Licensing runs on three independent axes, and movement on one never implies coverage on another. Most AI security budgeting errors are one of two assumptions: that an M365 purchase covers Azure AI workloads, or that Agent 365 includes the Sentinel data lake. Neither is true.
| Axis | Billed | What lives here |
|---|---|---|
| Microsoft 365 | Per user | Copilot audit, Purview, Defender XDR, Agent 365 / E7 — the agent control plane |
| Azure — Defender plans | Per resource + per tokens scanned | Foundry and Azure OpenAI workload security (surface 2) |
| Sentinel | Ingestion, retention, and the data lake tier | SIEM correlation — and the lake tier that carries the deepest agent telemetry. Agent 365 writes into the lake; it does not include it |
AgentsInfo — local agents populate on E5 / MDE P2 with no Agent 365 licence (tenant-verified); cloud agents need Agent 365.
CloudAppEvents — Copilot interaction verdict rows (Jailbreak, XPIA) arrive on E5; the Agent 365 runtime rows (InvokeAgent, InferenceCall, ExecuteToolBy*) do not exist until Agent 365 instruments an agent.
| You hold | You can already do | What the next tier adds |
|---|---|---|
| M365 E5 | Copilot interaction audit with safety verdicts · free security alerts · local-agent discovery and inventory (MDE P2) · read every agent identity in Entra · shadow-AI discovery | Agent 365 / E7: cloud-agent inventory and posture · Conditional Access, ID Protection and lifecycle for agents · runtime telemetry (invocations, tool calls) · the registry's Risks column and Security tab · local-agent risk scoring |
| + M365 Copilot | CopilotActivity populated per interaction | |
| Sentinel + lake tier | Two preview connectors land the deepest data lake-side: UnifiedAgentObservability (full spans — prompts, tool arguments, session reconstruction) and the four-table EntraAgent* identity graph. Without the lake, the richest agent telemetry has nowhere to land | |
Never quote a price from a web page — including this one; verify against the current Microsoft price list. And when a screen shows nothing, check the licence gate before declaring a data gap — the Agent Telemetry Map carries the gate on every table for exactly this reason.