Microsoft’s Agentic AI Governance Paradox
Microsoft assessed against Veqtor8’s ten principles for independent AI governance
Agentic AI governance is becoming a regular part of my conversations with large enterprises and Microsoft features in almost all of them. This is not surprising given that Microsoft is so deeply embedded in enterprise IT architecture. It is now extending its position into agentic AI with a growing set of capabilities for discovering, securing and governing agents.
Veqtor8 published ten principles for independent agentic AI governance in May 2026. They were developed from a series of AI governance workshops and ongoing discussions with enterprises which are adopting agentic AI products and services. The principles cover the operational governance of agents, but also the need for independent oversight across platforms, models, data sources and workflows.
Microsoft provides an interesting case against which to consider those principles. Its governance capabilities are extensive, particularly around agent identity, ownership and operational control. At the same time, Microsoft is both a major provider of the agentic AI environment and a provider of the tools used to govern it.
This creates an interesting paradox. The more an enterprise uses Microsoft to manage and govern its agents, the more its governance depends on the same platform it is trying to oversee.
I have used the ten principles here to take a closer look at Microsoft’s approach. It draws primarily on discussions with enterprises, including their experiences with Microsoft. Product information and analyst briefings are also used to understand the Microsoft capabilities discussed.
The ten principles
Architectural independence. The governance layer operates above the platform estate as continuously running infrastructure, accountable to none of the platforms it observes.
Governance for operational excellence and resilience. Governance exists to make the enterprise better run and remains available if any platform in the estate becomes unavailable.
Data portability and sovereignty. Governance evidence is owned by the enterprise, held in formats it controls, and producible to an auditor without any vendor’s cooperation.
Data governance as a foundation. Unified cataloguing, classification, lineage, quality monitoring and semantics that hold their meaning across platforms.
Federated architecture. Signals are ingested from any platform, normalised into a common governance model and presented as one view.
Reduced vendor concentration. Governance avoids recreating the concentration risk it seeks to manage.
Cyber and identity governance across machine boundaries. Consistent identity tracking for people, agents, workflows, service principals and model-to-model connections, including across platform boundaries.
Continuous cross-platform auditability. Evidence is captured as activity occurs, including what crossed a boundary, under whose authority and in what governance state.
Agent accountability and ownership. Every agent carries a named owner, an authorisation record, defined operational limits and a decommissioning process.
Independent quantification of AI risk and value. Risk and return are measured using sources with no financial interest in the answer.
Microsoft’s agentic governance stack
Microsoft has assembled a broad set of capabilities for governing agents. Agent 365 provides an agent registry, maps activity and connections, and works with Microsoft Defender and Microsoft Purview for security and governance. Entra Agent ID gives agents identities, access policies, lifecycle management and scoped permissions.
Defender provides runtime security controls, while Purview provides classification, data protection and compliance capabilities. Microsoft IQ brings together organisational context, structured business data and semantics, enterprise knowledge and external information.
These capabilities address issues raised repeatedly in enterprise discussions. Organisations need to understand the agents in use, accountability for those agents, their access, their activities, their value and their cost.
Microsoft assessment against the 10 principles
I have assessed Microsoft against each of the ten principles, based primarily on enterprise feedback and analysis of Microsoft’s current capabilities. The results fall into three groups.
Strong alignment
Agent accountability and ownership
Ownership is one of the first problems enterprises encounter as agent numbers grow. Organisations need visibility across all agents, an understanding of agent accountability, their permissions and their costs.
Agent 365 addresses much of this within the Microsoft environment. Its registry can include Microsoft-built, partner, synced and self-registered external agents. Sponsorship provides named accountability and lifecycle management supports decommissioning. Per-user rather than per-agent licensing also means governance licensing does not rise directly with every additional agent.
Cyber and identity governance across machine boundaries
Identity becomes more difficult as agents act on behalf of people, call tools, interact with other agents and move between systems.
Entra Agent ID gives agents identities and applies access policies and permissions to them. This provides a strong accountability chain within the Microsoft environment. Once an agent crosses into another platform, however, the end-to-end record also depends on identity controls and telemetry from that environment.
Data governance as an agentic AI governance foundation
Data governance comes up consistently in enterprise discussions. Organisations need to control the data agents can access and ensure they work from consistent business definitions.
Fabric IQ combines data accessible through OneLake with semantic models and ontologies covering business entities, relationships, rules and actions. Its coverage depends on data being accessible through OneLake. Shortcuts can provide zero-copy access to some external data held in supported open formats, while operational databases and many other enterprise systems use mirroring or ingestion.
Large enterprises typically operate across ERP systems, SaaS applications, operational databases, mainframes and multiple analytical platforms. Fabric IQ provides governance and semantics across data made available through Fabric. The enterprise requirement extends across the wider data estate.
Mixed alignment
Federated architecture
Organisations generally expect their agent estates to include several platforms. Agent 365 can include partner, synced and self-registered external agents, giving enterprises a broader view of their agent estate.
Microsoft can provide a broader view of the agent estate, but that view is based on Microsoft’s governance model and telemetry, and the depth of information may differ between Microsoft and third-party agents. The Veqtor8 principle goes further, calling for signals from all platforms to be brought together and normalised into a common enterprise governance model, rather than viewed through the governance model of one platform provider.
Continuous cross-platform auditability
Enterprises need to reconstruct what an agent did after an unexpected outcome, security incident or regulatory investigation. Microsoft provides extensive logging and audit capabilities within its environment.
Cross-platform workflows are harder. Establishing what data moved, who authorised the action, which controls applied and what actions followed depends on evidence from every environment involved.
This is an industry-wide challenge. Enterprises need a continuous audit trail that follows the agent across platform boundaries.
Independent quantification of AI risk and value
Enterprises are struggling to measure the economics of agentic AI consistently. They can usually identify productivity improvements, faster processes and increased capacity. Few can consistently connect the cost of individual agents with the financial value they create.
Microsoft provides detailed cost and usage information across its services, with reporting available at model and deployment level and finer attribution to individual agents and sessions still developing. This gives enterprises a reasonable basis for managing the economics of Microsoft-based agents.
A major challenge emerges when agents operate across multiple platforms. Enterprises need to bring cost, risk and outcomes together across the whole agent estate and measure them consistently against their own business objectives.
Vendor evidence can provide useful benchmarks, but enterprises ultimately need their own independent measures of agent cost, risk and value.
The limits of platform-native governance
Platform-native governance has a natural boundary. It can provide deep control and visibility inside the platform, but it cannot independently oversee the platform itself.
Microsoft has assembled a substantial governance stack for agents operating in its environment. The remaining four principles are harder to meet through a platform-native model because they require some separation between the governance layer and the platforms it oversees.
Architectural independence
Microsoft provides an integrated governance environment for its agents, drawing on capabilities across Agent 365, Entra, Defender and Purview. This gives enterprises strong visibility and control over agents operating within the Microsoft environment.
The limitation is structural. Microsoft is both a provider of the agentic AI environment and a provider of the governance used to oversee it. Independent governance requires an additional layer of oversight that does not depend on Microsoft, or any other platform provider, for its operation or evidence.
Governance for operational excellence and resilience
Microsoft provides strong operational governance for agents within its environment. This helps enterprises manage agent performance, security and control as deployments scale.
Independent governance adds resilience by ensuring that oversight does not depend entirely on the platforms being governed. It also gives the enterprise continuity of governance across a wider, multi-platform agent estate.
Data portability and sovereignty
Enterprises need control over governance evidence for audits, investigations, regulatory requirements and platform changes. Microsoft provides governance information across services including Purview, Defender, Agent 365 and Azure Cost Management, with capabilities to access and export that information.
Microsoft also provides extensive data residency and sovereign cloud capabilities. The Veqtor8 framework adds a separate requirement for governance evidence to remain under enterprise control and portable across platforms, rather than dependent on any one platform provider.
Reduced vendor concentration
Agentic AI brings models, data, identity, security, runtime and governance closer together. Microsoft can provide capabilities across all of them. For enterprises already heavily invested in Microsoft, this can simplify deployment and operation.
It can also increase dependency on a single technology and commercial ecosystem. Agent 365, Entra, Defender, Purview and Fabric can all form part of the same environment. Independent governance provides some separation from that environment, helping enterprises oversee concentration risk rather than making governance itself another source of it.
Implications for enterprises
Most enterprises running Microsoft agents have good reasons for using Microsoft’s governance capabilities. They provide agent inventory, identity, security and operational controls that organisations would otherwise have to build or source elsewhere.
The assessment also shows the limits of relying on platform-native governance alone. Microsoft can extend governance to third-party agents and environments, but that oversight is still provided through Microsoft’s governance stack. As agent estates spread across multiple platforms, enterprises also need oversight that is independent of any one platform provider.
Four practical steps follow.
Use platform governance for operational control and independent governance for enterprise oversight. Microsoft provides extensive controls across its own environment and can extend oversight to third-party agents. Independent governance provides a separate view across the wider estate.
Maintain accountability across platform boundaries. Enterprises need to follow agent identity, ownership, permissions and activity as agents interact with other platforms, tools and data sources.
Retain governance evidence continuously. Establish what information can be extracted from each platform, at what level of detail and with what delay.
Measure risk and value independently. Vendor evidence can provide useful reference points, but enterprises need to measure costs, outcomes and risks against their own business objectives.
The paradox remains
Microsoft’s governance capabilities are valuable, particularly for agent identity, ownership, security and operational control within its environment. Its support for third-party agents gives it a broader reach than a system limited to Microsoft-built agents.
The constraint sits at the boundary of the platform rather than in any shortfall of capability. The enterprises I speak to expect agents to operate across multiple platforms, models, data environments and workflows. No platform-native governance layer can, by itself, provide a complete and independent view of that estate.
As Microsoft’s agentic governance capabilities expand, enterprises may choose to place more agents, and more of the evidence used to oversee them, inside Microsoft. That may make operational sense, but the resulting increase in dependence on Microsoft needs to be understood and actively managed.
Agentic AI needs two layers of governance. Platform-native governance keeps each environment operating safely, while independent governance lets the enterprise decide for itself whether an agent earns its keep, its trust and its budget.
Andrew Milroy is the founder of Veqtor8, an independent technology advisory firm focused on AI, cybersecurity, cloud and data management.
This article reflects the author’s opinion and analysis based primarily on enterprise research and professional conversations, supported by publicly available product information and vendor briefings. It is not legal, regulatory or investment advice.
Comments