How to govern Microsoft Agent 365
A step-by-step guide to governing Microsoft Agent 365 with Rencore: detect with 37 policies, review with 5 reports, and remediate with 11 automations.
Governing Microsoft Agent 365 means keeping its access, configuration, and lifecycle under continuous control rather than reacting after something breaks. Rencore governs Microsoft Agent 365 with 37 pre-built policies, 5 reports, and 11 automations, so teams can detect risk, review posture, and remediate with an audit trail. The steps below turn that coverage into a repeatable routine.
Steps
-
Inventory Microsoft Agent 365
Connect Microsoft Agent 365 and let Rencore build a continuous inventory of its resources, owners, and configuration, so governance starts from what exists rather than a stale export.
-
Detect with policies
Turn on the pre-built policies that cover Microsoft Agent 365 to surface oversharing, sprawl, and misconfiguration on the first scan, before writing a single custom rule.
-
Review by owner and severity
Use the Microsoft Agent 365 reports to review findings by owner, category, and severity, and to share them with stakeholders who do not have a seat in the platform.
-
Remediate and automate
Apply automations to fix findings at scale, route sensitive changes through approvals, and keep every action reversible and logged for the audit trail.
Recommended Microsoft Agent 365 policies
Grounded in the Rencore catalog. See the full Microsoft Agent 365 catalog on the Microsoft Agent 365 connector page.
-
Blocked Agent Still Deployed
Flags agents that are blocked in the agent registry but still appear deployed to users, indicating that the block is not being enforced.
Severity: High -
External-publisher Agent Available to All Users
Identifies external-publisher agents that every user in the tenant can find and install, which is a common oversharing pattern after a broad initial enablement.
Severity: High -
Agent Missing Publisher
Flags agents that have no publisher recorded in the agent registry, making accountability and escalation impossible.
Severity: Medium -
Custom Agent Deployed Tenant-Wide
Identifies custom-built agents that are deployed to every user in the tenant, where individual-author agents may not have gone through the same review as vendor apps.
Severity: Medium -
Shadow AI agent detected on managed devices
Flags unapproved AI tools and agents detected on Intune-managed devices.
Severity: Medium -
Shadow AI: agentic AI CLI detected
Flags unapproved local agentic AI CLIs and coding agents on managed devices - the highest-risk shadow AI class.
Severity: High -
Microsoft-Disabled Blueprint Has Active Identities
Flags blueprints disabled by Microsoft that still have linked agent identities.
Severity: High -
Blueprint Has No Owners
Flags agent identity blueprints that have no owners registered in the owners collection.
Severity: High -
Blueprint Has No Sponsors
Flags agent identity blueprints that have no sponsors registered in the sponsors collection.
Severity: Medium -
Unused Blueprint
Flags agent identity blueprints that have no linked agent identities.
Severity: Low -
Blueprint Credential Expiring Within 30 Days
Flags agent identity blueprints with at least one passwordCredential or keyCredential expiring in the next 30 days.
Severity: Medium -
Blueprint Uses Password Credential
Flags agent identity blueprints that have at least one passwordCredential. Federated identity credentials are preferred for production agents.
Severity: Medium
