Forum Discussion
Ownerless, Risky and Unmanaged agents aren't reflecting in Agent 365 in admin center
1. Ownerless, Risky, and Unmanaged agents are not appearing in Agent 365 Admin Center despite having the required Agent 365 license and appropriate administrative roles. Several agents have no active owner, and I even hard deleted the owner account to simulate an ownerless scenario, but the agents are still not being identified as ownerless.
2. Risky agent classification is also not working as expected. Conditional Access and Microsoft Purview policies have been configured, and the agents have performed activities that should trigger risk indicators, yet no agents are being categorized as risky in Agent 365.
3. All Microsoft-native agents, including Copilot Studio agents, Foundry agents, and Microsoft Copilot agents, are consistently displayed as Managed. Only externally connected agents are shown as Unmanaged. If external agents are correctly identified as unmanaged, why are Microsoft-native agents not being classified as unmanaged when they meet similar conditions?
Please let me know the solution to overcome this issue, Do I need to enable something which I missed or I lack permission.
2 Replies
- The ownerless logic in the Agent Registry is narrower than a simple "no active owner" check which is why hard-deleting the owner account didn't flip the status. In the M365 admin center, Agents without owners is defined as "the number of agents that no longer have owners at your organization" but the detection/action tooling is currently scoped primarily to "declarative agents" built with M365 Copilot Agent Builder Agent Registry in Microsoft 365 admin center - Microsoft 365 admin | Microsoft Learn The "Reassign ownerless agents created with Agent Builder to manager" rule only picks up Agent Builder agents and it requires the previous owner to have a manager set in EntraID to resolve ownership Agent settings in Microsoft 365 admin center - Microsoft 365 admin | Microsoft Learn
Conditional Access and Purview policies do not generate the risky classification. Risky-agent detection comes from Microsoft EntraID Protection How it works and Activities contributing to risk
This is by design; it's not a classification failure. Copilot Studio, Foundry and Microsoft Copilot agents automatically register into Agent 365 and emit telemetry/observability natively; so by definition they are inside Agent 365's management plane i.e. Managed. Build agents with Copilot Studio and Agent 365 | Microsoft Learn
Externally connected agents (Amazon Bedrock, Google Vertex AI, Salesforce Agentforce, Databricks Genie, etc.) are brought in via Registry Sync. They sit outside Agent 365's native risk protection and observability, so they are correctly surfaced as Unmanaged.
NOTE: When the external agent are wrapped with Agent 365 SDK; it flips an external agent from Unmanaged to Managed. Key point to highlight Agents onboarded via the Agent 365 SDK have Microsoft Entra Agent ID. Agents onboarded via Registry Sync do not.
Agent 365 currently does not surface “Ownerless,” “Risky,” or “Unmanaged” classifications for Microsoft‑native agents because of how Entra ID Protection and Agent Registry logic works. These detections require specific prerequisites, roles, and activity conditions, and some signals are suppressed or attributed differently (e.g., risky activity in On‑Behalf‑Of flows is tied to the user, not the agent).
https://learn.microsoft.com/en-us/entra/id-protection/concept-risky-agents
https://learn.microsoft.com/en-us/microsoft-agent-365/developer/troubleshooting
