Govern and secure · Topic 08 of 14
AI agent registry and sprawl: how to find, inventory and manage every agent
An AI agent registry is a company's master list of AI agents: one record per agent that says what it is, who owns it, which identity it runs under, what it can reach, how risky it is and whether it is approved. Agent sprawl is what happens without one: agents multiply across platforms with no owner.
In this guide: 83 pages
Key takeaways
- Shadow AI, agent sprawl and agent lifecycle management are one problem seen from three sides, and a registry is where all three start.
- All three clouds ship a registry in 2026: the Microsoft Agent 365 registry (generally available 1 May 2026), AWS Agent Registry (31 Aug 2026) and Google Agent Registry (18 Jun 2026). Each is strongest for its own platform.
- A record is useful once four things are attached to it: a named owner, an agent identity, an approval state and a risk tier. The products hold the first three; the risk tier is a tag you define.
- Automatic discovery fills the list, and it is partial. Declare one system of record and reconcile the rest into it.
- The payoff is operational: ownerless agents get reassigned or blocked by rule, duplicates get consolidated, and a misbehaving agent can be blocked, quarantined or have its identity disabled.
Why does agent sprawl happen, and what does it cost?
Agent sprawl happens because building an agent became as easy as creating a document, while the controls that apply to applications (an owner, an identity, a review, a retirement date) were never attached. Agents are worse than the spreadsheets and SaaS subscriptions that sprawled before them, because an agent can read data and act on its own.
The numbers describe a workforce that adopted AI before IT caught up. In the Microsoft and LinkedIn Work Trend Index of 8 May 2024 (31,000 people, 31 countries), 78% of AI users said they were bringing their own AI tools to work. The 2026 Work Trend Index (5 May 2026) reported that active agents in the Microsoft 365 ecosystem had grown 15 times year over year, and 18 times in large enterprises. Microsoft said in November 2025 that its own tenant held more than 100,000 agents.
The cost shows up in breach reports. The IBM Cost of a Data Breach Report 2025 (30 July 2025; 600 organizations, breaches from March 2024 to February 2025, research by the Ponemon Institute) found that one in five organizations reported a breach due to shadow AI, and only 37% had policies to manage AI or detect shadow AI. Organizations with high levels of shadow AI saw an average of USD 670,000 in higher breach costs. Of the 13% that reported breaches of AI models or applications, 97% had no AI access controls in place.
Sprawl also wastes budget. Gartner predicted, as reported by Reuters on 25 June 2025, that more than 40% of agentic AI projects will be canceled by the end of 2027, citing escalating costs and unclear business value. A registry does not fix a weak business case. It does show which agents nobody uses, which duplicate each other and which have no owner left to ask.
Shadow AI and agent sprawl are two ends of the same problem. Shadow AI is AI that staff use or build without IT knowing: a personal chatbot account, a browser extension, a coding agent on a laptop. Sprawl is what you reach when sanctioned platforms produce agents faster than anyone records them.
How does an agent registry work?
A registry works as a system of record that discovery fills, people check and the controls act on. You set up seven things, in roughly this order.
- Pick the system of record. For Microsoft it is the Agent 365 registry in the Microsoft 365 admin center (Agents, All agents, Registry); the separate Entra Agent Registry converged into it in April 2026 and Entra keeps the identity side. AWS calls its product AWS Agent Registry, and Google Cloud has Agent Registry in Gemini Enterprise Agent Platform.
- Turn on discovery so the list fills itself. Foundry Control Plane discovers supported agents in a subscription. Power Platform inventory lists every Copilot Studio and Agent Builder agent within 15 minutes of a change. AWS Agent Registry auto-detects AgentCore Runtimes and Gateways across an AWS Organization with no setup in the member accounts. Google Agent Registry registers supported workloads in a project and takes external endpoints by hand.
- Define the minimum fields. The Microsoft 365 admin center exports more than 30 items per agent, including name, status, publisher, version, owner, platform and instructions. AWS records carry a record type (agent, skill, gateway, custom, or MCP server, a tool server that speaks the Model Context Protocol), descriptors, provenance and an approval status. Fields the products lack, such as business purpose, risk tier, data classes and review date, go into tags (Microsoft allows up to 50 admin-managed tags).
- Link each agent to an identity. On Microsoft each agent should carry a Microsoft Entra Agent ID; since July 2026 Copilot Studio creates one for every new agent. Google shows an agent’s SPIFFE ID (SPIFFE is an open standard for workload identities) on its details page in Gemini Enterprise. On AWS each agent gets a workload identity in the AgentCore Identity directory.
- Add an approval gate before an agent becomes discoverable. AWS records move from DRAFT to PENDING_APPROVAL to APPROVED or REJECTED; only approved revisions reach the discovery APIs and the registry’s MCP endpoint, and editing an approved record creates a new draft while the approved one stays live. In Microsoft 365, submitted agents land in a Requests queue, where an admin chooses Publish to store or Reject submission.
- Watch the counters. The Microsoft registry summary shows Total agents, Agents without owners and Unmanaged agents (created or managed outside Agent 365). With an E7 or Agent 365 licence a Risks column aggregates signals from Purview, Entra and Defender.
- Automate hygiene, and expose the registry to code. Microsoft 365 agent management rules can reassign ownerless Agent Builder agents to the previous owner’s manager, block ownerless agents with no usage and reject publish requests older than a set number of days. Microsoft Graph (preview) and the AWS registry APIs and MCP endpoint expose the list to code.
Two roles matter from day one: on Microsoft, AI Reader views every agent (no specific licence needed) and Agent ID Administrator changes agent identities; on AWS, shared registries use RAM managed permissions (ReadOnly, Consumer, Publisher, Admin).
What does a registry entry hold?
A useful entry answers six questions: what the agent is, who is accountable, what identity it runs under, what it can reach, how risky it is, and where it is in its life. The table shows whether the three cloud registries hold each group natively on 2 Nov 2026.
Field groups in a registry entry, and where each cloud holds them. "Native" means the product stores the field.
| Field group | Fields | Microsoft Agent 365 | AWS Agent Registry | Google Agent Registry |
|---|---|---|---|---|
| What it is | Name, description, purpose, platform, version, channel | Native | Native (record type, descriptors, version) | Native (A2A agent card, MCP server details) |
| Who is accountable | Owner, sponsor, team | Native owner; sponsor through Entra Agent ID | Publisher and ownership fields | Owner in Gemini Enterprise; transferable since 21 Sep 2026 |
| Identity | Agent identity, how it authenticates, who it acts for | Entra agent identity per agent; unmanaged agents may have none | AgentCore Identity workload identity | SPIFFE-based Agent Identity (API in preview) |
| Reach | Tools, connectors, MCP servers, data sources | Connector usage in Power Platform inventory (preview) | Descriptors for MCP servers, A2A cards, HTTP endpoints | Registered MCP servers and tools, via Agent Gateway |
| Risk | Risk tier, data classes, review date | Risks column with E7 or Agent 365; tags | Custom metadata and tags | Tags and labels |
| Lifecycle | Approval state, status, retirement | Requests queue; block; 30-day soft delete | DRAFT, PENDING_APPROVAL, APPROVED, REJECTED, DEPRECATED | Registered or not; sharing review in Gemini Enterprise |
The sub-page on what an AI agent registry is goes through each field. The short version: an entry with no owner and no identity is a line in a spreadsheet that nobody can act on.
Registry vs inventory vs CMDB vs control plane: which do you need?
You need all four, and they are different things. An inventory is the list discovery produces. A registry is the curated system of record with approval attached. A CMDB (the IT service management database of servers and applications) holds what an agent depends on. A control plane is the set of actions (block, quarantine, disable identity, stop) that read the registry and act on an agent.
Four neighbouring terms.
| Term | What it is | Who maintains it | Example on 2 Nov 2026 |
|---|---|---|---|
| Inventory | The discovered list of agents, filled automatically, complete or not | The platform | Power Platform inventory; Defender AI agents inventory; Foundry Control Plane |
| Registry | One curated record per agent with owner, identity, risk tier and approval state | Platform admins and governance | Agent 365 registry; AWS Agent Registry; Google Agent Registry |
| CMDB | Configuration items (servers, applications, services) and their relationships | IT service management | ServiceNow CMDB, with AI Control Tower holding the AI assets that map onto it |
| Control plane | The actions applied to agents: block, quarantine, stop, Conditional Access, rules | Security and platform operations | Microsoft Agent 365; AgentCore Policy and Gateway; Google Agent Gateway |
Vendors blur these words. Microsoft calls Agent 365 "the control plane for agents" and the registry is one part of it. Ask what a product discovers, what it stores and what it can do to an agent, and the name stops mattering.
How do Microsoft, AWS, Google and ServiceNow do it?
All four ship a registry and all four now claim to inventory agents built elsewhere. The cross-cloud features are the newest part of each product and several were still preview on 2 Nov 2026, so test them in your own tenant before a runbook depends on them.
Registry products as of 2 Nov 2026.
| Vendor and product | What it inventories | Discovery and approval | Status as seen 2 Nov 2026 |
|---|---|---|---|
| Microsoft Agent 365 registry (Microsoft 365 admin center) | Microsoft, Copilot Studio, Agent Builder, Foundry, SharePoint and partner agents; others through the Agent 365 SDK | Discovery through Power Platform inventory, Foundry Control Plane and Defender; Requests queue for approval; management rules for ownerless agents | Generally available 1 May 2026 for commercial customers; USD 15 per user per month or included in Microsoft 365 E7 (Microsoft GA blog, 1 May 2026). Sync with AWS Bedrock and Google Cloud in public preview; Graph registry API in preview. |
| Microsoft Entra Agent ID | Agent identities, blueprints, owners and sponsors | Identity, Conditional Access and ID Protection for agents; sponsor lifecycle workflows | Generally available (Microsoft Learn, 1 May 2026); the admin-center creation wizard still marked preview. |
| AWS Agent Registry (part of the AgentCore family) | Agents, MCP servers, tools, skills, gateways and custom resources | Auto-detection of AgentCore Runtimes and Gateways across AWS Organizations; DRAFT to APPROVED workflow; MCP endpoint | Public preview 9 Apr 2026; generally available 31 Aug 2026 in five Regions (US East N. Virginia, US West Oregon, Europe Ireland, Asia Pacific Tokyo and Sydney). |
| Google Agent Registry (Gemini Enterprise Agent Platform) | Agents (A2A agent-to-agent cards, v1), MCP servers and tools, endpoints, skills | Auto-registers supported workloads in a project; external endpoints by hand; policy enforced through Agent Gateway | Public preview announced with the platform launch in April 2026 (the platform was renamed from Vertex AI on 22 Apr 2026; the preview entry is undated); generally available 18 Jun 2026 with Agent Gateway. Agent Identity API in preview since 18 Jun 2026. |
| ServiceNow AI Control Tower | AI assets on and off ServiceNow: models, agents, prompts, datasets and, since June 2026, MCP servers; managed and unmanaged | Connectors for AWS, Google Cloud, Azure, SAP, Oracle and Workday (May 2026); risk classification at intake; lifecycle with offboarding; Publish to Microsoft Agent 365 | Generally available since May 2025; June 2026 release generally available; Agent 365 integration in preview since 6 May 2026. ServiceNow says it manages more than 1,600 AI assets internally. |
Two more are worth knowing. IBM previewed watsonx Orchestrate Discover on 27 Oct 2026, which connects to Amazon Bedrock, Microsoft Foundry and Google Gemini to find third-party agents. The A2A agent-to-agent specification (1.0.0, 12 Mar 2026) defines a self-describing Agent Card at /.well-known/agent-card.json, which the AWS and Google registries validate, and the official MCP Registry has been in preview since 8 Sep 2025, with enterprises expected to run private sub-registries that pull from it.
How do Microsoft, AWS and Google implement it?
The same capability, named the way each cloud names it, with statuses as the vendor pages showed on 2 Nov 2026.
Capability, Microsoft, AWS, Google
| Capability | Microsoft | AWS | |
|---|---|---|---|
| System of record | Agent 365 registry in the Microsoft 365 admin center (GA 1 May 2026) | AWS Agent Registry (GA 31 Aug 2026) | Agent Registry in Gemini Enterprise Agent Platform (GA 18 Jun 2026) |
| Automatic discovery | Power Platform inventory, Foundry Control Plane, Defender agent discovery | AgentCore Runtimes and Gateways across AWS Organizations | Supported workloads in the project; external endpoints by hand |
| Identity link | Microsoft Entra Agent ID per agent (GA); auto-created by Copilot Studio since July 2026 | AgentCore Identity workload identity (GA 13 Oct 2025) | SPIFFE-based Agent Identity; API in preview since 18 Jun 2026 |
| Approval before use | Requests queue: Pending review, Pending update, Pending activate | DRAFT, PENDING_APPROVAL, APPROVED, REJECTED; DEPRECATED is terminal | Sharing requests reviewed by admins in Gemini Enterprise (GA 23 Feb 2026) |
| Act on an agent | Block, management rules, 30-day soft delete, quarantine API, disable the Entra identity | Reject or deprecate the record (hides it from discovery); AgentCore Policy denies tool calls | Unregister (removes the record); Agent Gateway policies block it; ownership transfer |
| Other clouds | Sync with AWS Bedrock and Google Cloud in public preview | Indexes agents built elsewhere by hand; auto-detection is AgentCore only | Manual registration of external A2A agents and MCP servers |
Microsoft 365 E7 pricing comes from third-party coverage only, so this page quotes the Agent 365 standalone figure alone.
When should you not build a registry, and what goes wrong?
Do not start with a registry if you have fewer than a dozen agents on one platform: a shared list with an owner column does the job until the second platform arrives. Do not buy one as a substitute for deciding who may publish an agent to the whole company. Once you run one, these are the ways it fails.
Several registries and no single truth
Microsoft alone has the Agent 365 registry, Power Platform inventory, Foundry Control Plane, Entra agent identities and the Defender AI agents page, and its docs note that Foundry Agent Applications are not registered in the Entra agent registry. Declare one system of record.
Rows that look like duplicates
The same Copilot Studio agent can appear more than once in the Microsoft registry with different publisher types, and removing one entry does not remove the other. Brief the reviewers first.
Discovery that is partial by design
Defender lists a local agent only after it observes agent activity and says it is not a complete inventory of installed software. AWS auto-detection covers AgentCore Runtimes and Gateways, one Region per registry. Browser-based discovery misses desktop and command-line agents.
Ownerless agents
Shared agents become ownerless when the user who created them is deleted. Without a rule that reassigns or blocks them, the count only goes up.
Stale or missing fields
In Power Platform inventory the Modified on and Last modified by columns do not work for agents. Risk counts in the Microsoft 365 admin center can be up to an hour behind. Check a field before alerting on it.
Self-reported metadata and preview dependencies
Purpose, data access and risk written by the publisher are only as good as the review. Cross-cloud sync, the Graph registry API and IBM Discover were all preview on 2 Nov 2026, so a runbook that depends on them needs a manual fallback.
What should you set up?
The controls that turn a list into a registry, in the order we install them.
- One declared system of record per cloud, and one owner for the reconciliation between them.
- Discovery switched on for every platform you run, from Power Platform inventory to AWS auto-detection and Google Agent Registry in every project.
- A minimum record: name, purpose, owner, sponsor, identity, platform, environment, tools and data reached, risk tier, approval state, review date. Fields the product lacks go into tags, with the tag names written down.
- An identity per agent (Entra Agent ID, AgentCore Identity, Google Agent Identity); no shared service accounts and no human accounts used by agents.
- Risk tiers with a rule per tier: personal agents self-serve in a routed developer environment; team agents need an owner and a sponsor; agents that write to systems of record need approval and an evaluation gate before release.
- Hygiene rules: reassign ownerless agents, block ownerless agents with no usage, enforce data policies on connectors, limit sharing, and auto-reject publish requests nobody reviewed in time.
- A tested containment action per platform: on Microsoft 365, block or quarantine the agent and disable its Entra agent identity; on AWS, deny its tool calls in AgentCore Policy and Gateway authorization, since rejecting the registry record only hides it from discovery; on Google, block it at Agent Gateway and remove its IAM bindings, since unregistering only removes the record. Note what each leaves running (a Foundry stop does not end existing runs).
- Retirement with a recovery window (30-day soft delete on Microsoft 365), identity revoked, logs archived, and a quarterly review of the four counters: total, ownerless, unmanaged, unused for 90 days.
Enterprise example · Worked example · illustrative
A 6,000-person manufacturer finds 140 Copilot Studio agents
Illustrative scenario. An industrial manufacturer with 6,000 staff, a Microsoft 365 E5 tenant, SAP for orders, and a Copilot Studio licence two business units had used for a year.
The trigger was a question from internal audit: how many AI agents touch SAP? Nobody knew. Power Platform inventory showed 140 Copilot Studio and Agent Builder agents across 23 environments, 61 in the shared Default environment; the Agent 365 registry showed 38 without owners and 52 with no sessions in 90 days.
The team sorted the 140 into four groups. 52 abandoned agents were blocked, then deleted with the 30-day recovery window. 31 duplicated each other (four HR policy assistants, five variants of a supplier lookup) and were consolidated into 6 owned agents. 12 were active but ownerless: the Agent Builder ones were reassigned by rule to the previous owner’s manager, the Copilot Studio ones by hand, and each manager took ownership or retired the agent. The remaining 45 kept their owner.
That left 63 agents. Each got an Entra agent identity (Copilot Studio has created one for every new agent since July 2026), a business sponsor, and a risk tier as an admin-managed tag: tier 1 answers from the maker’s own files, tier 2 reads shared SharePoint and Dataverse data, tier 3 writes to SAP through a connector. There were 7 tier 3 agents, and 2 had been published with no authentication, so anyone with the link could use them.
Tier 3 is where the controls bit. Each of the 7 went through the Requests queue, got an evaluation set of 40 real order scenarios, and was published once the owner signed the results. A data policy blocked the Chat without Microsoft Entra ID authentication connector tenant-wide and restricted the HTTP connector to approved endpoints. Makers were routed to personal developer environments in a managed environment group, so new work no longer landed in Default. Six months later the registry held 71 owned agents, and the audit question had a one-line answer.
- Registry
- Agent 365 registry as the system of record; Power Platform inventory and Defender as discovery sources
- Owner
- Named owner and business sponsor per agent; a rule reassigns ownerless Agent Builder agents to the previous owner’s manager
- Identity
- Microsoft Entra Agent ID per agent; Conditional Access template that blocks high-risk agent identities
- Data access
- Data policy blocks unauthenticated chat and restricts HTTP to approved endpoints; sharing limits; makers routed to developer environments
- Risk tier
- Three tiers as admin-managed tags; tier 3 (writes to SAP) needs approval, an evaluation gate and monitoring
- Approval
- Requests queue with Publish to store or Reject submission; requests older than 30 days auto-rejected
- Monitoring
- Defender AI agents inventory and the registry Risks column; quarterly review of the counters
- Retirement
- Block, then delete with the 30-day soft-delete window; identity disabled; evaluation results archived
How do you start?
- Count what you have. Export every registry and inventory you run, plus the Defender local agent list. Expect the numbers to disagree.
- Declare the system of record and its reconciliation owner, in writing.
- Decide the minimum record and the tag names for risk tier, data classes and review date. Apply them to the top 20 agents by usage first.
- Switch on the hygiene rules for ownerless and unused agents, and tell makers what will happen and when.
- Set the approval rule per tier and route makers out of the Default environment.
- Test every kill switch on a throwaway agent, and write down what each one leaves running.
- Put the four counters on a monthly report, and review again after Ignite and re:Invent in late 2026.
Frequently asked questions
What is the difference between an AI agent inventory and an AI agent registry?
An inventory is the list discovery produces, complete or not. A registry is the curated record per agent, with an owner, an identity, a risk tier and an approval state attached.
Do we need Microsoft Agent 365 to run a registry on Microsoft 365?
No. Viewing the inventory needs no specific licence, Entra Agent ID is available to Entra customers, and the Requests queue works without it. The Risks column and cross-cloud sync need Agent 365 or Microsoft 365 E7. Conditional Access for agents needs E7, or Agent 365 plus Entra P1 or Microsoft 365 E3, and the ID Protection page says an Agent 365 licence will be required (Microsoft Learn, 2 Nov 2026).
How do we find shadow AI agents our staff built or installed?
In three places. Browsers: Purview and Defender for Cloud Apps detect AI apps used through the browser. Endpoints: Defender for Endpoint discovers local AI agents and their MCP server configurations. Platforms: the inventories and registries list what was built on sanctioned platforms. None of the three is complete alone.
Is agent sprawl the same thing as shadow AI?
They overlap. Shadow AI is AI that staff use or build without IT knowing. Agent sprawl is too many agents, often duplicated, ownerless or abandoned, across platforms with no central list, including agents IT knows about. A registry addresses both; the hygiene rules (reassign ownerless, block unused) reduce sprawl.
Who should own an agent?
A named person who answers for what it does, plus a business sponsor who answers for why it exists. Entra separates owners (technical) from sponsors (business) and can transfer sponsorship when someone leaves. Microsoft’s own practice deletes individually owned agents when the employee leaves.
What should a registry entry contain at minimum?
Name, purpose, owner, sponsor, identity, platform, environment, the tools and data it reaches, risk tier, approval state and review date. The products hold the first few natively; risk tier, data classes and review date go into tags. The sub-page on what an AI agent registry is lists every field.
Does one registry work across Microsoft, AWS and Google?
Partly, and only in preview as of 2 Nov 2026. Agent 365 registry sync with AWS Bedrock and Google Cloud is in public preview, and IBM’s Orchestrate Discover is a technology preview. Each registry is strongest for its own platform, so we recommend one per cloud, reconciled into a declared system of record.
In this topic
Sources
Each source was read on 2 November 2026. The date shown is the date on the page, or the page’s ms.date for Microsoft Learn; an undated page shows the date it was read.
- Agent Registry in the Microsoft 365 admin center
- Agent Registry convergence with Microsoft Agent 365
- Microsoft Agent 365 now generally available
- Agent settings in the Microsoft 365 admin center
- Agent requests
- Agent actions in the Microsoft 365 admin center
- What’s new in Microsoft Entra Agent ID
- Manage agents in Foundry Control Plane
- Power Platform inventory
- Discover AI agents (Defender XDR)
- Local AI agent discovery (Defender for Endpoint)
- Configure data policies for agents (Copilot Studio)
- Limit sharing in managed environments
- What’s new in Copilot Studio
- Deploying Microsoft Agent 365: how we’re extending our infrastructure to manage agents at Microsoft
- AWS Agent Registry now generally available
- The future of managing agents at scale: AWS Agent Registry now in preview
- AWS Agent Registry record lifecycle
- Using AWS Agent Registry with AWS Organizations
- Gemini Enterprise Agent Platform release notes
- Agent Registry overview
- Gemini Enterprise release notes
- AI Control Tower: what’s new in the June 2026 release
- ServiceNow launches AI Control Tower
- IBM introduces identity and control for AI agents
- IBM report: 13% of organizations reported breaches of AI models or applications (Cost of a Data Breach 2025)
- Microsoft and LinkedIn release the 2024 Work Trend Index
- Work Trend Index 2026: agents, human agency and the opportunity for every organization
- Over 40% of agentic AI projects will be scrapped by 2027, Gartner says
- A2A protocol specification, version 1.0.0
- Introducing the MCP Registry (preview)
Planning an AI program?
Talk to the team that builds it and runs it after launch.
- Built to SOC 2, HIPAA and GDPR standards
- EU AI Act-aligned delivery
- Microsoft Solutions Partner