AI governance in a Microsoft 365 organization: four layers, which product covers each, and the order to build them

In November 2026 we spoke with the IT team of an organization with a few hundred staff on Microsoft 365. It has two sanctioned AI assistants (Microsoft 365 Copilot and one other enterprise assistant), an AI governance budget approved for 2027, and several vendors pitching for it, one of them an identity vendor. The team had tested Microsoft Defender for Cloud Apps on a handful of IT accounts and found:

• About eighty AI apps in use across the company, against three approved.
• One person who sent several gigabytes of data in a single week to a public AI assistant that was not an approved tool.
• An employee who, meaning to help, exported the internal knowledge base to a hosted site to build a knowledge tool with an AI app builder.
• An employee outside IT who built an app that works around the collaboration platform.
• Someone editing work videos in a consumer AI video tool on a company laptop.

Blocking one AI model-hosting site from managed laptops worked in the test. The team's questions, answered below: where to start, whether Microsoft's tooling governs anything outside Microsoft, and who needs an Agent 365 license.

Each layer answers one question and has its own Microsoft product. Prices are per user per month, Commercial, annual commitment billed annually, November 2026 price list.

E7 combines E5, Microsoft 365 Copilot, Agent 365 and the Entra Suite, so one license carries all four layers; the first steps below need far less. The Defender for Cloud Apps licensing article compares the paths for layer 1.

Layer 1, apps. Defender for Cloud Apps discovers cloud apps from the signals Defender for Endpoint collects on onboarded devices, or from firewall and proxy logs. Filter Discovered apps by the Generative AI category for the kind of list the team found. Mark an app Unsanctioned and, per Microsoft's guide of 8 April 2026, it is blocked automatically on devices onboarded to Defender for Endpoint; you can warn users instead. The integration page lists Defender for Endpoint Plan 2 or Defender for Business (the edition in Business Premium) as the device requirement. Away from the office network it does not see devices that are not onboarded, such as personal phones, and it never sees the content of what was sent. It reports user, app and volume.

Layer 2, data. Purview answers what the volume contained. DSPM for AI reports interactions with AI apps and the sensitive information types in them. Microsoft's E3 and E5 comparison for Copilot (18 November 2025) lists it for both plans, with E3 limited to app information, activity export and auditing and with prompt and response text only on E5; for AI apps outside Microsoft 365, plan on E5 or the Purview Suite, as our DSPM for AI guide explains. Endpoint DLP, which acts on a paste or upload from a managed device, is E5-level. Monitoring AI apps outside Microsoft 365 is metered on Purview pay-as-you-go, your own Azure charge. Sensitivity labels differ in kind: Microsoft lists protecting files "even if a user moves or downloads them" among the E3 controls. Purview does not reach text retyped from memory or devices you do not manage, and a label protects only files that carry one.

Setup: the DSPM for AI guide, the shadow AI guide, the label article and the first five DLP policies.

Layer 3, identities. An AI app becomes more than a browser tab once someone grants it permissions with a company account. The Entra user consent setting decides whether they can: no user consent; consent only to apps from verified publishers or your own organization, for permissions you classify as low impact; or consent to anything that does not require an administrator. The Microsoft-managed policy, the default for a new tenant per the documentation of 22 January 2026, stops users from granting access to files, sites, mail, calendars and chats themselves. Older tenants may still allow everything, so check. The admin consent workflow turns a refusal into a request for named reviewers. Conditional Access can require a compliant device for a sanctioned assistant that signs in through Entra. App governance in Defender for Cloud Apps lists OAuth apps registered in Entra ID, Google and Salesforce, with their permissions and who granted them.

Connectors and MCP servers, briefly: Power Platform data policies control which connectors Copilot Studio agents may use, and Entra Internet Access has an MCP firewall (in preview, documentation of 6 August 2026) that inspects MCP traffic from devices running the Global Secure Access client.

Layer 4, agents. The agent registry (Microsoft 365 admin center, Agents, All agents, Registry) lists Microsoft, partner-built, organization-published and user-shared agents, and counts agents without owners and unmanaged agents. Viewing it takes a role such as AI Reader, not a specific license. Agent 365, generally available since 1 May 2026, is one per-user license, not a tiered family; it adds governance policies, advanced usage insights and threat detection, and Microsoft requires it before Conditional Access applies to agent identities. An app built on an outside AI app builder is not in the registry unless someone registers it; it surfaces in layers 1 and 3. Our agent governance primer covers the operating model. Licensing for the fourth layer is set out in Microsoft Agent 365: what it does, how it is licensed and who needs a license, and connectors between assistants and business apps in AI connectors and MCP servers.

The team's own order: block the AI apps that are not approved on managed devices, understand what data is leaving, then find and control agents and connectors. It is a sound spine: managed devices cover nearly all of that workforce, and Microsoft documents a delay of up to three hours between marking an app and the block. We would change three things.

1. Discover and tighten consent before blocking. Two weeks of discovery across every onboarded device shows which of the eighty apps matter. The consent setting is a configuration change, not a purchase. Block on day one only where the evidence is clear, such as the three-gigabyte upload.
2. Start labels in the first month, in parallel. A block protects the devices you manage; an encrypted label stays with the document wherever it goes, which makes it the durable control. Labels also take longest: design a small set, test the policies that act on labels, then apply them automatically. Do not encrypt everything in one step.
3. Open the agent registry early. Counting agents and ownerless agents is an hour's work, and it shows whether Agent 365 belongs in the 2027 budget.

The team's order is right unchanged where a contract or regulator requires an immediate stop.

First 30 days

• Days 1 to 3: turn on the Defender for Endpoint integration in Defender for Cloud Apps and export the Generative AI apps it finds. Check the Entra consent setting, enable the admin consent workflow, record the registry counts.
• Week 2: publish the approved AI tools and how to request another. Block the clear cases; warn on the rest.
• Week 3: agree a small label set and publish it to a pilot group. Turn on DSPM for AI policies in audit mode.
• Week 4: move from warn to block, write the inventory down, decide what to license.

Three of the five findings were people trying to improve their work: a knowledge tool, a sales app, faster video editing. On the call we said that blocking everything has a cost for exactly that reason. Block them without an alternative and the next attempt can move to a personal device, which none of these tools see. Give builders a sanctioned path:

• Link the Defender for Cloud Apps block notice to an internal page listing the approved tools and how to request another.
• Let people request apps through the Entra admin consent workflow.
• Offer a place to build: Copilot Studio in an environment with data policies, where a published agent can wait in the admin center's Requests view for approval.

On the call we raised a second pressure: customer contracts and NDAs carry AI clauses that require a supplier to disclose where AI touches the customer's data. The discovered-apps export, the agent registry export and Entra's list of enterprise applications are the raw material. Our Fractional Chief AI Officer retainer ($1,950 per month) builds an AI inventory in the first month and watches the AI questions in customer and insurer questionnaires.

Stated plainly: Microsoft's tools see and control what runs on managed devices, what signs in with company identities, and what touches Microsoft 365 data. Conditional Access for agents governs access to "resources protected by Microsoft Entra ID", and app governance covers OAuth apps registered in Entra ID, Google and Salesforce. Outside those, when someone connects an approved AI assistant to another third-party business app from inside the assistant, and the connection runs between the two vendors' clouds, no Microsoft product is in the path. That connection is governed in the assistant's admin console, in the business app's admin settings, and by which apps may sign in with company accounts.

A separate AI governance product is a reasonable addition when:

• Much of the AI use happens on devices you do not manage.
• Sign-in to your business apps runs through another identity provider, so consent and access policy sit there.
• Your estate is mostly third-party SaaS with many service-to-service integrations.
• Your licenses are below the Agent 365 prerequisite in Microsoft's licensing FAQ (Microsoft 365 E5 for enterprises, Business Premium for smaller organizations) and you do not plan to move.

Before the 30 days of discovery it is the wrong first purchase: you cannot yet name the gap it would close. For the Microsoft layers: the Shadow IT Assessment Workshop ($1,950, two days) runs discovery from firewall or proxy logs, Defender for Cloud Apps Implementation is $4,500 per project over 14 days, and the AI Agent Inventory and Lifecycle Governance Implementation is $4,950 per project for up to 25 agents.

Should step one simply be Defender for Cloud Apps for everyone?

For discovery, yes. Microsoft 365 E5 and the Defender Suite already include it. Otherwise the standalone license is $3.50 per user per month (November 2026 price list): 300 users cost 300 × $3.50 = $1,050.00 per month. Discovery and blocking through devices need Defender for Endpoint Plan 2 or Defender for Business; Microsoft 365 E3 includes Plan 1, so E3 tenants add Defender for Endpoint Plan 2, on its own or inside the Defender Suite, or feed firewall logs.

Does Agent 365 include Defender for Cloud Apps and Purview?

No. Microsoft's licensing FAQ treats them as prerequisites: core Agent 365 functionality relies on Microsoft 365 E5, or on the Defender Suite and Purview Suite added to E3; smaller organizations need Business Premium. Agent 365 extends Entra, Defender and Purview controls to agents. It does not license those products for your users.

Is Agent 365 tiered, and can I license everyone to get visibility?

It is one per-user license at $15.00 per month (November 2026 price list), also included in Microsoft 365 E7. Agents need no license of their own. Microsoft's licensing FAQ requires it for users who delegate access to agents and for owners, sponsors or managers of agents with their own access. Visibility does not need it: the registry comes with the Microsoft cloud subscription.

Does Microsoft's tooling govern anything outside Microsoft?

Partly. Defender for Cloud Apps discovers and blocks any cloud app on managed devices, Purview endpoint DLP acts on what leaves those devices, Entra governs apps that sign in with company accounts, and the agent registry can sync agents from connected non-Microsoft platforms (registry sync, which Microsoft's licensing FAQ lists among the capabilities that need an Agent 365 license). It does not govern connections between two outside services.

How do I control an approved AI assistant that someone connects to another business app?

In the assistant's own admin console, restrict which connectors and MCP servers the workspace allows; in the business app, restrict which integrations users may authorize. Microsoft is in the path when the target is Microsoft 365 data, where Entra consent applies, or when the MCP client runs on a managed device with the Global Secure Access client (MCP firewall, in preview).

• Manage generative AI apps for your organization — Microsoft Learn, 2026-04-08
• Govern discovered apps using Microsoft Defender for Endpoint — Microsoft Learn, checked 2026-11-11
• Integrate Microsoft Defender for Endpoint with Defender for Cloud Apps — Microsoft Learn, checked 2026-11-11
• App governance in Microsoft Defender for Cloud Apps — Microsoft Learn, checked 2026-11-11
• Compare Microsoft 365 Copilot features in E3 and E5 licenses — Microsoft Learn, 2025-11-18
• Copilot Control System security and governance — Microsoft Learn, 2026-02-25
• Considerations for deploying DSPM for AI — Microsoft Learn, checked 2026-11-11
• Microsoft Purview licensing guidance — Microsoft, checked 2026-11-11
• Manage app consent policies — Microsoft Learn, 2026-01-22
• Configure the admin consent workflow — Microsoft Learn, 2024-12-29
• Microsoft Entra licensing — Microsoft Learn, 2026-06-18
• Conditional Access for agents — Microsoft Learn, 2026-07-31
• Configure Global Secure Access MCP firewall — Microsoft Learn, 2026-08-06
• Data policies — Microsoft Learn, 2026-10-14
• Agent Registry in Microsoft 365 admin center — Microsoft Learn, 2026-05-01
• Agent Registry convergence with Microsoft Agent 365 — Microsoft Learn, 2026-04-05
• Agent 365 licensing FAQ — Microsoft, checked 2026-11-11
• IT Partner Commercial price list, November 2026 — annual commitment billed annually