On 1 May 2026 Microsoft made Agent 365 generally available at $15.00 per user per month, paid yearly, and in doing so priced something a seat licence never covered: a registry, an identity, and an audit trail for software that acts on its own. The pricing detail that matters most is the unit. Agent 365 is licensed per human user, not per agent. Your fortieth agent is free. Your two hundred and first employee is $15 a month.
That inverts how most ops orgs are budgeting this. They are counting agents and negotiating seats. The bill scales with headcount, and the risk scales with agents — two different curves, and only one of them appears on the invoice.
This stack is built around a single rule: an agent that can write to a real system runs under an identity you issued and a spend cap you set. Everything below either enforces that rule or is honestly outside it.
The shape
- Microsoft Entra Agent ID is the identity plane, and it is the layer people skip. It issues agent identities from blueprints with parent-child relationships, so policy applies to a family of agents rather than one at a time, and it speaks OAuth 2.0, MCP, and A2A. Agents built outside Microsoft register through the Entra Auth SDK sidecar or workload identity federation — Microsoft names AWS Bedrock and n8n specifically. Agent ID is available to every Entra customer. The catch is one line in Microsoft’s own docs: extending Entra’s security features to agents — Conditional Access for agents, Identity Protection risk detection, identity governance — requires an Agent 365 licence. Identity without Agent 365 is a name badge, not a door lock.
- Agent 365 is the control plane. Three jobs: observe (agent registry, registry sync, Agent Map in the Microsoft 365 admin center), govern (lifecycle, access reviews), and secure (Entra for access, Purview for data, Defender for threats). It is included in Microsoft 365 E7 and sold as an add-on to E5, A5, or Business Premium, or to a Defender Suite plus Purview Suite combination. If you are not already an E5 shop, price the prerequisite before you price the add-on.
- n8n is the action layer, and it is the only component here that Microsoft lists as an agent factory. Agents built on n8n are automatically provisioned an Entra Agent ID, appear in the admin center, and inherit Agent 365 observability — no identity work of your own. n8n also holds the approval gate: the human yes-or-no that stands between a model’s decision and a write to your CRM. Read the gate on the partner list carefully, though. The n8n Agent 365 trigger node is early preview and requires enrolment in Microsoft’s Frontier program. Build on n8n today because it is the cheapest reliable action layer; do not build a compliance argument on an integration in preview.
- Glean is the retrieval layer, and it governs itself. It is not on the Agent 365 partner list, so its agents do not land in your Microsoft registry — which is exactly why its own controls matter. Glean’s agent access policies run at runtime in two places: pre-execution, inspecting the tool identity and input arguments before a call, and post-execution, inspecting the structured response payload after. Three actions: Block the call, Filter individual items out of a result array, or Flag for review and log it. Scope is by user group, by agent or agent folder, and by tool. That is a real policy engine, and it is the answer to “can this agent email a non-corporate domain” in a way a search product usually cannot answer at all.
- Claude or ChatGPT is the surface a human drives. This is the layer your employees will actually use, and the one your Microsoft control plane does not see. Neither appears in the Agent 365 partner list. Their controls live in their own admin consoles, and you configure them there or not at all.
Named handoffs
- Someone builds a workflow agent in n8n → Entra issues it an identity and Agent 365 registers it. No ticket, no manual provisioning. The agent is in the registry because it was born there.
- The agent requests a token → Conditional Access for agents evaluates it against the same policy engine that governs your humans. This is the step that requires the Agent 365 licence.
- The agent queries Glean → the access policy fires twice. Once on the tool call and its arguments, once on the payload coming back. Finance documents get filtered out of a result set the agent was otherwise entitled to fetch.
- The agent proposes a write → n8n holds it at the approval gate → Agent 365 logs the action and Purview keeps the record. The gate is yours; the log is Microsoft’s; neither is the model vendor’s.
- A human drives Claude or ChatGPT Work → the spend lands on that vendor’s meter, and the cap that stops it is set in Anthropic’s or OpenAI’s console. Agent 365 will not stop it, will not see it, and will not report it.
Handoff 5 is the honest gap in this stack. Do not paper over it — staff it.
The fork that decides the cost
The assistant layer is where seat pricing and usage pricing diverge, and the two vendors have picked opposite sides.
Claude Enterprise has been self-serve since 12 February 2026 and bills a fixed seat fee per user per month, annually, plus every token at standard API rates. Minimum 20 seats. Self-serve buys credits upfront that draw down; sales-assisted bills monthly in arrears. Anthropic publishes the model but not the seat number. What it does publish is the control: admins set spend caps at the organisation level and per individual user, with month-to-date spend per member and threshold alerts. It ships SSO, domain capture, SCIM, audit logs, a Compliance API, custom retention, and training opt-out by default.
ChatGPT Business bundles usage into the seat at $25.00 per user per month billed monthly, minimum two users, with a lower annual rate. Enterprise is quote-only and adds the Enterprise Compliance API — time-stamped conversations, uploaded files, workspace GPT configuration, memories — plus apps and connectors that are disabled by default on Enterprise and Edu. ChatGPT Work, the agent that takes a brief and returns a finished file, launched 9 July 2026.
The pick: if you cannot forecast usage, buy the bundled seat. A metered plan with an unset cap is how a pilot becomes a budget incident. If you can forecast usage and you want the spend visible per person, the metered plan is strictly more informative — but only if someone sets the caps in week one rather than after the first invoice. The general principle is in seat-based vs usage-based AI pricing.
Cost reality
A 200-person org already licensed on Microsoft 365 E5, running roughly 30 agents:
- Agent 365: $15 × 200 users = $36,000/year. Unchanged whether you run 5 agents or 50.
- ChatGPT Business: $25 × 200 = $60,000/year at the monthly rate, usage included.
- Claude Enterprise: quote-only seat fee × 200, plus an API-rate usage line you must forecast separately. Model the usage line first; it is the one that moves.
- n8n Pro: €50/month on annual billing for 10,000 executions — billed per full execution, not per step. Business is €667/month, with overage at €4,000 per additional 300,000-execution bucket.
- Glean: no price published on Glean’s own pricing page, which shows only a demo request. Third-party trackers report enterprise minimums in the tens of thousands per year; treat every figure you find as reported, not published, and get the quote before you design around it.
Roughly $96,000/year in published, defensible numbers plus two quote-only lines. The Glean quote is the one most likely to exceed everything above it combined.
Variations and when to swap
- Drop Glean when your knowledge already lives in Microsoft 365. If the answers are in SharePoint, Teams, and Outlook, you are paying twice for retrieval. Keep Glean when a real share of the corpus sits in systems Microsoft does not index well — Salesforce, Jira, a wiki, a data warehouse — and when you need read-and-write policy on agent tool calls that your CRM cannot express.
- Swap n8n for a Microsoft-native agent factory if your rollout depends on the Agent 365 integration being generally available rather than in Frontier preview. Kore and Kasisto are on the partner list as agent factories today. The rule: pick n8n for breadth and cost, pick the native path when procurement needs a GA integration on paper.
- Run Claude and ChatGPT side by side for one quarter, then cut one. Two assistant contracts is a defensible pilot and an indefensible steady state. Set the review date when you sign, not when the renewal arrives.
What this stack does not replace
- It is not an AI policy. It enforces decisions; it does not make them. Which agents may write to which system is a written rule first — see AI policy for RevOps teams.
- It is not a build platform for the agents themselves. A lean team building agents without an engineer wants the AI agent ops stack, which is a tenth of this price and has none of the governance.
- It does not govern shadow AI. Anything an employee opens in a personal browser tab is outside every layer here.
- It does not make agents accurate. Identity, logging, and caps constrain what a wrong answer can do. They do not reduce how often you get one.
Watch-outs, each with a guard
- Agent ID without Agent 365 gives you names, not enforcement. Conditional Access and Identity Protection for agents sit behind the licence. Guard: before announcing the identity layer as a control, confirm at least the licence prerequisite chain — E5, A5, Business Premium, or Defender plus Purview Suite.
- The n8n integration is early preview and Frontier-gated. A preview feature can change shape between your pilot and your rollout. Guard: write the compliance narrative against Agent 365’s GA capabilities only, and treat n8n’s registry presence as an accelerator you would still ship without.
- Your two most-used AI products are outside the Microsoft registry. Claude and ChatGPT are not on the partner list. Guard: configure their own audit exports — Anthropic’s Compliance API, OpenAI’s Enterprise Compliance API — and pull both into the same review as your Agent 365 logs. One review, three sources.
- Per-user pricing hides agent sprawl. Because the bill does not move when agents multiply, nothing bills you for the thirtieth redundant agent. Guard: review the Agent 365 registry monthly against an owner list, and retire anything with no named owner. Run the CRM agent access audit against whatever still holds write scope.
- A spend cap set to “unlimited” still bills. Anthropic’s docs are explicit that consumption is billed even when the limit is unlimited. Guard: set an organisation cap and per-user caps on day one, with threshold alerts to a channel a human reads.
Match rules
Right pick when: you are already on Microsoft 365 E5 or above, you have somewhere between 100 and 2,000 employees, agents are being built in more than one place, and someone — a CISO, an auditor, a board — is going to ask who authorised a specific write to a specific system. The stack earns its cost at the moment the answer stops being “I’d have to ask around.”
Wrong pick when: you are under about 50 people, where the E5 prerequisite alone outweighs the risk being managed and a named owner per agent does the same job for free. Also wrong when you run on Google Workspace rather than Microsoft — the control plane assumes an Entra tenant, and the Vertex AI registration path makes agents visible in the admin centre without giving you a reason to buy the rest of the estate. And wrong when you have no agents writing anywhere yet: govern the second agent, not the first.
If you can only do one thing: set the spend caps on your assistant plan. It takes ten minutes, it costs nothing, and it is the only control in this stack that stops a bad week from becoming a bad quarter.