What do Microsoft's Agent 365 terms say about customer compliance responsibility?

The Universal Terms for Online Services make the customer solely responsible for any application or AI agent it creates using or for use with Microsoft AI Services, including complying with any legal, regulatory, or licensing requirements applicable to the resulting application or AI agent or its use.

How is Agent 365 data governed when transferred between integrated services?

Once data is transferred between and to Agent 365 Integrated Services, it is governed by the Product Terms of the Microsoft product where that data is processed or stored. Customers are responsible for evaluating whether data flows between Application Services are appropriate for their organization's usage and compliance requirements.

What are the licensing prerequisites for Microsoft Agent 365?

As of June 2026, enterprise customers need Microsoft 365 E5 or both Defender Suite and Purview Suite as standalone licenses. Frontline worker customers need Microsoft Defender and Purview Suite FLW. Small and medium-sized business customers need Microsoft 365 Business Premium. Education customers need Microsoft 365 A5 or both Defender Suite and Purview Suite for Education.

Does Microsoft Agent 365 include audit logs and eDiscovery for agent activity?

Microsoft's Agent 365 Licensing FAQ identifies audit logs and eDiscovery for agent activity in both the tenant-level capability list and the licensed capability list, suggesting a distinction between baseline and licensed functionality. However, the FAQ does not define the retention period, preservation behavior, or historical access rules across downgrade, reassignment, or termination scenarios.

AI Governance

What Microsoft Agent 365's Terms Don't Say About Your Compliance Audit Trail

Microsoft's Agent 365 terms make customers responsible for AI agent compliance — but don't answer what governs the evidentiary record of agent actions when licensing changes. Here's what compliance officers and federal agencies need to ask before deployment.

💡

TL;DR:
Microsoft's Agent 365 terms place AI agent compliance squarely on the customer but don't specify what governs the evidentiary record of agent actions after a license configuration change. Compliance teams and federal agencies should resolve this before deployment — not during an adverse finding.

What You Need to Know

The change: Microsoft Agent 365, generally available since May 1, 2026, is Microsoft's control plane for observing, securing, and governing AI agents across Microsoft 365 environments. As of June 2026, standalone Agent 365 purchases require prerequisite licensing that varies by customer segment.
Who is affected: Federal agencies, government contractors, healthcare organizations, and any regulated enterprise deploying AI agents that interact with compliance-sensitive data.
Why it matters: The Product Terms make the customer solely responsible for any AI agent it creates using Microsoft AI Services, including compliance with applicable legal, regulatory, and licensing requirements. Neither the Product Terms nor the Supplemental Terms for Enterprise Apps and Agents expressly address what governs the record of agent actions if the licensing configuration changes after those actions occurred.
What to do first: Before broad Agent 365 deployment, obtain written confirmation from Microsoft of the agent activity log retention period under Purview and Defender, and confirm explicitly whether that retention persists if the Agent 365 license is downgraded, reassigned, or terminated.
Key dates: June 2026 — prerequisite licensing effective for new Agent 365 standalone purchases. July 1, 2026 — Microsoft 365 commercial pricing and packaging updates take effect; licensing analysts report Microsoft 365 E5 moving from $57 to $60 per user per month.

The signal is public. The implications are not.

Members receive deeper analysis and early warnings inside the PolicyEdge AI Intelligence Terminal.

Upgrade to Founding Member

Medicaid work requirements move along parallel pathways through three review points on a dark policy-intelligence grid.

Medicaid Work Requirements: What the Court Ruling Changes—and What It Doesn’t

A federal court declined to block three CMS provisions governing Medicaid work requirements. The ruling leaves the implementation timeline in place for now without resolving the legal merits.

EU AI Act Article 50 shown as linked data paths separating system marking from public disclosure.

EU AI Act Article 50: What the Transparency Rules Require

EU AI Act Article 50 is now applicable, but it does not require one universal AI label. Learn how duties differ by organizational role, system, content type and exception.

June 2026 JOLTS report visual showing subtle labor-market signals without a clear hiring trend.

June 2026 JOLTS Report: Why the Data Do Not Show a Hiring Rebound

BLS reported job openings as little changed at 7.4 million and hires as unchanged at 5.3 million in June. The data did not establish a hiring rebound—and national estimates alone cannot determine whether a company’s critical roles are becoming easier to fill.

Trump generic-drug tariffs shown as cyan supply-chain paths crossing an amber threshold and branching into uncertain routes.

Trump Generic-Drug Tariffs: What Businesses Can—and Cannot—Plan For

Trump’s announced generic-drug tariffs could reshape supply chains beginning in 2028. Here is what manufacturers, healthcare purchasers and boards can assess now—and which unanswered policy questions prevent reliable forecasts.