Procurement heard Agent 365 is ‘the control plane for agents’ and costs extra (or sits inside E7). We already pay for Microsoft 365 Copilot seats. Is Agent 365 mandatory for basic block/approve, or only when we want the full observe–govern–secure stack?

Registry and basic lifecycle on eligible M365 plans vs Agent 365 / E7 advanced observability, tools, Purview and Defender agent controls — Steady Licence before buying the control plane twice.

Do we need Agent 365 if we already bought Microsoft 365 Copilot?

You’re right to separate “we can see and block agents” from “we bought the full agent control plane.” The marketing blurs them; the licensing table does not.

Here’s what’s going on. Microsoft Agent 365 is the control plane to observe, govern, and secure agents across Microsoft and connected platforms. It is a stand-alone subscription and is included with Microsoft 365 E7. Microsoft 365 Copilot is the productivity add-on for Graph-grounded work. Copilot seats amplify what people can do; Agent 365 amplifies what admins can see and enforce.

Learn’s service description draws the line. On eligible Microsoft 365 Enterprise, Business, Education, and First Line Worker plans, you already get Agent Registry inventory, basic governance actions (publish, deploy, block, delete, approve, assign, reassign owner), lifecycle rules, and registry sync. The advanced row — policy templates, observability/telemetry, tenant-wide tool/MCP controls, Graph API for registry actions, plus richer Entra / Purview / Defender / Intune agent controls — is Yes for E7 and the Agent 365 SKU, and No on the base M365 column.

Practical options:

Use what current M365 + Copilot already unlocks. Inventory, Requests, block/unblock, owner reassignment, and basic lifecycle rules are Steady GRC for early programmes. Viewing inventory needs an appropriate admin role (for example AI Reader / AI Administrator), not “buy Agent 365 first.”
Buy Agent 365 (or move to E7) when the advanced row is the bottleneck. Agent Conditional Access patterns, tool/MCP allow-lists, deep observability, Graph-driven governance, or the Purview/Defender agent columns — that is when the SKU earns its keep.
Don’t confuse Copilot Control System with Agent 365. CCS is the broader governance approach across admin centers and Purview. Agent 365 is a licensed control-plane product (or E7 inclusion).
Skip Agent 365 while you have no agent programme. Fine for a pure Copilot Chat pilot — revisit when makers and the Agent Store are real.

The caution: feature packing moves; treat the Learn service-description table as truth the week you buy, not a blog’s dollar figures. Some overview metrics only fill after Agent 365 licences activate. Copilot does not replace Agent 365 for agents beyond Copilot, and Agent 365 does not replace Copilot seats for Graph grounding.

I’d suggest a FinOps one-pager: map this quarter’s needs (inventory, approve, block, ownerless rules) to the base M365 column; map Security’s advanced observe/secure asks to the Agent 365 / E7 column; buy only when the second list is non-empty. That is Steady Licence before paying twice for control.

You’re asking the right question. Steady before scale means the control plane matches agent risk — it isn’t a vanity SKU beside every Copilot seat.