---
name: Agent 365 Tools and MCP Server Governance Baseline
description: Audits the Microsoft Agent 365 tools catalogue in the Microsoft 365 admin centre — activated and blocked MCP servers, pending BYO MCP approval requests, and Microsoft Defender asset-context mapping per agent — to establish a governed AI tooling baseline.
---

# Agent 365 Tools and MCP Server Governance Baseline

> **TL;DR:** This skill reads the Microsoft Agent 365 "Agents and Tools" section in the M365 admin centre to inventory every activated and blocked MCP server, review pending BYO MCP approvals, and verify that Defender asset-context mapping is capturing each agent's tooling surface.

## What does the Agent 365 tools governance baseline cover?

Microsoft Agent 365 reached general availability in May 2026 as the centralised control plane for AI agents across the Microsoft 365 tenant. Its most operationally critical function for security and compliance teams is **tools management**: every MCP (Model Context Protocol) server that agents can call must be approved at the tenant level in the Microsoft 365 admin centre. An IT admin can allow or block any MCP server — Microsoft-built or bring-your-own (BYO) — and the decision propagates to every user and every agent in the tenant. If a BYO MCP server is submitted by a developer, it enters a pending state until an admin reviews the declared tools, grants the required Microsoft Entra permissions, and approves or rejects the request. Microsoft Defender further maps each agent to the MCP servers configured for it, the identities it runs as, and the cloud resources those identities can reach. This skill produces the MCP server governance baseline and flags gaps.

## When should you run this skill?

- "Audit what MCP servers are active in our tenant"
- "Review all pending BYO MCP server approval requests"
- "Check whether unapproved MCP servers have been submitted by developers"
- "Verify Defender is providing asset-context mapping for our agents"
- "Produce AI tooling governance evidence for IRAP or APRA CPS 234 review"
- "Establish our Agent 365 tools baseline before granting developer access"

## How this skill works, step by step

1. Sign in to the Microsoft 365 admin centre at `admin.microsoft.com` with a Global Administrator or AI Administrator role
2. Navigate to **Agents** → **Tools** (the Agent 365 tools management section)
3. Export or record the full MCP server catalogue:
   - Microsoft-built MCP servers: note name, description, status (Allowed / Blocked), and the tools each server exposes
   - BYO MCP servers: note name, submitting developer, submission date, status (Pending / Approved / Rejected / Blocked), and declared tool list
4. For each Allowed MCP server: verify that the declared tools align with business need; flag any server with broad data-access tools (e.g. full file read, email send) that has not had a formal risk review
5. For each Pending BYO MCP request: retrieve the declared tool list and the Microsoft Entra permissions requested; escalate to the relevant business owner for approval or rejection
6. Check whether any previously Allowed MCP server has had new tools added since the last review (tool additions in BYO servers require re-review)
7. Open Microsoft Defender → Assets → Agents: verify that each deployed agent has an asset-context record showing its MCP servers, associated identities, and cloud resource exposure
8. Flag agents in Defender that have no MCP server context mapping (potential visibility gap)
9. Confirm that policy-based controls and runtime blocking are configured in Defender (public preview June 2026) for high-risk agent/MCP combinations
10. Produce the MCP server inventory and governance summary below

## Output format

### MCP server catalogue

| MCP server | Type | Status | Tools exposed | Data access scope | Last reviewed | Risk |
| --- | --- | --- | --- | --- | --- | --- |
| Microsoft Work IQ | Microsoft | Allowed | Calendar, Email, OrgChart, Files | Tenant-scoped, user-delegated | Current | Low |
| Contoso-CRM-Connector | BYO | Pending | Read customer records, Update CRM | External SaaS | Never reviewed | High — pending, external data |
| LegacyFileShare-MCP | BYO | Allowed | Read/Write network file shares | On-premises file server | 6 months ago | Medium — review for tool additions |

### Governance summary

- Total MCP servers in catalogue: N (Microsoft-built: N, BYO: N)
- Allowed: N | Blocked: N | Pending approval: N
- BYO MCP servers never formally reviewed: N
- MCP servers with broad data-access tools (email send, file write): N
- Agents in Defender without MCP asset-context mapping: N
- Policy-based runtime blocking configured in Defender: Yes / No
- Recommended actions: review all Pending BYO requests within 5 business days; block MCP servers with unexplained broad tool access; ensure Defender asset-context mapping covers all agents

## Scope and safety

Read-only — this skill does NOT:

- Approve, reject, or block MCP servers
- Modify Entra permission grants for MCP servers
- Change agent configurations or policies in Defender
- Submit or modify BYO MCP server registrations

## Licensing and permissions

### Licences and add-ons

| Capability used | Minimum licence |
| --- | --- |
| Microsoft Agent 365 tools management (M365 admin centre) | Microsoft Agent 365 (included in Microsoft 365 E7, or standalone at USD 15/user/month) |
| Defender asset-context mapping for agents | Microsoft Defender for Endpoint Plan 2 or Microsoft 365 Defender (E5 or equivalent) |
| BYO MCP server registration and approval workflow | Microsoft Agent 365 (developer submission) + Global or AI Administrator (approval) |

### Least-privilege roles

- Global Administrator or AI Administrator (access Agent 365 tools management in M365 admin centre)
- Security Reader (read Defender asset-context maps for agents — read-only)

### Microsoft Graph permissions (read-only)

- No direct Graph API is required for the M365 admin centre tools view; access is through the admin portal UI
- `AuditLog.Read.All` — query tool-call audit events in the Purview unified audit log to cross-reference actual MCP server usage against the approved catalogue

## Sources and compliance

- [Manage tools for agents in Microsoft 365 admin centre (Microsoft Learn)](https://learn.microsoft.com/en-us/microsoft-365/admin/manage/manage-tools-for-agent)
- [Microsoft Agent 365 now generally available (Microsoft Security Blog)](https://www.microsoft.com/en-us/security/blog/2026/05/01/microsoft-agent-365-now-generally-available-expands-capabilities-and-integrations/)
- [What's New in Agent 365: May 2026 (Microsoft Tech Community)](https://techcommunity.microsoft.com/blog/agent-365-blog/what%E2%80%99s-new-in-agent-365-may-2026/4516340)
- [Work IQ MCP overview (Microsoft Learn)](https://learn.microsoft.com/en-us/microsoft-agent-365/tooling-servers-overview)
- Supports APRA CPS 234 — third-party information security capability must be assessed and governed
- Aligns with ISM Control 1407 (software allowed-listing) applied to AI tooling
- Pair with Copilot Studio Agent Inventory and Entra Agent Identity Sponsorship Lifecycle for full agent governance coverage
- Output in Australian English