- Home
- AI agents
- AI agent registry and sprawl
- Controlling agent sprawl
Govern and secure · AI agent registry and sprawl
Controlling agent sprawl: how to find, consolidate, own and retire agents
Agent sprawl is the state where agents multiply across platforms faster than anyone records, owns or retires them. Controlling it means four routines that run on a schedule: discover agents wherever they appear, consolidate duplicates into owned ones, enforce ownership and sharing rules for the people who build them, and retire the ones nobody uses.
In this guide: 83 pages
Key takeaways
- Discovery has three layers (browser and network, endpoint, platform) and none is complete alone. Run all three and reconcile into the registry.
- Duplicates are found by purpose, and consolidation is a people decision: one owned agent per purpose per environment, with the evaluated one surviving.
- Citizen builders need a sandbox, a sharing limit and a data policy before they need training. Power Platform environment routing, environment group rules and data policies do this on Microsoft; Gemini Enterprise sharing controls do it on Google.
- Retirement is a sequence: block, wait, delete, revoke the identity, archive the logs. Microsoft 365 keeps a deleted agent restorable for 30 days; AWS marks the record deprecated for good.
Where do you find agents that nobody registered?
In three layers, each with its own tooling and its own blind spots: the browser and network layer, the endpoint layer and the platform layer. The registry topic page lists the platform inventories; this page covers the other two and the gaps between all three.
Browser and network. Microsoft Purview groups AI apps into Copilot experiences and agents, enterprise AI apps, and other AI apps detected through browser activity and categorised as generative AI in the Defender for Cloud Apps catalog. Endpoint DLP can warn or block a user who pastes sensitive data, a credit card number for example, into a third-party generative AI site, and Insider Risk Management ships a risky AI usage policy template. Microsoft Entra Global Secure Access can route Copilot Studio agent traffic through web content filtering per environment (Agent 365 licence required).
Endpoint. Defender for Endpoint discovers local AI agents on Windows and macOS (macOS in preview): command-line tools, desktop apps, agentic IDEs, VS Code extensions and OpenClaw-style local agents, together with their MCP server configurations. An agent here is a combination of a user, a device and an agent type, it appears only after Defender observes activity, and Microsoft says the list is not a complete inventory of installed software. Agent 365 added Intune policies that block common ways OpenClaw runs, in preview for Frontier customers.
Platform. The Defender AI agents inventory covers Copilot Studio, Foundry, Microsoft 365 and supported non-Microsoft platforms, and Microsoft says it finds agents built on Amazon Bedrock and Google Cloud. Setup is in the Defender portal under Security for AI: connect the Microsoft 365 connector and switch on real-time protection for Copilot Studio. On the other clouds the registries auto-detect their own platform (AgentCore Runtimes and Gateways across an AWS Organization; supported workloads in a Google project) and take everything else by hand. The registry counters and a quarterly export of all three layers close the loop.
How do you consolidate duplicates without a fight?
By deciding the rule before the list, and by making the decision about purpose rather than about people. The rule we use is one owned agent per purpose per environment; the survivor is the one with an evaluation set and a sponsor, and the others are merged into it or retired through the normal sequence.
Duplicates hide behind names. Four agents called HR assistant may answer different questions, and two with different names may answer the same one, so sort by purpose, which the owner writes and the Microsoft 365 admin center exports alongside the agent’s instructions. Then use the counters the registry already keeps (total agents, agents without owners and unmanaged agents on Microsoft, plus the sessions and runs each inventory reports) to find agents with no usage in 90 days.
The merge itself is a short meeting per purpose. The owners of the duplicates agree which one survives; the survivor keeps its evaluation set and gains the others’ knowledge sources where they add something; the retired ones are blocked first, so that anyone still using them notices, then deleted, which starts the soft-delete window. Microsoft’s own tenant runs a tiered version of this: individuals may create and share simple, low-risk agents in a safe space, team and line-of-business agents go through enterprise review, individually owned agents are deleted when the employee leaves, and team-owned agents have a lifecycle tied to attestation.
What rules should citizen builders work under?
Three rules before anything else: build in a personal developer environment instead of the shared Default environment, share only within limits, and run under a data policy that blocks the risky connectors. On Microsoft these are environment routing, managed environment sharing limits and Copilot Studio data policies; on Google they are Gemini Enterprise sharing controls and Agent Gateway egress rules.
Citizen-builder controls by platform, with the exact setting names as the vendor pages showed on 2 Nov 2026.
| Rule | Microsoft (Power Platform, Copilot Studio, Microsoft 365) | Google (Gemini Enterprise, Agent Platform) |
|---|---|---|
| Where makers build | Environment routing places each new maker in a personal developer environment inside an environment group; published group rules become read-only in member environments | Agents register in the project they are deployed in, and Agent Registry holds them |
| Who an agent can be shared with | Managed environment sharing: let people grant Editor permissions, let people grant Viewer permissions, only share with individuals (no security groups), limit the number of viewers; existing access is unaffected. Microsoft 365 admin center sharing (all users, no users, specific users) applies to Agent Builder agents | Enable agent sharing toggles; admins can require manual review of sharing requests (GA 23 Feb 2026) and transfer ownership of employee-made agents (21 Sep 2026) |
| Which capabilities are blocked | Data policies on connectors: Chat without Microsoft Entra ID authentication, HTTP with endpoint filtering, Skills, event triggers, and the channel connectors (Direct Line, Teams and Microsoft 365, Facebook, SharePoint, WhatsApp, Omnichannel, Application Insights); enforcement is real time and exemptions are no longer supported | Agent Gateway egress policies with allow and deny rules for agent and MCP server traffic; Model Armor on the gateway (GA 24 Jun 2026) |
| Group rules that touch agents | Sharing agents with Editor permissions, Sharing agents with Viewer permissions, Knowledge sources for agents, Skills in Copilot Studio, External models, Preview and experimental AI models, Generative AI settings, transcript access, Cost controls (draw from tenant credit pool), Maker guidelines (preview), Default deployment pipeline (preview), Solution checker enforcement, Advanced connector policy | IAM Unified Access Policies covering MCP servers (GA 31 Aug 2026) |
| Reaching the whole company | Agent and plugin access (built by Microsoft, by your organisation, by external publishers), user access (all, none, specific users or groups), and the Requests queue for org-wide publishing | Admin review of sharing requests in Gemini Enterprise |
Data policy enforcement has applied to all Microsoft tenants since early 2025. From October 2026 the admin deployment page warns when pipelines deploy to unmanaged target environments, with 30 days before such deployments are blocked, which pushes the last unmanaged environments into the fold.
How do you retire an agent properly?
In a fixed order: block, wait, delete, revoke, archive. Blocking first means anyone still relying on the agent notices while it can still be restored; deleting with a soft-delete window means a mistake costs a day; revoking the identity and archiving the logs mean the audit trail outlives the agent.
On Microsoft 365, block the agent in the admin center (for Foundry and SharePoint agents this only affects availability in Copilot Chat), then delete with the 30-day soft delete and restore window. Disable the Entra agent identity while the window runs rather than deleting it; deleting a blueprint cascades to its child identities with its own 30-day window, and Microsoft warns the cascade can take hours or days. Copilot Studio agents can be quarantined through the Power Platform API first, which leaves them usable only in the maker’s test pane. Admin actions from the Microsoft 365 admin center fail silently for environments with the Power Platform IP firewall in enforcement mode, so check the result.
On AWS, reject or deprecate the registry record, which hides it from discovery, then deny its tool calls in AgentCore Policy and Gateway authorization and remove the workload identity; DEPRECATED is terminal. Google’s sequence is to block the agent at Agent Gateway, remove its IAM bindings and unregister it, which removes the record. Whatever the cloud, keep the evaluation results, the traces and the last approved version with the registry record, because a retired agent is the one an auditor asks about.
Write the retirement rule down. Ours has three triggers: no usage for 90 days, no owner after the reassignment rule has run, or no sponsor after the owner left. Each trigger blocks the agent and starts a 30-day objection period, and the owner, or the former owner’s manager, gets the notice; deletion after that has its own soft-delete window.
How do Microsoft, AWS and Google implement it?
The sprawl controls on each cloud, with statuses as the vendor pages showed on 2 Nov 2026.
Capability, Microsoft, AWS, Google
| Capability | Microsoft | AWS | |
|---|---|---|---|
| Discovery beyond the platform | Purview and Defender for Cloud Apps (browser); Defender for Endpoint (local agents and MCP configurations); Defender AI agents inventory (platforms, including agents on Amazon Bedrock and Google Cloud) | AWS Agent Registry auto-detects AgentCore Runtimes and Gateways across an Organization; nothing outside AgentCore | Agent Registry registers supported workloads in a project; external endpoints by hand |
| Citizen-builder sandbox | Environment routing into personal developer environments; environment group rules; the Default environment kept empty | A developer platform; no citizen-builder sandbox to configure | Employee-made agents in Gemini Enterprise under admin sharing controls |
| Sharing limits | Managed environment sharing limits; Microsoft 365 admin center sharing for Agent Builder agents | RAM managed permissions on shared registries: ReadOnly, Consumer, Publisher, Admin | Enable agent sharing toggles; manual review of sharing requests (GA 23 Feb 2026); ownership transfer (21 Sep 2026) |
| Retirement | Block; quarantine through the Copilot Studio API; 30-day soft delete; Entra identity disable; blueprint cascade with a 30-day window | Reject or deprecate the record (DEPRECATED is terminal); deny in AgentCore Policy; remove the workload identity | Block at Agent Gateway; remove IAM bindings; unregister |
Defender discovery of local agents on macOS, OpenClaw blocking through Intune and connector usage in Power Platform inventory were preview on 2 Nov 2026.
Enterprise example · Worked example · illustrative
A 2,500-person freight forwarder reconciles three discovery lists and settles ownership
Illustrative scenario. A freight forwarder with 2,500 staff, Microsoft 365 E5, Copilot Studio in two business units, and a handful of developers running Claude Code and VS Code agents on laptops.
The three discovery layers disagreed. Power Platform inventory listed 61 agents across 11 environments; the Defender AI agents inventory listed 49 of those plus 3 Foundry agents nobody had registered; Defender for Endpoint listed 17 local agents on developer laptops, with 23 MCP server configurations between them; and the Defender for Cloud Apps catalog showed 6 browser AI apps in use without approval. Reconciling the lists took a week and produced one registry of 81 agents, with the 6 apps tracked as a separate category.
Ownership was the fight. Nine shipment-status agents had six owners across two business units, three of whom had left, and each unit claimed the best one. The rule settled it: one owned agent per purpose per environment, with a sponsor from each unit signing for its own copy, so nine became two. For the 19 ownerless agents, the reassignment rule moved the Agent Builder ones to the previous owner’s manager and the Copilot Studio ones went to the managers by hand; four managers retired theirs the same week.
The local agents stayed under a rule: no production credentials in any configuration, and every MCP server on the allow list, checked monthly against the Defender for Endpoint export. The 3 unregistered Foundry agents got records, identities and sponsors before they were allowed back into Copilot Chat.
- Owner
- Owner and sponsor on every surviving agent; the reassignment rule moves ownerless Agent Builder agents to the previous owner’s manager
- Identity
- Microsoft Entra Agent ID per agent; local agents tied to the user and device Defender reports
- Risk tier
- Tier by data reached (own files, shared data, writes to the transport management system); tier 3 needs approval
- Approval
- Requests queue for org-wide publishing; requests older than 30 days auto-rejected
- Sharing
- Managed environment limits: individuals only, 20 viewers, no security groups
- Data policy
- Environment group data policies on connectors; HTTP connector restricted to approved endpoints
- Retirement
- Block, objection period, then soft delete with a 30-day restore window; identity disabled; triggers: unused 90 days, ownerless, no sponsor
Frequently asked questions
Should we block Copilot Studio for everyone until governance is ready?
No. Blocking sends people to personal accounts, which is where shadow AI starts: Salesforce found in 2023 that over half of workplace generative AI users lacked formal approval. Route makers into personal developer environments, switch on the data policies and sharing limits, and let the registry fill while you review.
How do we stop an agent being shared with the whole company?
On Microsoft, with managed environment sharing limits (individuals only, a viewer cap, the Editor and Viewer switches) and the Requests queue for org-wide publishing; the limits apply to new shares and existing access stays. On Google, with the agent sharing toggles and manual review of sharing requests in Gemini Enterprise.
What happens to an agent when its owner leaves?
Shared agents become ownerless when the creator’s account is deleted. Microsoft 365 management rules can reassign ownerless Agent Builder agents to the previous owner’s manager and block ownerless agents with no usage, and Entra sponsor lifecycle workflows transfer sponsorship when a sponsor changes role.
How often should we run the sprawl review?
Monthly for the counters and quarterly for the full export, with the retirement triggers (unused 90 days, ownerless, no sponsor) running as rules in between. Power Platform inventory reflects changes within 15 minutes and Microsoft 365 risk counts can be up to an hour behind, so a monthly pass is fresh enough.
More in AI agent registry and sprawl
Sources
Each source was read on 2 November 2026. The date shown is the date on the page, or the page’s ms.date for Microsoft Learn; an undated page shows the date it was read.
- Microsoft Purview protections for generative AI apps
- Local AI agent discovery (Defender for Endpoint)
- Discover AI agents (Defender XDR)
- Enable security for AI agents in Defender
- Microsoft Agent 365 now generally available
- Secure Web and AI Gateway for agents (Global Secure Access)
- Environment groups
- Rules for environment groups
- Limit sharing in managed environments
- Configure data policies for agents (Copilot Studio)
- Agent settings in the Microsoft 365 admin center
- Agent requests
- Agent actions in the Microsoft 365 admin center
- Agent Registry in the Microsoft 365 admin center
- Power Platform inventory
- Quarantine agents (Copilot Studio admin API)
- Pipelines in Power Platform
- Agent identity deletion (Microsoft Entra Agent ID)
- Disable agent identities
- What’s new in Microsoft Entra Agent ID
- Deploying Microsoft Agent 365 at Microsoft
- Gemini Enterprise release notes
- Gemini Enterprise Agent Platform release notes
- Agent Registry overview
- AWS Agent Registry record lifecycle
- Using AWS Agent Registry with AWS Organizations
- Amazon Bedrock AgentCore release notes
- AI at work research: generative AI use without approval
Planning an AI program?
Talk to the team that builds it and runs it after launch.
- Built to SOC 2, HIPAA and GDPR standards
- EU AI Act-aligned delivery
- Microsoft Solutions Partner