The short answer: inventory AI agents in Microsoft 365 in five days
You can list the AI agents in your Microsoft 365 tenant in five working days without buying anything. Ask the teams first, then check Copilot Studio, SharePoint and the Teams app catalog, record four fields per agent, and sort the list by what each agent can reach, not by how many there are.
- Days 1 and 2: ask people what they built
- Day 3: check the three places agents live
- Day 4: record four fields per agent
- Day 5: sort by reach
Ask your teams before you scan Microsoft 365
Start with people. Send a short message to the teams most likely to have built something, which is usually finance, operations, HR, and whoever runs your service desk. Ask what they have built, what it does, and who maintains it.
This feels less rigorous than scanning, and it is faster and more accurate at this stage. People who built something useful are generally pleased to talk about it. More importantly, they know the things a scan cannot tell you: whether the agent is still in use, whether the person who built it still works here, and whether it was ever meant to be shared as widely as it has been.
The interesting answers are not the agents people tell you about. They are the ones built by somebody who has since moved team or left, which nobody mentions because nobody owns them.
Where AI agents live: Copilot Studio, SharePoint and Teams
Three places hold most of what people mean when they say agent.
- Copilot Studio. This is where authored agents live, and it is the only population you can enumerate properly. For each one you can see its environment, its data connections, its knowledge sources, and its publishing state.
- SharePoint. Agents created directly on a site are a different shape. Any licensed user can create one, with no central request and no approval gate, so this population grows with your license rollout rather than after it.
- The Teams app catalog. Agents published to Teams surface here, and for some tenants this covers a useful share of what people actually mean when they ask the question.
Record four fields per AI agent, not fourteen
The fourth field, what content it sits on, is where the work is, and it is the one people skip. Access through an agent is inherited from whoever built it. Access to an agent is a sharing decision somebody made deliberately. They are different questions and only one of them tells you about exposure.
What it does
One sentence, in the maker's words.
Who built it
And whether they still work here.
How widely it is shared
A sharing decision someone made on purpose.
What content it sits on
The field where the work is, and the one people skip.
Sort AI agents by reach, not by count
The instinct is to count the list and report the number. The number is the least useful thing on the page. Sort instead by what each agent can reach, and the picture changes. A handful of agents sitting on finance, HR, or legal content will matter more than everything else combined.
Three groups is usually enough: agents on sensitive content, agents with no active owner, and everything else. If an agent falls into the first two groups at once, that is where you start.
What this will not tell you
Agents defined over Microsoft 365 content rather than authored in Copilot Studio do not enumerate neatly. Lightweight agents built through Agent Builder, and declarative agents generally, will not appear as a tidy list anywhere. The practical control for that population is the person who created them and the permissions on the content they sit on, which means your access review and your offboarding process are doing the governing, not your register.
If you later compare your list against a count from another tool, expect the totals to differ. They are built on different foundations and counting different things. Knowing why, before somebody puts both numbers on a slide, saves an awkward meeting.
Gartner expects the average Fortune 500 enterprise to be running more than 150,000 agents by 2028, up from fewer than 15 in 2025. A manual list is the right first move and the wrong permanent answer.
Keeping the AI agent inventory true is the real cost
Building the list takes a week. Keeping it true takes forever, and that is the real problem you have just discovered rather than solved. Agents are created faster than reviews happen, the people who build them move on, and a register that is three weeks stale is not a control.
So treat the week as a diagnostic rather than a deliverable. You will come out of it knowing what you are dealing with, which two or three things need fixing now, and whether the volume is something your team can keep up with by hand.
Rencore Governance keeps this list true after the week is over: every agent, its owner and what it can reach, scanned on a schedule.
Frequently asked questions
How long does it take to build an inventory of AI agents in Microsoft 365?
Where do AI agents live in a Microsoft 365 tenant?
What should an AI agent inventory record?
Why not just count the agents?
How do I keep the agent inventory up to date?
Where this fits in Rencore Governance
AI & Agents module
One inventory of every Copilot Studio agent and every site that holds SharePoint agents, with owner, reach and policy.
See the AI & Agents moduleCopilot and agent governance
Find agents without an owner, see what each one can reach and enforce policies on a schedule.
See Copilot governanceWhat is agent sprawl?
The plain-language definition, and why access matters more than the number of agents.
Read the definition