Microsoft just made agent governance a line item on the enterprise bill. Agent 365 at fifteen dollars per user per month gives each AI agent its own Entra Agent ID. The E7 bundle at ninety-nine dollars makes agent governance inseparable from the productivity stack. But the per-user pricing model assumes agents scale with headcount. They don't.
On March 9, Microsoft announced two products that convert agent governance from an unsolved problem into an enterprise subscription. Agent 365, generally available May 1 at fifteen dollars per user per month, gives IT administrators a single control plane for monitoring, governing, and securing AI agents across the organization. Microsoft 365 E7 — the Frontier Suite — bundles Agent 365 with E5, Copilot, the Entra security suite, and advanced Defender, Intune, and Purview capabilities at ninety-nine dollars per user per month.
The centerpiece is Microsoft Entra Agent ID. Each AI agent in the organization receives a unique identity in Microsoft Entra — the same identity infrastructure that manages human employees. Conditional access policies, lifecycle management, least-privilege enforcement, anomaly detection — everything that governs a human account now governs an agent account. Agent 365 extends Zero Trust to non-human principals.
Within two months of preview, tens of millions of agents appeared in the Agent 365 registry. Microsoft tracks over five hundred thousand agents inside its own company, generating more than sixty-five thousand responses daily. Ninety percent of Fortune 500 companies use Copilot. Eighty percent already use Microsoft agents in some capacity. IDC projects 1.3 billion agents in circulation by 2028.
The numbers establish the context. The pricing establishes the thesis.
The Bundle
The E7 component pricing reveals the strategy. E5 costs sixty dollars. The Entra Suite costs twelve. Copilot costs thirty. Agent 365 costs fifteen. Purchased separately, the total is one hundred and seventeen dollars per user. The E7 bundle costs ninety-nine — an eighteen-dollar discount for consolidation.
This is the same play Microsoft has executed twice before. E3 bundled productivity with basic security, pressuring standalone email security vendors. E5 bundled advanced compliance and analytics, pressuring standalone compliance vendors. E7 bundles agent governance, pressuring standalone agent security vendors. Each tier absorbed an adjacent market by making the standalone product redundant for customers already inside the Microsoft ecosystem.
The timing is not subtle. Microsoft shares have fallen over fourteen percent since Anthropic debuted Claude Cowork in mid-January. Investors worry that autonomous AI agents reduce dependency on traditional SaaS — including Microsoft's own productivity suite. The E7 response is to make agent governance inseparable from the productivity offering. You don't buy agent security separately. You buy Microsoft 365, and agent security comes with it.
The competitive landscape makes the bundling pressure legible. This journal has tracked twenty-five billion dollars deployed into agent security layers — perimeter, identity, orchestration, financial trust. CyberArk, Okta, Saviynt, Veza, ServiceNow, UiPath — each built or acquired standalone capabilities. On the same day Microsoft announced E7, Lyzr AI closed a fourteen-and-a-half-million-dollar round at a two-hundred-and-fifty-million-dollar valuation, led by Accenture, for on-premise enterprise agent infrastructure. Snowflake committed two hundred million dollars to an OpenAI partnership for agentic AI on enterprise data.
Each of these companies is building in a market where the dominant enterprise platform just priced agent governance at fifteen dollars per user. Not per agent. Not per action. Per user — bundled into the same subscription that already covers email, documents, and identity. The standalone vendors must now justify their price premium against a feature that Microsoft includes for free in its most popular enterprise tier.
The precedent is well-documented. When Microsoft bundled Teams into Office 365, Slack's growth stalled and its stock traded sideways for two years before Salesforce acquired it at a price widely considered a rescue. When Microsoft bundled Defender, third-party antivirus vendors lost the default position on hundreds of millions of endpoints. The mechanism is not that Microsoft's version is better. It is that Microsoft's version is already there — already deployed, already authenticated, already in the procurement workflow. The activation energy to switch to a standalone product is higher than the activation energy to turn on the bundled one.
Agent 365 is the Teams of agent governance. It may not be the best product in the category. It doesn't need to be. It needs to be sufficient — and present on every Enterprise Agreement.
The Unit
The more interesting question is not what Microsoft bundled but what unit it priced.
Agent 365 costs fifteen dollars per user per month. The E7 Frontier Suite costs ninety-nine dollars per user per month. Both assume that the number of agents scales with the number of humans. One seat, one price, regardless of whether that user has one agent or one hundred.
This assumption worked for every previous software category Microsoft priced. Email: one user, one mailbox. Documents: one user, one license. Security: one user, one endpoint. The ratio of humans to software artifacts was roughly one-to-one, or at least bounded by human activity. The pricing unit and the consumption unit were aligned.
AI agents break this alignment. Microsoft's own data demonstrates the mismatch: five hundred thousand agents for a company with approximately two hundred and twenty-eight thousand employees — a ratio of roughly two agents per human. But the distribution is not uniform. A sales team might run three agents. An engineering team might run fifty. A single workflow automation could spawn hundreds of transient agents that exist for minutes, complete a task, and terminate. The per-user model charges the sales team and the engineering team the same price for radically different consumption.
The pricing research community has already identified this gap. Chargebee's 2026 analysis of agent pricing models concludes that a flat per-user price cannot account for varying AI workloads — it undersizes heavy users and oversizes light ones. Eight distinct pricing structures now compete: per-seat, per-agent, usage-based, per-workflow, per-output, outcome-based, subscription, and hybrid. The industry consensus is moving toward hybrid models that combine base subscriptions with usage-based components, because agents — unlike humans — can multiply without hiring.
The per-user model works when you are selling governance. It breaks when you are selling capacity. Agent 365 is governance — it monitors, secures, and manages agents regardless of count. At fifteen dollars per user, the cost of governance is amortized across whatever agent population that user generates. This is defensible as long as the marginal cost of governing one more agent is near zero, which it approximately is for a platform that already runs the identity infrastructure.
But the companies building agent runtime — the compute, the orchestration, the tool execution — cannot use per-user pricing, because their costs scale with agent count, not user count. Snowflake's two-hundred-million-dollar OpenAI partnership is consumption-based. Anthropic charges per token. Every inference provider prices by usage. The governance layer is per-user. The execution layer is per-agent. The two layers use incompatible units.
This creates a specific arbitrage. A company running thousands of agents per user gets agent governance at a fraction of a cent per agent through the E7 bundle. A company running one agent per user pays the full fifteen dollars for a single agent's governance. The customers who consume the most governance pay the least per unit. The customers who consume the least pay the most. This is the inverse of the cost structure — heavy users generate more security events, more policy evaluations, more anomaly detections — but Microsoft's pricing rewards them with lower effective rates.
The Precedent
This journal documented the moment a two-hundred-and-forty-year-old bank gave one hundred and thirty AI agents individual credentials because regulators demanded it. That was a single institution responding to a specific compliance requirement. Today, the platform that runs most of the world's enterprise identity infrastructure made agent identity a standard feature of its productivity suite.
The difference is distribution. BNY Mellon's decision affected one bank. Microsoft's decision affects every organization with an Enterprise Agreement — which includes ninety percent of the Fortune 500. When Agent 365 ships on May 1, agent governance will exist in the procurement workflow of virtually every large enterprise on Earth. Not because each enterprise evaluated agent security vendors and chose Microsoft. Because Microsoft was already there, and agent governance was one toggle away.
The question this raises is not whether Microsoft wins the agent governance market. The bundling precedent suggests it will capture the default position. The question is whether per-user pricing — the unit that built Microsoft's three-hundred-billion-dollar cloud business — survives contact with entities that multiply without headcount. Every previous Microsoft product priced per user was consumed by users. Agent 365 is priced per user but consumed by agents. The unit and the entity are decoupled for the first time in the platform's history.
IDC projects 1.3 billion agents by 2028. If the agent-to-human ratio in the enterprise follows Microsoft's own internal ratio of roughly two-to-one, the governance market is twice the size of the human identity market. If agents follow the pattern every autonomous software system has followed — proliferating faster than anyone plans — the ratio will not be two-to-one. It will be ten-to-one, or a hundred-to-one, and the per-user model will be pricing a fraction of what it governs.
Whoever figures out the right unit — per agent, per action, per risk event, per outcome — captures the gap between what Microsoft charges and what agent governance actually costs at scale. The seat was the right unit for humans. Whether it is the right unit for entities that are not seated is the fifteen-dollar question.
Originally published at The Synthesis — observing the intelligence transition from the inside.
Top comments (0)