You haven’t just adopted a new Copilot. You’ve brought a new digital actor into the organization.
That’s perhaps the most important change with agents right now.
When an agent gets its own identity, access to data, and the ability to perform actions over time, it’s no longer enough to ask who created it or who pressed start. We also need to ask what the agent actually does, what it has access to, whether its behavior changes, and what happens if it starts doing something it shouldn’t.
That’s where Microsoft Purview gets interesting.
Microsoft Agent 365 is generally available for Commercial from May 1, 2026, on a per-user basis and requiring at least one qualifying license. At the same time, Microsoft now documents Risky Agents as a preview policy in Insider Risk Management. This preview applies to documented supported agent types and documented detections, not generic agents everywhere. The preview status is worth noting, but it’s not the main point here.
The interesting part is that Microsoft clearly believes the agent is now an actor you must be able to monitor, investigate, and govern as more than just functionality inside an app.
From tool to identity
We’re used to thinking of AI as a tool people use. You write a prompt, the model responds, and a human evaluates the result.
Agents move this model.
An agent can get an identity, permissions, and tasks. It can work with information from multiple sources and perform actions on behalf of the organization. That means the security and compliance model also needs to be able to relate to the agent directly.
Microsoft documents that Purview can be used for Microsoft Agent 365 across areas such as audit, data classification, sensitivity labels, DLP, Insider Risk Management, communication compliance, eDiscovery, data lifecycle management, and Compliance Manager. At the same time, the documentation clarifies that not everything is enabled automatically: for Agent 365 agent instances, Purview can automatically enable audit, data classification, and Compliance Manager’s AI regulatory assessments, while other controls must be added as for a user. See the Purview documentation for Agent 365.
That doesn’t mean the agent is a human. But from a governance perspective, we start asking many of the same questions:
- Who owns this identity?
- What access does it have?
- What data does it process?
- What actions does it perform?
- What is normal behavior?
- What do we do when the behavior no longer looks normal?
When the agent gets its own risk profile
This is where I think Risky Agents says something bigger than the feature itself.
When the agent gets its own identity, it also gets its own risk profile.
An agent doesn’t have to be malicious to become a risk. Bad instructions, compromise, excessive privileges, changed context, or unexpected autonomous behavior can be enough. An agent that yesterday did exactly what it was supposed to do can tomorrow gain access to different data or start operating in a way the organization didn’t plan for.
Microsoft documents that Risky Agents in Purview can detect these types of signals:
- risky prompts
- sensitive responses
- sensitive data access
- risky websites
This isn’t a theoretical framework I’m reading into the product. It’s the documented baseline now in Monitoring agents in Insider Risk Management.
Supported agent types, as Microsoft currently documents them, are:
- Copilot Studio agents
- Microsoft Foundry agents
- agents built with the P4AI SDK
It’s important to stick to this. Risky Agents doesn’t mean Purview now monitors all conceivable agents everywhere. But the direction is clear: Microsoft is building observation and investigation of behavior-based risk for non-human actors too. See also the policy template documentation for Insider Risk Management.
Now comes a consolidated risk surface too
What’s new here isn’t just that Purview has a preview policy.
What’s new is that agent risk is treated as something to be shown across the platform.
Microsoft documents that agent risk from Purview is shared onward to DSPM for AI and Microsoft 365 admin center in Monitoring agents in Insider Risk Management. In addition, Microsoft 365 admin center now has a dedicated Agents at risk surface that aggregates high risk from Entra, Purview, and Defender.
That’s an important signal.
Because when Entra, Defender, and Purview start meeting around the same agent, the agent is no longer just an app component. It becomes its own security boundary with identity, behavior, exposure, and governance needs.
At the same time, we shouldn’t oversell this. Aggregated risk is useful for visibility, but that isn’t the same as full understanding or full data parity between consoles. A shared “agents at risk” list can be a good operational starting point, but it doesn’t replace ownership, context, and investigation.
This is also a compliance problem
It’s easy to put agents in the security box. Identity, access, and threat detection sound first and foremost like classic cybersecurity.
But agents make compliance even more important.
Because what happens when the identity that reads, compiles, moves, or produces information is no longer a human?
Then the governance model still needs to know what information is sensitive, where it can be used, what can be shared, how long data should be retained, and what activity must be investigable afterwards.
That’s exactly why the combination of identity and Purview is interesting. DLP, sensitivity labels, audit, eDiscovery, and lifecycle don’t stop being relevant because the actor is an agent. On the contrary, classification and data governance become more central when more actions can happen without a human evaluating each step.
We’ve spent many years building compliance around the question:
What is the human allowed to do with the information?
Now we have to add a new one:
What is the agent allowed to do with the same information?
In my view, that’s a much bigger change than a new policy template in Purview.
From normal agent to risky agent
The most interesting scenario isn’t necessarily an agent misconfigured from day one. It’s the agent that works normally over time and then changes behavior.
Think of an agent that usually reads a limited dataset and produces a specific result. Then it suddenly starts retrieving more sensitive information, producing sensitive responses, or visiting risky websites.
Then we need more than access control. We need behavior observation and a basis for investigation.
This is where Risky Agents becomes interesting as a signal of the direction Microsoft is taking with Purview and Insider Risk Management. And it’s also where many organizations will discover that the agent problem is really a governance problem: ownerless agent, unclear sponsor, unclear data access, and unclear process for who should respond when risk appears.
Visibility still isn’t the same as control
That Purview can provide signals about agent behavior doesn’t mean all problematic behavior is automatically detected, understood, and stopped. Risky Agents provides a basis for observation and investigation. That’s valuable, but it doesn’t replace good access control, DLP, classification, ownership, and operational routines.
The same applies to DSPM. Microsoft documents that Agent 365 should be governed through DSPM > AI observability, and that classic DSPM doesn’t support Agent 365. See the Purview documentation for Agent 365.
That point matters in practice: many will look for agent governance in old overviews and assume lack of visibility means lack of risk. It could just as well mean they’re looking in the wrong console, lack the right role, or don’t have the licensing needed for the relevant views.
Because agents now aren’t just a technology question. They’re also an operations and accountability problem.
What should you do now?
I’d start with five things.
Map agents as actual identities
Find out what agents you have, who owns them, what access they have, and what data they work with. An agent portfolio without ownership quickly becomes a governance and compliance problem.Distinguish visibility from control
An “Agents at risk” list is useful, but it’s only a starting signal. You still need access control, data minimization, classification, and response routines.Get the data foundation in place before autonomy increases
Sensitivity labels, DLP, audit, and lifecycle don’t get less important with agents. They get more important. The agent should encounter governed data, not clean up an information landscape no one owns.Clarify who investigates and who can intervene
Purview, Entra, Defender, and admin center provide different slices of the problem. Someone must own the investigation, and someone must have the mandate to constrain, stop, or change the agent.Pilot preview features as preview features
Risky Agents is useful for learning what normal and abnormal agent behavior looks like, but don’t treat it as a finished control you can lean your entire governance model on.
Practical caveats you shouldn’t skip
Access and licensing aren’t entirely trivial here.
For Purview-related agent risks and alerts, the relevant Insider Risk Management roles determine who can actually see and investigate in Purview. In Microsoft 365 admin center, it’s a different question: there Microsoft documents that the Risks column and the Security tab may require E7 or Agent 365, in addition to role-based access. See Agent Registry and agent details.
In practice, that means “we have the feature,” “we have the license,” and “the right people see the feature” aren’t the same.
And that’s often exactly where governance fails.
Honestly?
Risky Agents is interesting, but not primarily because Microsoft has built yet another feature in Purview.
What’s interesting is what the feature tells us.
The agent is becoming an independent digital actor in the organization. It gets identity, access, data, and room to act. Then we also need to see when the behavior changes, when ownership is missing, and when the agent starts to represent a risk across identity, security, and compliance.
When the actor is no longer always a human, compliance doesn’t become less relevant.
It becomes part of the very prerequisite for letting agents loose.