Agent 365 Identities
Manage every agent's Entra identity and Exchange mailbox access state from a single governance table. Provision new identities, grant or revoke Exchange RBAC access for every mailbox an agent needs, and track each agent's provisioning status in real time.
Overview
The Agent 365 Identities page (/governance/agent-365/identities) is the permanent governance surface for Agent 365 in your tenant. It replaces the one-shot Identity Backfill page, which now redirects here.
Every agent in your tenant appears in one table with columns for:
| Column | What it shows |
|---|---|
| Agent | Agent name and type |
| Type | Agent type (Personal Assistant, AI COS, Standard, SME) |
| Mailboxes | Stacked list of the mailboxes this agent uses, with a kind badge and per-mailbox Exchange-access status for each |
| Entra Identity | Whether an Entra agent identity has been provisioned |
| Exchange Access | Rolled-up Exchange RBAC status across all of the agent's mailboxes |
Actions return immediately with a job reference and the affected row enters a pending state; the row updates automatically when the server-side operation settles.
Prerequisites
- The Agent 365 Enablement ceremony must be complete for your tenant before identities can be provisioned or Exchange access can be granted.
- You must be signed in as an Outermind system administrator with the Settings permission.
Reaching the Page
Navigate to Governance > Configuration > Microsoft Entra Agents in the admin console sidebar, or go directly to /governance/agent-365/identities.
Note: The old
/governance/agent-365/backfillURL redirects here automatically.
Blueprint Consent Banner
If any agent type's blueprint has not been through the consent ceremony, a banner appears at the top of the page with a link to the Agent 365 Enablement page. Agents of that type cannot be provisioned until consent is granted.
Provisioning Entra Identities
Agents that lack an active Entra identity show Not provisioned in the Entra Identity column.
Provision a single agent
- Click the ... overflow menu on the agent's row.
- Select Provision identity.
- The row shows a spinner while provisioning runs.
- When provisioning completes, the Entra Identity column updates to reflect the new status.
Provision all agents at once
Click Provision all in the page header to provision every agent that does not yet have an active identity. A confirmation dialog appears before provisioning begins. Each row enters a pending state independently; agents that are already provisioned are not affected.
Managing Exchange Mailbox Access
Exchange access controls whether an agent can read and send mail under its own Agent 365 identity. This leg uses Exchange Online RBAC grants and is handled separately from Entra identity provisioning.
An agent may need access to more than one mailbox. Personal Assistants and AI COS agents each use two mailboxes - their own shared mailbox and their supervisor's mailbox. The Mailboxes column shows all mailboxes in a stacked list with a kind badge (own or supervisor) and a per-mailbox access indicator. The Exchange Access column shows a rolled-up status across all mailboxes for quick scanning.
Grant mailbox access
To grant Exchange access to all of an eligible agent's mailboxes:
- Click the ... overflow menu on the agent's row.
- Select Grant mailbox access.
- Each mailbox line in the row shows a spinner while its RBAC grant is applied.
- Each mailbox line updates independently to its settled status as SignalR updates arrive.
- The rolled-up Exchange Access column reflects the combined result.
Exchange access can only be granted to agents that are Exchange-eligible (Personal Assistants, AI COS agents, and standard agents with a monitored mailbox). SME agents and agents without a target mailbox show - in the Exchange Access column and cannot be granted access.
Revoke mailbox access
To remove Exchange access from an agent whose Exchange Access column shows Granted:
- Click the ... overflow menu on the agent's row.
- Select Revoke mailbox access.
- The row enters a pending state while the grant is removed.
- The Exchange Access column updates to Not granted when complete.
Revoking access does not affect the agent's Entra identity or any in-flight tasks.
Retry all Exchange grants
Click Retry all Exchange grants in the page header to re-attempt the Exchange RBAC grant for every eligible agent that does not currently have access granted. This is useful after recovering from a tenant-side permission issue or a transient Exchange Online error.
Status Indicators
Entra Identity status
| Status | Meaning |
|---|---|
| Active | Identity is fully provisioned and ready. |
| Identity created | The Entra identity was created; Agent 365 registry-card registration is still in progress. |
| Error | Provisioning failed. An error message appears below the agent name. Click Provision identity to retry. |
| Not provisioned | No identity exists yet. |
Scope drift badge
An amber Scope drift badge can appear alongside the Entra Identity pill for an active agent. It means the Graph scopes that were actually granted to the agent's Entra identity no longer match the scopes declared in the agent's spec (permissionProfile.m365.graphScopes). This typically happens after the spec is updated to a narrower or broader scope set without re-provisioning the agent.
The badge is informational and recoverable - the agent continues to operate, but it may hold more or fewer Graph permissions than its spec requires. Use Reconcile scopes from the overflow menu to re-apply the spec's scope subset.
Reconciling Graph Scope Drift
When an agent shows the Scope drift badge:
- Click the ... overflow menu on the agent's row.
- Select Reconcile scopes.
- The row enters a pending state while the reconcile runs server-side.
- When the reconcile completes, the Scope drift badge disappears and the row reflects the updated grant state via a live SignalR push.
Per-mailbox Exchange access status
Each mailbox line in the Mailboxes column shows one of these icons:
| Icon | Meaning |
|---|---|
| Green check | Access granted for this mailbox. |
| Red X | Grant attempt failed for this mailbox. |
| Clock | Grant is pending or has not been attempted yet. |
| Spinner | A grant operation is in flight for this mailbox. |
| - | Not applicable (e.g., SME agents or agent types without a target mailbox). |
Exchange Access status (rolled-up)
The Exchange Access column summarises across all mailboxes for an agent:
| Status | Meaning |
|---|---|
| Granted | Every mailbox the agent needs has an Exchange RBAC grant in place. |
| Not granted | One or more eligible mailboxes do not yet have a grant. |
| Error | At least one grant attempt failed. Use Grant mailbox access from the ... menu to retry. |
| - | The agent type is not eligible for an Exchange RBAC grant (e.g., SME agents). |
Live Updates
The page receives real-time updates via SignalR. When a grant, revoke, or provisioning operation completes on the server, the affected row updates automatically without a page refresh. If you suspect a row is stuck in a pending state after an extended period, click Refresh (if visible) to reload all rows and clear any stale spinner.
Agent 365 Not Enabled
If Agent 365 has not been enabled for your tenant, the page shows an Agent 365 is not enabled notice instead of the identities table. Go to Settings - Microsoft 365 and complete the Agent 365 Enablement ceremony first.
FAQ
What is the difference between this page and the Identity Backfill page?
The old Identity Backfill page was a one-shot tool for provisioning agents that existed before Agent 365 was enabled. This page covers the same provisioning capability and adds Exchange RBAC management, per-mailbox access status, bulk actions, and real-time row updates. The backfill URL redirects here.
Why does a Personal Assistant or AI COS agent show two mailbox lines?
These agent types need Exchange access to two mailboxes: their own shared mailbox and their supervisor's mailbox. The Mailboxes column shows both lines with a kind badge (own or supervisor) and an independent status indicator for each. The Grant mailbox access action covers both mailboxes in a single operation; each line updates as its grant settles.
Do I need to provision identities AND grant Exchange access separately?
Yes. Provisioning creates the Entra agent identity; granting Exchange access is a separate Exchange Online RBAC step that allows the agent to read and send mail. Both steps are required for full Agent 365 mail operation. You can use Provision all followed by Retry all Exchange grants to complete both steps in bulk.
Why does an agent show "unsupported" or "-" for Exchange Access?
Some agent types (such as SME agents) do not have a target mailbox and cannot hold an Exchange RBAC grant. These agents are not Exchange-eligible and do not need the Exchange access step.
A row has been spinning for a long time - what should I do?
Exchange operations are asynchronous and typically complete within a minute. If a row remains in a pending state for several minutes, the SignalR update event may have been lost during a network interruption. Refresh the page to reload all rows and clear stale spinners, then check the current status.
Can I revoke Exchange access without removing the agent's Entra identity?
Yes. Revoking Exchange access only removes the Exchange RBAC grant. The Entra identity remains active and the agent can continue other operations that do not require direct mailbox access.
What does the "Scope drift" badge mean, and is it urgent?
The badge means the Graph permissions granted to the agent's Entra identity no longer match what the agent's spec declares. The agent continues to function but may hold more or fewer Graph permissions than intended. It is not an emergency, but you should reconcile the agent's scopes at your earliest opportunity to restore least-privilege compliance. Select Reconcile scopes from the agent's ... menu.
Why would scope drift occur?
Scope drift is detected by the nightly orphan/repair sweep and flagged whenever the granted Graph scope set differs from the spec's permissionProfile.m365.graphScopes. Common causes include an admin updating an agent's spec after initial provisioning, or a bulk provisioning run that applied a different scope envelope than the one now declared in the spec.
Does "Reconcile scopes" affect Exchange mailbox access or the Entra identity itself?
No. Reconciling scopes only updates the Graph permissions on the existing Entra identity. Exchange RBAC grants and the Entra identity registration are not modified.