Microsoft has put a governance layer in front of MCP servers. Microsoft Agent 365 integration with Azure API Management entered public preview on October 8, and it connects the Agent 365 control plane in the Microsoft 365 admin center with runtime policy enforcement in Azure API Management (APIM). In plain terms: the compliance people get one inventory and one set of switches, and the network people get a gateway that actually stops traffic.
The split of responsibilities is the interesting part. Agent 365 owns governance intent: it discovers APIM gateways and their MCP servers across the tenant, builds a centralized inventory, and records access decisions. APIM owns enforcement: policies run inline on traffic to MCP servers and tools. Neither product pretends to do the other’s job.
What you get at each tier
The feature set depends on your APIM tier, and the gap between them is wide. On v2 tiers you get centralized MCP inventory and server-level block or unblock. That is coarse: if a third-party MCP server exposes ten tools and one is risky, your options are all or nothing.
The AI Gateway tier, itself in preview, adds the granular controls. Per-tool blocking without disabling the whole server, tool activity observability, and tool threat protection. The threat protection policy uses Microsoft Defender and Microsoft Purview to evaluate tool requests and results for things like prompt injection and sensitive data exposure, and it can run before invocation, after invocation, or both. Pre-invocation blocking stops a malicious tool call from ever leaving the gateway; post-invocation withholding stops the result from reaching the agent.
There is a catch worth stating plainly: the tier that has the per-tool controls is itself a preview product, available only in East US 2 and Sweden Central, best effort, no SLA, pricing unannounced. This is governance on paper until that tier reaches general availability.
How the wiring works
Setup is a one-time, tenant-level act. A Global Administrator signs into the Microsoft 365 admin center, goes to Agents, Settings, Gateways, and flips on the APIM integration. That single consent covers all MCP servers in the connected gateway, including servers registered later. Microsoft documents that the consent grants the Agent 365 service identity an “A365 MCP Gateway Policy Operator” role at tenant level to read APIM resources and write API-scoped policies; individual Agent 365 admins need no separate Azure permissions afterward.
That last point is a footgun hiding inside a convenience. Change control for a tenant-wide consent that automatically covers future gateway registrations is not optional. A team that registers a new MCP server next quarter inherits a governance posture nobody on that team ever approved. If you run this integration, put gateway registration into your change process explicitly.
Also worth knowing: agents do not route through the gateway automatically. Agent developers must configure their agents to call the gateway MCP endpoint, and Microsoft recommends restricting MCP server connectivity so the gateway is the only permitted caller. The integration governs what tools are visible and permitted; it does not rewrite your network topology for you.
The limits, on the record
Per Microsoft Learn, APIM v1 tiers are not supported at all. v2 tiers do not support tool-level access control or tool threat protection, only the server-level switches. Tool-level governance is unavailable for MCP servers with dynamic allowed tool lists, which rules out servers that reshape their tool surface at runtime. Third-party analysis adds that the Agent 365 decision plane does not carry the user’s identity to downstream MCP servers, so per-user authorization on the backend is still your job in gateway policy. External MCP servers fronted by APIM need to conform to MCP version 2025-06-18 or later with Streamable HTTP or SSE transport.
Context: what Agent 365 is
Agent 365 was announced at Ignite in November 2025 as Microsoft’s control plane for AI agents: an agent registry, access control, visualization, interoperability and security in one place. It reached general availability for commercial customers on May 1, 2026, licensed per user at $15 user/month on an annual commitment, and it is included with Microsoft 365 E7. The APIM integration extends it from “we know about your agents” to “we can act on what your agents touch”, which is the part most enterprises were missing.
What to do with this
If you publish MCP servers through APIM today, three practical moves. Move to a v2 tier if you have not, because v1 gets nothing here. Give every MCP server a static allowed-tools list so tool-level governance can apply at all, dynamic lists are ungovernable by design. And when you want per-tool blocking, pilot the AI Gateway tier in a non-production tenant: grant the consent, confirm discovered servers appear in the Agent 365 tool inventory, and verify that blocking a server actually stops agent calls before you trust it in production.
The pattern here is bigger than one integration. Agent sprawl is the new shadow IT, and every major cloud vendor is now racing to sell the broom closet. Microsoft’s approach, intent in the admin center and enforcement at the gateway, is a sensible architecture. Whether it is deployable depends almost entirely on when the AI Gateway tier exits preview.