Microsoft Automated Your Agent Count. Nobody Automated Your Coverage.

Microsoft made Agent 365 generally available on May 1, 2026 with a registry that discovers and inventories agents across the environment, which turns agent count into an automated product feature. Authorization coverage, the share of those agents carrying an authorization record, a named owner, an unexpired review date, and evidence of compliance review before deployment, remains manual work that no vendor is automating. On the Governance Readiness Matrix, high count against low coverage is the quadrant named Agent Sprawl, the condition where agent count outruns the organization's capacity to authorize.

Your agent registry produces the count on the left. Nothing on any roadmap produces the number on the right.

Sixty-three agents. The number came off the registry that morning, refreshed on its own, reaching into the two other clouds the company runs, and the governance committee had waited two years to see a figure it could put in front of a board without a footnote attached to it. Someone read it out loud twice. For about fifteen seconds the room had the feeling of having finished something.

Then the CISO asked how many of the sixty-three had a signed authorization record, a named owner, and a review date that had not lapsed.

Nobody answered. The head of platform engineering said the intake process covers everything deployed since March, which was true, and which was an answer to a question no one in the room had asked.

What had happened underneath that meeting started in the spring. Microsoft announced general availability of Agent 365 on May 1, 2026 , with a registry built to discover, inventory, and govern agents across the environment. Registry sync to platforms outside Microsoft shipped in that same release as a public preview, covering Amazon Bedrock and Google Vertex AI, and picked up Salesforce Agentforce and Databricks Genie on May 20, 2026. It is a preview still, as of July 28, 2026, through a connection an administrator has to run by hand. Inside the Microsoft estate the count refreshes without being asked. Whatever else the May release did for Microsoft, it retired a question that had consumed governance committees for two years. How many do we have. The answer is now a product feature, and it is more honest than any spreadsheet a working group ever kept, because it was never asked to flatter anyone.

The second number moved nowhere. ISACA's 2026 AI Pulse Poll , published May 5, 2026 from more than 3,400 digital trust professionals, found 90 percent believe employees are using AI in their organization, while 38 percent report having a formal, comprehensive AI policy. Read that 38 carefully. It counts the existence of a document. A policy is a commitment. Coverage is a ratio. Grant Thornton's 2026 AI Impact Survey , fielded February 23 through March 18, 2026 across 950 business leaders, puts it closer to the bone. Nearly three in four organizations are giving agentic AI access to their data and processes, and 20 percent have a tested AI incident response plan for when it fails. The dashboards in these companies refresh every few seconds. The governance artifacts sit wherever the pilot team left them, in a folder last opened when the pilot was still called a pilot, by someone who has since moved to a different business unit and has no idea the folder is load-bearing.

That committee spent two years making the first number trustworthy. Two years of the only governance capacity the company had, spent producing a figure a vendor was always going to hand them for free in a May release. Nobody spent a week on the second number. Tooling can store an authorization record and route it for review. It cannot decide the agent should exist, and it cannot name the person who answers for it when it does not.

The count had a vendor building it. The coverage had nobody, for the same two years.

She ran the matrix the following Tuesday and it took a little over an hour. Two axes. Agent count, which the registry hands you now. Authorization coverage, the share of those agents carrying all four artifacts: an authorization record, a named owner who knows they own it, a review date that has not passed, and evidence of compliance review conducted before deployment. Fifteen minutes to settle the count. Then the artifacts, which is the part nothing has made easier, and which stalled twice on whether a Teams thread from March counted as compliance review. Fifteen to divide. Fifteen to find the ungoverned agent with the deepest access and put a remediation date beside it, because that is where the work starts. Eleven over sixty-three. Seventeen percent. High count, low coverage, and that quadrant has a name on the Governance Readiness Matrix , which is Agent Sprawl, because sprawl was never really about the count. It is the specific condition where the count outruns the organization's capacity to authorize.

Twenty-six years of watching enterprises count things is enough to know what visibility does on its second pass, and it is not in anyone's launch blog. Before the registry, a company could plausibly not know its agent population, and the finding landed on the inventory gap, which is survivable. The registry ends that. The count is timestamped and sitting in your own admin center, which means the organization demonstrably knew it had sixty-three agents on the morning an examiner asks why eleven of them have authorization records.

Not knowing used to be the finding. Knowing, and having done nothing with the knowledge, is the worse one.

One line down, same font, and the entire governance question sits in whether the second line makes the deck.

The seventeen went on the same slide as the sixty-three, in the same font, one line down. She has not decided whether to bring both figures into the November board meeting or only the one that took two years to earn. The registry will keep producing the first number either way. It has no opinion about the second.

The scenario in this edition is constructed and does not describe any specific organization.

Sources. ISACA 2026 AI Pulse Poll , May 5, 2026. Grant Thornton 2026 AI Impact Survey , 950 business leaders, February 23 to March 18, 2026. Microsoft Security Blog, "Microsoft Agent 365, now generally available, expands capabilities and integrations" , May 1, 2026. Microsoft Learn, "Registry sync in the Microsoft 365 agent registry (preview)" , updated May 21, 2026.

The full framework, including the unit of count, tiered coverage thresholds, and the four quadrants with next actions, is at sougataroy.com/frameworks/governance-readiness-matrix.