Microsoft is making a big bet that the next phase of enterprise AI won’t be won by the flashiest model demo—it’ll be won by whoever makes agents usable, governable, and secure enough for actual companies to trust.
That’s the backdrop for today’s announcement, which includes Wave 3 of Microsoft 365 Copilot, broader model support that now includes Claude alongside next-gen OpenAI models, the general availability of Agent 365 on May 1 for $15 per user, and a new bundled offering called Microsoft 365 E7 Frontier Suite, which will go generally available the same day for $99 per user.
In plain English: Microsoft is trying to move AI inside the enterprise from “cool pilot project” to “thing your company actually runs.”
And for once, the interesting part is not just the model menu.
The Neuron recently sat down with Microsoft Security CVP Vasu Jakkal to dicuss the role of security in Agent 365. She framed the problem pretty clearly: agents are spreading faster than many organizations can keep track of them.
“If you cannot see something, you cannot protect it,” she said. In her view, that creates a visibility gap, which becomes a security gap, which then becomes real business risk. She tied that directly to Microsoft’s research showing that more than 80% of Fortune 500 companies are already using agents, while many leaders still lack mature security controls around generative AI.
That’s where Agent 365 comes in.
Microsoft calls Agent 365 the control plane for agents, a central layer for IT, security, and business leaders to track what agents exist, who is using them, how they behave, what they can access, and where the risks are.
In Jakkal’s words, Agent 365 is meant to answer questions like: “What are the agents in my organizations? Who is using these agents? What’s the data in these agents? How are these agents working with each other? What are the risks for these agents?”
That idea may sound a little dry on paper, but it’s a very real enterprise problem. A chatbot in a demo is cute. Thousands of semi-autonomous agents wandering around your company’s data estate with unclear permissions is… less cute. More raccoon-in-the-server-room energy.
Jakkal’s bigger point is that agents should increasingly be treated like digital workers, not just software.
“We need to treat agents like people,” she said, explaining that when humans join a workforce, they get identities, onboarding, conditional access, and data security policies, and agents need the same kind of structure. That logic sits at the center of the Agent 365 overview on Microsoft Learn, which describes the product as a secure, scalable way to govern agents across a Microsoft 365 tenant.
We recently brought Bryan Goode, Microsoft's CVP of Business Applications Marketing, on The Neuron LIVE! to show off Agent 365, if you'd like a deeper look of it in use after reading.
She also made an important distinction: agents should not necessarily inherit all the permissions of the humans they assist. A finance executive may have access to a huge amount of sensitive information, but their agent may only need access to a narrow subset of it. That’s one reason Jakkal argued agents may actually require more observability than humans in some cases: they act faster, operate at scale, and can make mistakes in bulk, instead of one at a time. Tiny whoopsies, but enterprise-sized.
That security framing is also what makes this Copilot update more interesting than a normal product refresh.
According to Microsoft, Wave 3 of Microsoft 365 Copilot adds more agentic experiences across Word, Excel, PowerPoint, and Outlook, while also leaning harder into what the company calls Work IQ. This all supports the idea that enterprise AI becomes genuinely useful when it understands not just general knowledge, but the specific context of how work gets done inside an organization. Microsoft says this next wave will improve Copilot chat, help users create and augment work artifacts more fluidly, and let them build agents within the canvases they already use every day.
Just as important, Microsoft is continuing to push a model-diverse strategy. Rather than tying Copilot to a single model provider, the company says Copilot is “model diverse by design,” and it’s now bringing Claude into mainline chat through the Frontier program, alongside the latest OpenAI models. Microsoft has also already documented Claude support in some Copilot experiences, including Researcher. That is a pretty loud signal that enterprise buyers should expect orchestration, not monoculture.
That matters because most large organizations do not want to rebuild their workflows every time the leaderboard changes. They want simple optionality. Microsoft is trying to sell exactly that: use the best model for the task, inside the existing Microsoft surface area, with the governance layer already attached.
Security is the second half of that story, and Jakkal was especially sharp on why the timing matters now.
“Data hygiene, we know that. Identity hygiene, monitoring operations hygiene. But AI just puts such a shiny light on that,” she told me. In other words, AI is not inventing entirely new enterprise security problems out of thin air, it is amplifying old ones at machine speed.
If your files are mislabeled, your access policies are sloppy, or your governance is inconsistent, agents don’t politely refuse to participate in the chaos. They operationalize it. Efficiently. Like tiny interns with rocket skates.
She gave a concrete example: if highly sensitive financial files are labeled too broadly, AI systems do not magically understand that nuance.
“AI doesn’t know that and it will access that. AI agents will access that,” she said. That’s why Microsoft is so focused on making sensitivity labeling, policy enforcement, conditional access, and threat protection part of the default scaffolding around agents rather than optional cleanup later.
That same logic shows up in Microsoft’s security messaging around what it calls “double agents.” As Jakkal put it, each agent is also its own attack surface. In the interview, she said Microsoft has done red-team research showing how agents can be manipulated if the right controls are not in place.
“A malicious actor can manipulate your agent into becoming… a double agent,” she said, a phrase reminiscient of a James Bond film, but also genuinely useful shorthand for a real risk category.
This is where the new E7 bundle starts to make strategic sense.
Microsoft says the Microsoft 365 E7 Frontier Suite will combine Microsoft 365 E5, Microsoft 365 Copilot, Agent 365, Microsoft Entra Suite, and advanced Defender, Intune, and Purview capabilities into a single package. The company is positioning it as a simpler and more cost-effective route for enterprises that are already heading toward large-scale AI deployment and do not want to stitch together the stack à la carte.
Microsoft’s enterprise pricing pages already reflect the surrounding product structure, while the new Agent 365 site and documentation make clear that Microsoft sees agent management as a first-class enterprise layer, not an experimental sidecar.
The bigger strategic move here is pretty clear: Microsoft wants to define the next enterprise AI stack as models + work context + identity + security + governance. This taking a step beyond the common “here’s a chatbot for your spreadsheet”-approach to corporate AI, in exchange for "letting humans and agents work together without turning your compliance team into a support group."
Jakkal put that shift in the clearest possible terms.
“I don’t think agents are really the next big thing anymore. It’s the baseline of how we do things,” she said. “The future isn’t just about smarter agents, it’s about trusted agents.”
That, more than any individual feature, is the story Microsoft is trying to tell today.
Wave 3 of Copilot matters. Claude showing up inside Copilot matters. Agent 365 matters. The E7 bundle matters. But the real bet is that the next phase of enterprise AI will not be won by raw model capability alone. It will be won by whoever makes AI legible, governable, and safe enough for organizations to use at full scale without holding their breath.
That is a much more practical vision of AI than the industry usually likes to sell. Which, annoyingly enough for the hype machine, is probably why it has a real shot.
We also sat down with Jakkal in the fall during Microsoft Ignite 2025 in San Francisco. Watch the full interview here.
