Subscription Owner can do everything.

4. Tools (install once)

winget install Microsoft.AzureCLI          # Azure CLI
winget install Microsoft.Azd               # Azure Developer CLI
winget install Microsoft.DotNet.SDK.9      # .NET 9.0 SDK

Docker Desktop is NOT required. The deployment uses Azure Container Registry remote build.

5. Frontier Program Enrollment

Your tenant must be enrolled in the Frontier preview program. Frontier is available to all Microsoft 365 customers with a Copilot license.

⚙️ Step 1: Prepare Your Tenant (~3 min)

1.1 Enable Frontier

Open the M365 Admin Center
Go to Copilot → Settings → User access
Under Copilot Frontier → select All users → Save

1.2 Activate the Agent 365 Trial

Important

This step is easily missed. Without it, you get 0 licenses and agent creation will fail.

In the Admin Center, go to Agents → Overview
Look for the banner: "Do more with the Frontier Program"
Click "Try Now"
Verify: Go to Billing → Licenses → You should see 25 × Microsoft Agent 365 Frontier

1.3 Verify Agent Settings

Admin Center → Agents → Settings:

☑ Allow apps and agents built by your organization
User access: All users

🚀 Step 2: Deploy the Agent (~6 min)

2.1 Sign In

# Sign in to Azure CLI (device code flow recommended)
az login --use-device-code --tenant YOUR-TENANT-DOMAIN

# Sign in to Azure Developer CLI
azd auth login --tenant-id YOUR-TENANT-ID

Use --use-device-code if you have multiple browser profiles or accounts.

2.2 Clone the Sample

git clone https://github.com/microsoft-foundry/foundry-samples.git
cd foundry-samples/samples/csharp/FoundryA365

2.3 Clear the MCP Tools Configuration

Caution

This step is critical! The default sample includes MCP tools (OneDrive, Word) that require a KeyVault certificate. Without clearing this, the agent will crash silently when receiving messages.

# Replace the ToolingManifest with an empty configuration:
'{"mcpServers":[]}' | Set-Content src/hello_world_a365_agent/ToolingManifest.json

You can add MCP tools back later once KeyVault is configured.

2.4 Deploy — One Command

azd provision

You'll be prompted for:

Prompt	What to enter
Subscription	Select your Azure subscription
Environment name	e.g. `myagent` (becomes the prefix for all resources)
Location	`northcentralus` ⚠️ Required — only supported region
Resource group	Select "Create a new resource group"

Note

That's it. This single command automatically:

✅ Creates the Foundry Project, Container Registry, and Bot Service
✅ Builds the container image remotely (no local Docker needed)
✅ Creates the Agent Blueprint and starts the hosted container
✅ Submits a Digital Worker request to the M365 Admin Center
✅ Configures OAuth2 grants for the Blueprint

Duration: ~6 minutes.

2.5 Note Your Blueprint ID

azd env get-values

Copy the value of AGENT_IDENTITY_BLUEPRINT_ID — you'll need it in the next step.

✅ Step 3: Approve and Configure (~3 min)

3.1 Approve the Agent Blueprint

Open: Admin Center → Agents → Requests
Find your agent (name = your environment name from Step 2.4)
Click "Approve request and activate"
Select template: "Default template for allowing instances"
Publish to: All users → Activate for: All users
Accept the permissions → Click Finish

3.2 Configure Teams Developer Portal

Warning

The agent will NOT receive messages in Teams without this step!

Open: https://dev.teams.microsoft.com/tools/agent-blueprint/YOUR-BLUEPRINT-ID/configuration

(Replace YOUR-BLUEPRINT-ID with the value from Step 2.5)
Set Agent Type: Bot Based
Set Bot ID: = your Blueprint ID (same value!)
Click Save

Tip

If your blueprint doesn't appear in the portal list (it only shows 100), open any blueprint and replace the ID in the browser URL with yours.

🎉 Step 4: Create an Agent Instance and Test (~2 min)

Open Microsoft Teams
Go to Apps → search for your agent (environment name)
Under "Agents for your team" → click your agent
Click "Create agent" → enter a name (e.g. "My AI Assistant") → Create
Wait for the notification (~1-2 minutes)
Open the chat with your agent → type "Hello!"

✅ The agent responds!