---
title: Agents
description: Govern every AI agent in your tenant - what each can actually read across files, sites, users, and email, who deployed it, and how to constrain it before rollout.
icon: Bot
---

# Agents

The Agents screen answers the question that decides whether enterprise AI is an asset or an incident: **"What can our AI agents actually reach - and who decided that?"** Agents ship with vendor products, get built by employees in an afternoon, and inherit access nobody consciously granted. 1Security unifies every agent - Copilot, Entra, Azure, and third-party - into one governed inventory with its true data reach quantified. See the [Agents guide](/en/docs/agents) for how the sources fit together.

## What You Can Achieve

<Cards>
  <Card
    title="Take a census of your AI workforce"
    description="Every agent instance in the tenant - vendor-shipped, employee-built, or bundled with a product you licensed - with creator attribution where Microsoft exposes it, and whether its account is even enabled."
  />
  <Card
    title="Quantify reach before you trust"
    description="For each agent, the number of users, files, sites, and emails it can actually access, and whether sensitive data is within reach. Guardrail decisions made on numbers, not manifests."
  />
  <Card
    title="Govern blueprints, not just instances"
    description="Agents are stamped out of blueprints. Review the template once - publisher verification, declared permissions, how many instances exist - instead of chasing each copy."
  />
  <Card
    title="Set guardrails that stick"
    description="See which permissions Microsoft blocks for agents outright - and which risky grants remain live. Safe AI rollout means knowing exactly what agents can read before employees start asking them questions."
  />
</Cards>

## Agents, Blueprints, Consumption

The screen splits into tabs because AI governance has layers:

- **Agents** - deployed instances doing work in your tenant today. This is where reach, activity, and permissions are real.
- **Blueprints** - the templates agents are created from, with their **publisher**, **verification status**, **declared permissions**, and how many permissions **cascade** down to instances. One unverified blueprint can be the parent of fifty agents.
- **Consumption** - per-agent AI usage and spend, from Azure consumption data and Copilot credit reports.

The **Import registry export** button in the header ingests the free
agent-registry CSV from the Microsoft 365 admin center - your deployed agents
with their instructions and reach flags. A deployed agent is recognized by
its Title ID or - for SharePoint agents, which never get one - by its Entra
agent ID; store-catalog rows with neither are set aside, so the census stays
deployed-agents-only. No Agent 365 license needed; see the
[Agents guide](/en/docs/agents) for the export steps and what the licensed
API adds.

The Consumption tab's **Import credits CSV** button does the same for spend:
in the Microsoft 365 admin center open **Reports → Usage → Microsoft
Copilot → Credits** and export the report as CSV. Microsoft keeps only 30
days of it and offers no API, so a regular import is what builds your
durable per-agent and per-user credit history. Rows are matched to your
agent inventory automatically, and no extra Microsoft licence is required.

## How Agents Reach Your Files

The critical classification on this screen is the **file access channel** - the mechanism, not the marketing, of an agent's data access:

- **Tenant-wide** - application-level access to files across the organization. The highest-stakes category; treat each entry as a standing decision.
- **Admin-consent delegated** - reads files as whichever user is interacting with it, approved for everyone by an admin.
- **Explicit grant** - scoped access to specific resources. This is what deliberate agent governance looks like.
- **None** - no file path today.

Email access follows the same logic (**tenant-wide**, **scoped**, or **none**), and every agent's permissions are broken into **direct**, **inherited**, and **blocked** - so you can see both what an agent was given and what you've explicitly denied it.

Agents also declare **knowledge sources** (SharePoint, OneDrive, Teams, Email, Website, Graph connectors, Dataverse, People, Meetings) - the retrieval layer security teams know as **RAG** (retrieval-augmented generation): whatever lands in these sources can end up in the agent's answers - and **capabilities** (web search, code interpreter, image generation, actions). An agent that can read email _and_ take actions deserves a different review than one that summarizes a website.

## The Agent List

Rows quantify each agent's footprint: blueprint, creator, account status, file access channel, reach counts across users, files, sites, and emails, a sensitive-data flag, and the direct / inherited / blocked permission split. Click an agent to open its drawer - the **Files**, **Sites**, **Users**, and **Emails** tabs show exactly what it can reach and through which channel or knowledge source, turning "it has Sites.Read.All" into a concrete list of what that means. The drawer's side panel draws the **agent access graph** - the same radial map users and files have, and it says HOW reach comes about, not just how much: a Copilot-like agent shows a **"Users' own permissions"** node with the actual people under it (the agent acts as them), a tenant-wide or admin-consented agent shows its dashed channel node with "all users" and "all files" nested beneath, and scoped agents show their concrete grants. Around that: the people split by role - **entitled users** (the assigned audience, whether or not they ever opened it), **active users** (seen using it in the logs) and **governance** (owners and sponsors) - plus knowledge sources, Sites.Selected grants, assigned groups, mailboxes, and the connector surface grouped by destination - external destinations marked, not hidden. Every node clicks through to the matching tab or drawer.

A strip above the list says where the Copilot Studio inventory came from, so you know whether the environment, owner and quarantine columns can be trusted: green when it is read, amber while the actions connection covers it as a fallback, red when it is not read and those agents show incomplete, grey when the tenant has no Power Platform. Anything but green opens **Why and how to fix** with the same remedy as Integrations.

Filters narrow by status, file and email access channels, permission risk (blocked / inherited / direct), knowledge source types, capabilities, and blueprint; the Blueprints tab filters by publisher verification and whether instances exist.

## What 1Security Sees - and What It Does Not

One agent can act in three different Microsoft worlds, and it helps to keep them apart:

- **Microsoft 365** - SharePoint, OneDrive, Teams, Outlook, Entra. This is where 1Security is at home: files an agent opens, emails it touches, and sign-ins land in the audit trail we read and show up in the agent's **Activity logs** tab.
- **Power Platform** - the world most agents are built in. Whether someone builds an agent in Copilot Studio, in Power Apps, or inside Teams, the result is the same kind of agent, and it appears in this inventory - with its environment, owner, and quarantine state, which come with the onboarding consent. Each environment's **connection inventory** needs the optional [Copilot Studio actions](/en/docs/integrations-modules#7-copilot-studio-actions-power-platform-delegated) connection in Integrations: the drawer's **Tools & connectors** tab lists the connections agents in that environment can ride - connector, Standard or Premium tier, custom connectors, and the identity the connection acts as (the connection's stored identity performs the call, not the chatting user). Where a connection points outside Microsoft 365 - Salesforce, SAP, ServiceNow, HTTP, a custom API - the row says **"Access analysis not supported"**: we name the destination, we do not analyze it. What we still do not read is what the agent does _inside_ Dataverse and which flows it triggers, and the exact agent-to-connection wiring lives in Dataverse, so the tab shows the environment's connections, not a per-agent binding. For those, the Power Platform admin center remains the place to look.
- **Power BI / Fabric** - a separate service despite the family name. Copilot in Power BI and Fabric data agents live there, and 1Security does not read that world today.

The rule of thumb: **if an agent's only road to data runs through Microsoft 365, its footprint on this screen is complete; where it uses connectors or flows, we name the connections it can ride but their activity is beyond this screen's view.**

One more thing this screen feeds: an agent is a **new access path for people**. Every user entitled to a scoped agent can effectively read what that agent's grants reach, so that reach is surfaced on the user, file, and site drawers as **"via agent"** rows and filters - with the agent named - and drops out automatically when the agent loses the grant, is disabled, or is quarantined. Broad channels (tenant-wide or admin-consented agents) stay banner-level by design: "every user reaches every file" is a statement, not a list.

## Notifications and Severity for an Agent

Agents have their own anomaly detector (activity against the agent's own 30-day baseline) and their own **Notifications** tab from the notification log. **Tenant-wide file access**, **admin consent for all users**, **very broad reach** (searches all websites, or ten thousand or more reachable files) and reach into sensitive information lift an alerted episode's severity; broad reach _and_ sensitive information together lift it two tiers. Overrides on the [Alerting screen](/en/docs/screens/alerting) can tighten or mute one agent, or all agents behind one vendor's app, with an expiry.

## Investigative Patterns

<Callout type="info">
  **The pre-rollout gate**: filter file access **tenant-wide** + **sensitive
  data within reach**. These are the agents to constrain first - every one of
  them can surface regulated content to anyone who chats with it.
</Callout>

- **Supply-chain check** - in Blueprints, filter **unverified publishers** + **with agents**: unvetted third-party templates already running in your tenant.
- **Read-and-act risk** - agents with the **actions** capability + email access: the profile where prompt injection stops being theoretical, because the agent can both ingest untrusted content and do something about it.
- **Orphaned AI** - agents whose creator has left or whose account is disabled but that still hold permissions: decommission them like you would a service account.