Enterprise use of autonomous AI agents is growing faster than the systems designed to manage them. Microsoft is now attempting to close that gap with new infrastructure aimed at tracking, securing and governing AI driven automation across corporate environments.
New research from the company warns that many AI agents already operate outside standard IT oversight. These unsupervised systems, described as potential “double agents,” could be manipulated through techniques such as prompt injection or data poisoning and pushed to act against the organisations that deploy them.
Agent 365 targets shadow automation
Microsoft announced Agent 365 alongside the Frontier Worker Suite (E7), with general availability scheduled for May 1st. The platform acts as a centralised control plane designed to catalogue AI agents, provide visibility into their behaviour and surface risk signals while integrating with Microsoft Defender, Entra and Purview.
Agent 365 will be sold as a standalone product priced at $15 per user per month. The Frontier Worker Suite combines Agent 365 with Microsoft 365 Copilot and additional security capabilities for $99 per user per month, while Copilot itself now supports additional models from OpenAI and Anthropic.
Double agent risks emerge
Microsoft’s internal analysis identified hundreds of thousands of AI agents running across its own systems, with a substantial portion operating without formal IT or security approval. In controlled testing, the company demonstrated how prompt injection and data poisoning techniques could alter agent behaviour, transforming routine automation into a potential security risk.
The “double agent” scenario refers to an AI system that has been compromised but continues to appear legitimate while acting against organisational interests. In practice, this extends traditional insider threat concerns to automated systems that operate with delegated permissions.
Australian enterprise implications
Australian organisations experimenting with agent based AI may face new budget considerations as governance tools become part of the deployment stack. Because the licensing model is priced per user rather than per agent, overall costs can grow alongside workforce size regardless of the number of agents actually deployed.
Enterprises may also need to build clearer inventories of their existing AI agents, apply identity and data protection policies, and extend audit processes to include non human identities. Financial institutions and other heavily regulated sectors exploring AI driven automation could face particular pressure to demonstrate oversight.
For companies already operating within the Microsoft ecosystem, the bundled licensing structure may encourage further consolidation of agent development and deployment on Microsoft platforms. This dynamic could influence procurement strategies for Australian organisations running workloads across Azure or Microsoft 365.
Governing AI at enterprise scale
Microsoft’s move signals a broader shift toward treating agentic AI as operational infrastructure that requires the same governance controls applied to human users. By packaging identity, security and observability capabilities together, the company is positioning agent governance as a standard component of enterprise software.
Key developments to monitor include adoption levels once Agent 365 becomes generally available in May, whether competing cloud providers introduce similar governance layers, and how quickly security teams adapt incident response procedures to account for AI driven identities and automation.
Need help governing AI agents in your organisation? Book a free AI Discovery Session with Aivy to assess your AI automation strategy.
