Forum Discussion
Ownerless, Risky and Unmanaged agents aren't reflecting in Agent 365 in admin center
- The ownerless logic in the Agent Registry is narrower than a simple "no active owner" check which is why hard-deleting the owner account didn't flip the status. In the M365 admin center, Agents without owners is defined as "the number of agents that no longer have owners at your organization" but the detection/action tooling is currently scoped primarily to "declarative agents" built with M365 Copilot Agent Builder Agent Registry in Microsoft 365 admin center - Microsoft 365 admin | Microsoft Learn The "Reassign ownerless agents created with Agent Builder to manager" rule only picks up Agent Builder agents and it requires the previous owner to have a manager set in EntraID to resolve ownership Agent settings in Microsoft 365 admin center - Microsoft 365 admin | Microsoft Learn
Conditional Access and Purview policies do not generate the risky classification. Risky-agent detection comes from Microsoft EntraID Protection How it works and Activities contributing to risk
This is by design; it's not a classification failure. Copilot Studio, Foundry and Microsoft Copilot agents automatically register into Agent 365 and emit telemetry/observability natively; so by definition they are inside Agent 365's management plane i.e. Managed. Build agents with Copilot Studio and Agent 365 | Microsoft Learn
Externally connected agents (Amazon Bedrock, Google Vertex AI, Salesforce Agentforce, Databricks Genie, etc.) are brought in via Registry Sync. They sit outside Agent 365's native risk protection and observability, so they are correctly surfaced as Unmanaged.
NOTE: When the external agent are wrapped with Agent 365 SDK; it flips an external agent from Unmanaged to Managed. Key point to highlight Agents onboarded via the Agent 365 SDK have Microsoft Entra Agent ID. Agents onboarded via Registry Sync do not.