Forum Discussion
Can Agent 365–registered 3rd-party agents be invoked outside MS 365 clients and still track usage?
Hello,
The documentation describes how to register a third-party agent with the Microsoft Agent 365 platform (for example an agent hosted on Google Cloud Run) in order to benefit from capabilities such as observability, governance, security, and centralized management.
Does this mean that users must access these agents through Microsoft 365 entry points (such as Copilot Chat, Teams, or other Microsoft clients) in order for those capabilities to apply?
Or can the same registered agent also be invoked and interacted with from third-party clients or external services (for example applications running in GCP) while still benefiting from Agent 365 features like observability, governance and/or security?
What if third party agent is registered to Agent 365, but it doesn't use EntraID? It's what observability, governance and/or security will be available then?
Thank you.
2 Replies
- Agent 365 capabilities are not tied to the client surface the user comes in through. Tied to two things;
1. agent having a Microsoft Entra Agent ID
2. agent emitting observability telemetry to the service
Governance and security (Conditional Access, Identity Protection, lifecycle/access reviews, permission scoping) are enforced at the identity layer i.e., when the agent authenticates and acquires tokens via its Entra Agent ID.
Observability/security/compliance experiences (M365 admin analytics, Purview, Defender) are powered by the telemetry the agent sends (OpenTelemetry via the Agent 365 SDK), regardless of how it was invoked. Agent 365 observability concepts | Microsoft Learn
The short answer for can the same registered agent be invoked from third-party clients / external services (e.g., apps running in GCP) and still benefit from Agent 365 is Yes; provided it's integrated via the Agent 365 SDK and authenticates with its Entra Agent ID. In a nutshell; Microsoft Entra & Graph provides the agent identity, permissions and blueprint, while Google Cloud Run provides the runtime Build an Agent 365 agent deployed in Google Cloud Platform (GCP) | Microsoft Learn
There are two onboarding paths which provides different coverage;
1. Registry Sync / Connected Platforms: No-Entra Agent ID; Inventory/visibility only centralized discovery, ownership, metadata and sync status in the registry. No identity-based access control, no Conditional Access, no full runtime observability/security enforcement
2. Agent 365 SDK integration: Yes-Entra Agent ID; Full stack Entra Agent ID, Conditional Access/Identity Protection, lifecycle governance, OpenTelemetry observability, Purview DLP/compliance and Defender threat detection
- Agent 365 capabilities are not tied to the client surface the user comes in through. Tied to two things;
I have the same question. Im planning to build ai agent in Google ADK and exploring if it can be monitored using Agent 365
