Microsoft Agent 365 exists to give organizations a control plane for the agents now spreading across their tenant — and governance is the whole point. But you can’t govern what you can’t see, and admins had exactly one way to see their agents: clicking through the admin center, one screen at a time. The Agent Registry Graph API (Preview) changes that — it exposes the agent inventory programmatically so security and compliance teams can automate the governance workflows they already run. This is the step-by-step PowerShell version.
Programmatic access to the Agent Registry
Agent inventory data is available programmatically through the Microsoft Graph API — enabling automated governance at scale.
Integrate the following tasks into existing workflows across agents:
GET /beta/copilot/admin/catalog/packages
GET /beta/copilot/admin/catalog/packages/{id}
The governance problem this solves
The requests came in a familiar order — and every one of them was a governance question. First it was visibility: “How many agents actually exist in my tenant?” A security team can’t attest to what it can’t enumerate. Then it was duplication: three departments had each built an “HR helper,” and nobody knew until the licensing review. Then lifecycle and compliance: governance wanted a recurring export of every agent, its publisher, and when it last changed — dropped into SharePoint or a ticket, not screenshotted from a portal.
A UI is fine for one lookup. It falls apart at governance scale. What these teams were really asking for was an API they could script so they could automate bulk agent management, streamline onboarding, and fold agent oversight into existing workflows. That’s exactly what the Agent 365 Agent Registry delivers. Microsoft documents the two governance entry points on the Graph API for agent registry and agent details page, and they cover the vast majority of what people asked for.
Prerequisites & access required
Before the first command, make sure the boxes below are ticked. Most “it doesn’t work” moments trace back to a missing license or role, not the code.
| Requirement | What you need |
|---|---|
| License | A Microsoft Agent 365 license — access to the Package Management API depends on it. |
| Role | Sign in as an AI administrator or Global administrator. |
| Graph permission | CopilotPackages.Read.All (delegated). Consented on first interactive sign-in. |
| PowerShell module | Microsoft.Graph.Authentication (PowerShell 7+ recommended). |
| Cloud | Global (commercial) cloud. Gov and 21Vianet clouds aren’t supported in preview. |
403 from the API — the portal ships with Microsoft 365 Copilot admin, but the Agent 365 Graph APIs require a Microsoft Agent 365 license on the tenant. Admin role alone is not enough.
Step-by-step in the PowerShell terminal
Open a PowerShell 7 terminal and paste these one block at a time. Each step is deliberately small so you can see the result before moving on.
Step 1 — Install the Graph auth module (one time)
Skip this if you already have it. It’s the only dependency.
Install-Module Microsoft.Graph.Authentication -Scope CurrentUserStep 2 — Sign in as your admin user
A browser window opens for interactive sign-in. Approve the CopilotPackages.Read.All consent the first time. See Connect-MgGraph for all sign-in options.
Connect-MgGraph -Scopes "CopilotPackages.Read.All"-UseDeviceCode and follow the code prompt instead.
Step 3 — Get all agents in your inventory
This is the List Copilot packages API. The supportedHosts eq 'Copilot' filter narrows the package catalog down to agents. Drop the filter to list every package.
$uri = "https://graph.microsoft.com/beta/copilot/admin/catalog/packages?`$filter=supportedHosts/any(h:h eq 'Copilot')"
$agents = (Invoke-MgGraphRequest -Method GET -Uri $uri).value
$agents | Select-Object id, displayName, publisher, platform | Format-Table -AutoSize$filter (`$filter) stops PowerShell from treating it as a variable — it’s a literal OData query parameter that Graph expects.
Step 4 — Get details of a particular agent
This is the Get Copilot package details API. Grab an id from the table above and pull the full metadata — long description, categories, sensitivity, who it’s deployed to, and its underlying elements — exactly the fields an attestation review needs.
$id = "PASTE_AN_ID_FROM_STEP_3"
Invoke-MgGraphRequest -Method GET -Uri "https://graph.microsoft.com/beta/copilot/admin/catalog/packages/$id" |
ConvertTo-Json -Depth 10Step 5 — Export the inventory for governance (optional)
This is the line compliance actually wanted: a flat CSV they can drop into SharePoint or attach to an attestation ticket.
$agents | Select-Object id, displayName, publisher, platform, lastModifiedDateTime |
Export-Csv ./agent-inventory.csv -NoTypeInformation -Encoding UTF8Step 6 — Sign out when you’re done
Disconnect-MgGraphWiring it into Agent 365 governance
The two calls are the raw material; governance is what you build with them. A few patterns that map directly onto Agent 365 oversight responsibilities:
- Attestation reviews — on a schedule, list every agent, join it to owner and publisher, and route each one to its owner to confirm it’s still needed and correctly configured.
- Deduplication — group agents by
displayNameandpublisherto surface the three “HR helpers” before the next licensing review, and consolidate. - Lifecycle tracking — watch
lastModifiedDateTimeto flag stale or abandoned agents for retirement, and new arrivals for onboarding checks. - Compliance reporting — export the inventory to SharePoint, Dataverse, or a ticketing system so oversight lives where your auditors already look.
The takeaway
Two Graph calls turn a manual, screen-by-screen chore into a governance capability. List gives security the enumeration it needs to attest; details gives compliance the depth it needs to review. Wrap them in a scheduled export and you’ve answered the original Agent 365 governance ask — visibility, deduplication, and lifecycle oversight — without anyone touching the admin center. Start with the interactive steps to build confidence, then graduate the same logic to app-only auth when you’re ready to automate.