Microsoft Agent 365 Explained: AI Governance, Licensing and Model Routing Limits

The column is written for accounting firms, but it matters just as much to Windows and Microsoft 365 admins. It names Microsoft Agent 365 as one orchestration option. It calls Microsoft Copilot the safest place for client data. And it says two big deals, Stripe buying OpenRouter and SAP investing in n8n, have changed its recommendations. Some of those claims hold up well. Others need correcting before an IT department builds on them.

What the column argues​

The author and his colleague Brian Tankerley consult on AI strategy. His earlier framework described three levels of AI adoption:

1. LLMs for personal productivity: ChatGPT, Claude, Copilot and similar tools.
2. AI built into products: vendor software with AI features included.
3. Agents connected through MCP (Model Context Protocol): multi-step automation linked to tools and data.

The new column adds a fourth concern: the connections between those levels. In the author's design, an orchestrator holds the workflow logic. Routine or sensitive work goes to a local Ollama server running open-weight models. Tasks that need frontier reasoning, live web answers or a particular vendor go through an AI router to paid cloud models. The router offers one API and one bill, switches providers when one fails, and meters tokens.

He also covers build versus buy. Building your own agents can be a competitive advantage, but you maintain them forever. Buying agent bundles means paying for implementation plus monthly fees. The column names three bundles, Auras from 34Five.ai, TaxGPT CoWork and Netsurit, and expects more announcements after October 15.

Summary: The main point holds up. An AI setup has several layers, not one chatbot. Several product claims need checking.

Four layers that often get lumped together​

The column uses "orchestration" for quite a lot. It helps to split the stack apart, because vendors often sell products that cover one layer and describe them as covering all of them:

Products overlap across these layers, but the layers are different jobs. That difference is where the Microsoft part of the story needs the most correction.

Stripe and OpenRouter: what was actually announced​

The column says it has stopped recommending OpenRouter automatically after "Stripe's $8 billion purchase." What happened, according to the companies:

• Stripe announced on August 19, 2026 that it had agreed to acquire OpenRouter. Stripe described OpenRouter as a model gateway that routes token usage across more than 400 models from more than 80 providers.
• Stripe's announcement did not give a price. The $8 billion figure comes from media reports, not from either company.
• In its own post, OpenRouter said it processes more than 10 trillion tokens a day for over 10 million developers and companies. It said it would keep the same mission, name, product and roadmap, and that nothing about existing integrations would change. The deal was subject to customary closing conditions and was expected to close within weeks.

So the column's worry, that OpenRouter users now depend on "Stripe's charges and whims," is a reasonable concern about lock-in. It is not a report of anything Stripe has actually changed. The column also contradicts itself on catalog size: its text cites Bloomberg's figure of 400 models as of May, while its comparison table says 500+. Model counts change constantly, so treat any number as a snapshot.

OpenRouter's developer documentation describes one API endpoint for hundreds of models, with automatic fallbacks. Its code examples are drop-in compatible with the OpenAI SDK. That makes switching easy, but it does not decide privacy for you. One bill does not mean one data-handling policy. Each request still ends up at a specific provider, with its own retention, training and regional terms.

n8n and SAP: the figure doesn't match​

The column says n8n "took a significant $60M investment from SAP." n8n's own announcement from May 12, 2026 describes it differently. SAP made a strategic investment that valued n8n at $5.2 billion, and n8n would be built into SAP's Joule Studio. n8n reported 1.7 million monthly active builders and more than 1,400 enterprise customers. The $60 million figure does not appear in that announcement.

The column also says n8n "recently changed its pricing." No details, dates or links to the SAP deal were available to verify. Anyone who relies on n8n should check the current pricing page rather than assume.

Summary: Both deals happened. The dollar figures and consequences attached to them in the column don't match what the companies said.

Microsoft Agent 365 governs agents; it doesn't route models​

The column says Microsoft released Agent 365 as "its orchestration approach available in Microsoft E7 licensing." Microsoft's documentation describes it differently.

On Microsoft Learn, Agent 365 is a tool to observe, govern and secure an organization's agents. That covers a central agent registry in the Microsoft 365 admin center, access controls through Microsoft Entra, data protection and DLP through Microsoft Purview, and threat detection through Microsoft Defender. It went generally available for commercial customers on May 1, 2026, licensed per user. Microsoft says it works best with Microsoft E5, and at least one user needs a qualifying Agent 365 license to turn it on.

It is a control plane. It does not choose between GPT and Claude for a given prompt, and it is not a replacement for n8n.

E7 is also not the only way to get it. Agent 365 is bundled into E7 and is also available as a standalone license at $15 per user per month for organizations that want agent governance without the full E7 commitment. Microsoft 365 E7, branded the Frontier Suite, unifies four products into a single SKU: E5, Microsoft 365 Copilot, Agent 365 and the Entra Suite. General availability landed on May 1, 2026, at $99 per user per month.

Before an admin reaches for the corporate card, two caveats:

• The standalone price has prerequisites. Kesslernity reports that its own licensing FAQ sets prerequisites first: for enterprises, E5, or E3 plus the Defender and Purview suites.
• Licenses aren't the whole cost. SAMexpert notes that Microsoft offers per-agent cost estimators but no end-to-end total cost of ownership (TCO) model for the combined E7-plus-consumption stack.
• Current discounts: CSP promotional discounts are published: 10% off annual at 10 to 9,999 seats, 15% off annual at 100 to 9,999 seats, and 15% off triennial at 300 to 9,999 seats, all through 31 December 2026.

The column's comment about Azure fits better. Firms that want Microsoft's data residency and compliance terms often call their own Azure deployment directly from the orchestrator instead of going through a third-party router. Many Microsoft shops do exactly that.

"The safest" Copilot: true, with conditions​

The column calls Microsoft Copilot "the safest and least capable" AI product. It says you can safely process client documents there, which it says isn't true of the other $20/month products. Microsoft's documentation supports part of that. Microsoft says Copilot runs inside the Microsoft 365 service boundary and follows the same data protection, access control and compliance settings as the rest of Microsoft 365. Copilot can only summarize content the user is already allowed to see. Encrypted content requires EXTRACT and VIEW usage rights. Prompts, responses and referenced content can be audited and retained through Purview.

The catch is that "only what the user can access" also means "everything the user can access." If a firm's SharePoint has years of overshared folders, Copilot will surface them politely. Permission cleanup is what makes it safe. And these commitments apply to Microsoft's covered commercial service, not to every product with a Copilot badge or every third-party connector attached to it.

The local-model pattern: good idea, test it before you trust it​

The design of sending sensitive or high-volume routine work (classification, document summaries, embeddings) to a local Ollama box is sound. The column makes one point correctly: Ollama runs open-weight models locally and does not draw tokens from Claude or ChatGPT. It says that if you want local and cloud models behind one routing layer, a self-hosted gateway like LiteLLM can register Ollama as another endpoint. It says OpenRouter only routes to hosted providers.

Two caveats:

• Keeping inference local only keeps data local if logs, telemetry, backups, connectors and tool calls also stay local.
• The column's price of roughly $5,500 for a Dell or Lenovo AI server is its own estimate. Get current quotes for the configuration you actually need.

About that router table​

The column lists 15 routing products, from OpenRouter, Ramp Router and TrustedRouter to Portkey, LiteLLM, Cloudflare AI Gateway, Amazon Bedrock, Azure AI Foundry and Google Vertex AI. It includes prices and claims such as Ramp's reported average savings of about 40%. It says most organizations choose TrustedRouter or Factory AI, that Ramp launched Router on August 19, and that Meta is reportedly building a competitor called Switchboard. The author himself calls the table a snapshot and tells readers to do their own checks. Take that advice. Prices, fees and privacy terms in this market change almost weekly.

A practical checklist for Windows and M365 admins​

1. Sort your data first. Decide which data can go to a cloud model, which only to your own Azure tenant, and which must stay local.
2. Clean up permissions before rolling out Copilot. Review SharePoint and OneDrive sharing, apply sensitivity labels and set up DLP.
3. Price Agent 365 properly. Check the E5 or E3 prerequisites, then compare standalone at $15 with E7 at $99 against the licenses you already own.
4. Test routers against your requirements. Can you limit sensitive workloads to approved providers? What happens during fallback? What are the retention and processing-region terms?
5. Estimate costs with real workloads. Run representative tasks. Don't rely on savings percentages from marketing.
6. Assign an owner. Someone should monitor output quality, outages, token spend and vendor changes, including changes in who owns the vendor.

The bottom line​

The column is right that the connections between your AI tools matter as much as the tools themselves, and that relying on a single AI vendor is a risk. Its start-small advice also holds up: pay for one AI subscription, learn to write good prompts, and build a library of reusable ones. But three of its claims need correcting. Agent 365 governs agents; it doesn't route models. E7 is not the only way to buy it. And the n8n and OpenRouter dollar figures don't match what the companies announced. Check prices, deal figures and product descriptions against vendor documentation before building on them.