Microsoft 365 Enterprise Blog | Updates, News & Insights

Build a Microsoft 365 agent inventory: Orchestry AI & Agent

Written by David Francoeur | Sep 1, 2026, 10:45:00 AM

Someone has probably already asked you how many AI agents are running in your Microsoft 365 tenant. If you went looking for the answer, you found out the question is harder than it sounds.

Four admin surfaces will each give you a number. The Microsoft 365 admin center counts agents published to channels. The Power Platform admin center counts what was built on Power Platform, drafts included.

SharePoint agents are files sitting in document libraries, so finding those is a search across every site rather than a report at all. The Teams admin center covers the Teams-native ones. Every number is correct inside its own scope, and no two of them match.

Even once you’ve stitched a list together by hand, you’re missing the parts that decide what you do next: who created this one, what content it answers from, who can reach it, and whether it should worry you more than the other two hundred.

A list tells you agents exist. Governance is knowing which ones matter and being able to do something about them. Agent sprawl is the visible half of that problem; the roster is only the answer to the visible half. Building a real Microsoft 365 agent inventory is where that starts, and it’s what this release is built to close.

On this page

One roster for the agents across your tenant

Where it lives: AI & Agents › Agents

Orchestry inventories agents from across your tenant into a single filterable roster. One list, cross-platform, no portal-hopping and no manual de-duplication.

The detail that matters most here is the least glamorous one: owner names are resolved to real people. Agent inventories elsewhere routinely hand you a GUID, which means the first thing you do with the list is go and look up who that is. Each row instead carries the creator’s name and the date it was created.

Filtering is where the roster stops being a list. You can narrow by agent type, by status, by publication scope, and by any of the named governance insights.

Deleted agents don’t disappear from the roster. They’re retained with a Deleted status, so your audit trail and your trend history survive the cleanup. This matches the soft-delete pattern Orchestry already uses for workspaces and OneDrive.

The question it answers: what agents do I actually have, and who built them?

Where your agent risk is concentrated

Where it lives: AI & Agents › Dashboard › Agents tab

A roster answers what. The dashboard answers how worried should I be, and about which part.

The questions it answers:

  1. Where do I stand today?
  2. What’s being created, and by who?
  3. What’s my risk profile and where is it concentrated?

Watch the 90-day trend more closely than the total. Agent counts climb faster than people expect, and that trend is what tells you if this is under control.

The tiles aren’t just decoration. Click through and you land in the Agents report already filtered to what you clicked, so the path from “risk is concentrated somewhere” to “these are the agents” is one click rather than a new search.

A risk score you can defend in a meeting

Where it lives: on each agent row, and in full on the agent detail page

Each agent gets a composite risk score from 0 to 100, banded into five tiers: Low, Moderate, Elevated, High and Critical.

Two things make this more useful than a severity flag.

  • It’s graded. A tenant with three hundred agents doesn’t need to know that some of them are risky. It needs a defensible order to work through them in. A score gives you that; a high-severity count doesn’t.
  • The reasoning is visible. The score is produced by named governance insights, and every insight that fired on an agent is shown on the agent itself, each with a description of what it means. So “why is this one near the top of my list” has an answer in plain words rather than in arithmetic: it’s shared tenant-wide, its owner has left the company, and it reaches an external MCP server. That’s the answer a security review actually needs.

It’s also not a new model to learn. This is the same risk-rating framework Orchestry already runs across workspaces and OneDrive, pointed at agents. If your team already triages workspace risk on a Monday morning, agents drop into that same habit.

The question it answers: which of my agents do I look at first, and why this one?

Named insights, and every one of them is a filter

Where it lives: on the roster, on the dashboard, and on each agent detail page

The score tells you where to look. The insights tell you why, in language a security team already uses rather than raw configuration data you have to interpret yourself.

Each insight is a specific, named governance concern with a priority attached. Grouped by the question they answer:

Who can reach this agent

  • Anonymous Access: the agent is reachable without signing in.
  • Anonymous Link: the agent is exposed through an anonymous sharing link.
  • Tenant-Wide Share: anyone in the organization can use it.

Whether anyone is looking after it

  • Orphaned: the owner is no longer an active user. The agent keeps working; nobody is accountable for it.
  • Stale: no recent activity. A candidate for retirement rather than an emergency.

What it can actually do, and what it reads

  • Autonomous Agent: it can act without a person prompting it.
  • Uses MCP Server: it reaches an external MCP server, so its reach extends past your tenant.
  • Maker-Authenticated Connection: it connects using its creator’s credentials, which means everyone using it is effectively acting with the maker’s permissions rather than their own.
  • Public Website Knowledge Source: it answers partly from the open web.

Platform hygiene

  • Unmanaged Solution: the agent sits in an unmanaged solution, outside a controlled deployment path.

Every insight is a one-click filter with a live count beside it. You don’t read a description and then go build a search. You click “Tenant-Wide Share” and the roster becomes the fourteen agents anyone in your organization can reach. You click “Orphaned” and you have the list of agents nobody owns any more, ready to reassign or remove.

That count is doing quiet work too, because it sizes the problem before you open it. “We have a sharing issue” and “we have three agents shared tenant-wide” lead to very different Monday mornings.

The question it answers: what specifically is wrong with this agent, and how many others have the same problem?

Per-agent detail: what it reads, and who can reach it

Where it lives: AI & Agents › Agents › any agent

Open an agent and you get the same three-tab view whatever type it is, which is the point. Comparing one agent to another shouldn’t mean learning two different screens.

  • Overview carries the identity and the shape of the thing.
  • Sources is what it’s grounded on.
  • Access is how many people can reach it, and what rights they have.

The useful discipline here is that all three tabs are read from the same crawl that produces the risk score, so the detail page and the score never disagree with each other.

The question it answers: what is this agent connected to, and who can use it?

The Power Platform your agents are running on

Where it lives: AI & Agents › Reports

Agents aren’t free-floating objects. An agent lives in a Power Platform environment, reaches out through connectors, is bounded by DLP policies, and is packaged in a solution. You can’t meaningfully govern the agent without seeing the ground it stands on, and that ground is usually governed by a different team, on a different day, in a different portal.

So the agent inventory ships with the Power Platform context around it, as four reports.

  • Environments. The Power Platform environments Orchestry can see, with the agents inside each one. The question this answers is which environments exist that nobody meant to create, and which ones are quietly carrying production workload.
  • DLP policies. Which policies exist and what they cover. It’s far easier to spot the environments no policy applies to when the policies are listed against the environments than when you’re reading policy definitions in isolation.
  • Custom connectors. The connectors built in-house, which are the ones with no vendor documentation and no review process behind them. A custom connector is how an agent reaches a system nobody expected it to reach, and it’s the least-inspected object in most tenants.
  • Solutions. What’s packaged where, and whether it’s managed or unmanaged. An unmanaged solution means something was built directly in an environment rather than deployed into it, which is both a governance signal in its own right and one of the insights on the agent roster.

This release reports on environments, DLP policies, custom connectors and solutions. Orchestry is building towards Apps and Flows.

The question it answers: what’s my agent estate actually running on, and which parts of it nobody is governing?

Acting on what the inventory finds

Where it lives: the row action menu on the Agents report, and the agent detail page

A report you can’t act on is just another dashboard, and there are enough of those.

Delete works across all sources, whatever the agent is and whichever Microsoft mechanism sits behind it. You don’t need to know which mechanism applies, or go to a different portal depending on the answer. It’s final on the Microsoft side, and the confirmation says so before anything happens.

Deleted agents stay in the inventory with a Deleted status. Your trend history stays intact, and six months from now you can still answer what was removed and when.

The question it answers: can I actually do something about this, or am I just looking at it?

Who’s allowed to do all this

Where it lives: Settings › Access Control › Roles

Agent governance touches sensitive ground: what content AI reads, who can reach it, and a destructive action. That shouldn’t require handing someone full Orchestry Admin.

There’s a dedicated AI & Agents Admin role, assignable to individual users or to groups. It grants privileges to AI & Agents governance, reporting and actions, and nothing else. Every assignment change is written to the Access Control history, so who was granted this and when is answerable later.

This lets your security team own agent risk without also handing them provisioning and lifecycle control.

The question it answers: how do I give my security team this without giving them everything?

AI readiness, free on every tier

Where it lives: AI & Agents › Dashboard › AI Readiness tab

The agent layer is one half. This is the ground underneath it, and it’s free on every Orchestry tier.

The AI readiness score is a single tenant-wide, model-agnostic reading of how ready your content posture is for any AI, built from 13 governance signals across three groups: oversharing, governance, and Orchestry safeguards. Each signal passes or fails against a threshold, and the score is the share that pass, so every signal counts equally and no single one can dominate the number.

Based on Orchestry data, early tenants scored 23% and 28% on their first scan, before any governance work started. It scores your whole estate, not a top-N sample, and it needs no SharePoint Advanced Management license.

You can drill into any signal to see what’s behind the number, which is the difference between a score that starts a project and a score that just starts an argument.

That score is model-agnostic on purpose. The same conditions apply whichever AI is reading your content, whether that’s Microsoft 365 Copilot, an agent someone built last week, or a third-party tool like Claude or ChatGPT.

The question it answers: before I worry about individual agents, is my content safe for AI at all?

Getting started

If you’re on Orchestry Enterprise, the AI & Agents section is available to you now. It needs the Monitoring App extended with Power Platform and Dataverse access, which is a short install with no procurement loop and no chasing roles environment by environment. Once it’s crawled, the roster and the dashboard populate on their own.

If you’re on any other Orchestry tier, the AI readiness dashboard is free to you. It’s the honest place to start anyway, because agent risk is mostly inherited content risk.

If you’re not an Orchestry customer, there’s a 28-day fully functional trial.

It runs on the Microsoft 365 licensing you already hold, including E3, with no Agent 365 license required.

Where this goes next

This is a first release. Three things deepen it from here.

  • Content analysis, so you can see the specific content an agent is using rather than the sources it points at. That’s what turns AI readiness from cleaning a hundred thousand sites into fixing the few thousand documents your AI actually touches.
  • An agent review policy, so agents have owners who re-confirm them on a schedule, extending the review model Orchestry already runs for workspaces and OneDrive.
  • Access management, usage and cost analytics, and proactive purging of the agents nobody uses.

Microsoft 365 agent inventory: common questions

How do you build a Microsoft 365 agent inventory?

Natively, you assemble it by hand from four places: the Microsoft 365 admin center for agents published to channels, the Power Platform admin center for what was built there, a site-by-site search for SharePoint agents, and the Teams admin center for Teams-native ones. Each is correct within its own scope and no two agree on the count. Orchestry crawls all of them into one filterable roster with owner names resolved to real people.

Which Microsoft admin center shows all your AI agents?

None of them individually. Each admin center reports the agents inside its own scope, which is why tenant-wide counts differ depending on where you look. Getting a single number means either reconciling four exports by hand or using a tool that crawls across them.

How do you know which AI agents are risky?

Orchestry gives each agent a composite risk score from 0 to 100, banded into five tiers from Low to Critical. The score is produced by named governance insights covering who can reach the agent, whether anyone still owns it, what it’s able to do, and what it’s grounded on. Every insight that fired is shown on the agent itself with a description, so the reason behind a score is readable rather than inferred.

Can you delete an AI agent from Microsoft 365?

Yes. Orchestry deletes across all sources, whatever the agent is and whichever Microsoft mechanism sits behind it, from the row action menu on the Agents report. Deletion is final on the Microsoft side and the confirmation says so first. Deleted agents stay in the inventory with a Deleted status so your trend history and audit trail survive.

Who should own agent governance in your organization?

Usually the security team, which creates a permissions problem: agent governance touches what content AI reads and includes a destructive action, but it shouldn’t require full administrative access to everything else. Orchestry has a dedicated AI & Agents Admin role, assignable to users or groups, that grants agent governance, reporting and actions and nothing beyond them, with every assignment change logged.

See it on your own tenant

Reading about an agent inventory is one thing; seeing your own is another. Most teams are surprised by the count before they get anywhere near the risk scores.

If you’d rather watch it than read about it, we walked through the whole release in AI & Agents Governance for Microsoft 365, the third part of our agent governance series. And if you want to see what it finds in your environment, request a demo and we’ll go through it with you.