Inventory every agent in the tenant¶
Licence and role
Any Microsoft 365 tenant. Inventory: Power Platform administrator, Global reader, or AI reader. Agent identities: AgentIdentity.Read.All (Agent ID Administrator for non-owners).
Why it matters¶
You cannot govern agents you cannot see. Agents show up in two places: Copilot Studio agents in Power Platform environments, and Microsoft Entra agent identities, which act with their own permissions. Most tenants have never listed either.
Steps¶
- Power Platform admin center > Manage > Inventory (or Manage > Copilot Studio). It lists agents built in Copilot Studio and in Microsoft 365 Copilot Agent Builder. Select Download to export the full list to CSV with owner, environment and created date.
- Entra agent identities: Microsoft Entra admin center > Agent ID, or run the read-only check below (Microsoft Graph, AgentIdentity.Read.All).
- Record an owner and a business purpose for every agent in the tracker. An agent without a named owner goes on the review list.
- Repeat monthly. New agents appear without any admin action.
Impact on users¶
None. The inventory export and the Graph check only read data.
Rollback¶
Nothing to roll back.
Read-only check¶
Reads settings only. It changes nothing in your tenant or on the device.
Modules, connection and role
Requires: Microsoft.Graph (Conditional Access + agent identities), ExchangeOnlineManagement (audit search), Microsoft.PowerApps.Administration.PowerShell (data policies).
Connect first:
Connect-MgGraph -Scopes AgentIdentity.Read.All,Policy.Read.All
Connect-ExchangeOnline
Add-PowerAppsAccount
Note: Microsoft retires Search-UnifiedAuditLog on 15 Oct 2027 (MC1505599). AG04 will move to the Graph AuditLogQuery API before then.
$u = 'https://graph.microsoft.com/v1.0/servicePrincipals/microsoft.graph.agentIdentity?$select=id,displayName,accountEnabled,agentIdentityBlueprintId,createdDateTime'
$all = @()
while ($u) { $r = Invoke-MgGraphRequest -Method GET -Uri $u; $all += $r.value; $u = $r.'@odata.nextLink' }
"Agent identities: $($all.Count)"
$all | ForEach-Object { "$($_.displayName) | enabled: $($_.accountEnabled) | created: $($_.createdDateTime)" }
How to verify¶
Every Copilot Studio agent and every agent identity has an owner and a purpose recorded in the tracker.
Sources¶
This control is in the M365 AI Agent Hardening Kit
The free Top 5 has this control with its Jira import, Excel project plan, tracker CSV and the read-only PowerShell script. The Complete kit has all 20 controls.