Agent 365 CLI Setup No Longer Needs a Custom App Registration

Agent 365 keeps improving, and a recent update to the Agent 365 CLI is another step in the right direction. It removes the most tedious part of connecting a new agent to Agent 365, and it keeps every security control you already rely on exactly where it was.

Agent 365 gives your agents the same governance your users already have

Agents (AI that takes actions on someone's behalf, beyond answering questions) are showing up in most tenants now, from Copilot agents people build in a few minutes to custom agents developers build on whatever model fits the job. Agent 365 is Microsoft's control plane for all of them. Each agent gets its own identity in Microsoft Entra, shows up in one inventory, and falls under the same tools you already use for people: Conditional Access for sign-in, Purview for data protection, and Defender for watching what it does. That applies to agents built on Microsoft's stack as well as agents built elsewhere. The benefit is that you can manage and monitor agents 24x7 the same way you manage your users. I walked through the architecture in an earlier post if you want the full picture.

The CLI is how a new agent gets connected to Agent 365

Once a developer has built an agent, something has to register it with Agent 365. That's the job of the Agent 365 CLI, a command-line tool called a365 that runs on Windows, macOS, and Linux. It registers the agent's identity blueprint in Entra (the template each running copy of the agent gets its identity from), creates the agent identity from that blueprint, configures the permissions the agent needs, and handles deployment to Azure. The idea is that the developer runs a handful of commands and the agent comes out the other end with an identity your security team can see and govern.

To do that work in your tenant, the CLI signs in to Entra on behalf of the person running it, and that sign-in is what this update changes.

Microsoft now manages the app the CLI signs in with

Until now, the CLI signed in through an app registration you created and maintained yourself. Setting it up meant registering an app in Entra, adding three redirect URIs, adding seven delegated Microsoft Graph permissions, getting admin consent from an Application Administrator or Global Administrator, and adding an optional token claim so the CLI could see your admin roles. Four of those permissions were beta and often didn't appear in the Entra portal, so they had to be granted through Graph Explorer, and clicking the portal's own admin consent button afterward quietly removed them. As the CLI added capabilities, the app needed new permissions to keep up.

Microsoft now provides a managed enterprise application named Agent 365 CLI in eligible tenants, and new setups use it by default. Microsoft keeps it registered, permissioned, and current as the CLI evolves, so developers go straight to setting up their agent. Existing setups that use your own app keep working as they are. The benefit is a faster path from a finished agent to a governed agent, and one less app registration for your identity team to own. In short, it means less troubleshooting and issues getting your agents out there.

Your security controls still apply

For security teams, the important detail is that the managed app uses delegated access, so the CLI can only do what the signed-in person is already allowed to do. It doesn't give anyone extra privileges or bypass Conditional Access or Security Defaults, and agent resources still require their own consent. The CLI confirms that Microsoft's app is present and carries the right permissions without modifying it. The benefit is that approving it is an easy conversation: your identity controls work exactly the way they did before, with less setup around them.

Let AI run the setup

Right alongside this update, Microsoft's documentation now says you don't need to install or run the CLI by hand at all. Agent 365 Skills plug into a coding assistant (GitHub Copilot CLI, VS Code agent mode, or Claude Code), and you describe the outcome you want, like "register this agent with Agent 365" or "add observability to this agent." The skill installs the CLI, checks your prerequisites, runs the steps in the right order, and confirms the project still builds. The skills are additive and aware of what's already done, so rerunning one skips completed work instead of repeating it.

I love using AI to be better at AI. It's the whole point, and here Microsoft is using it to make its own governance platform easier to adopt. The benefit is that a developer who has never touched the CLI can connect an agent to Agent 365 by describing what they want, with the order of operations handled for them.

What I'd do this week (from Microsoft’s documentation)

• Update the CLI. Run dotnet tool update --global Microsoft.Agents.A365.DevTools.Cli. The simplified setup needs the latest version, and older versions can fail to sign in with the managed app.

• Confirm the app is in your tenant. In the Entra admin center, go to Enterprise applications and search for the application ID f54280f4-395e-4ea8-9e48-bf2d4952aa14. The rollout is staged, and until it reaches your tenant, setup uses a tenant-owned app named Agent 365 CLI.

• Plan for sign-in on Mac, Linux, and WSL. On native Windows the CLI signs in through Web Account Manager. On macOS, Linux, and Windows Subsystem for Linux (wsl) it uses device code sign-in, which some Conditional Access policies block. Run setup from native Windows, or have your identity team set up a tenant-owned app with a sign-in flow your policy allows, and keep the policy as it is.

• Line up licensing for observability. Registering an agent's identity needs no additional license. Seeing its activity in Defender, Purview, and the Microsoft 365 admin center needs at least one user in the tenant with a Microsoft 365 E7 or Agent 365 license assigned.

• Try the skills. Install them with gh skill add microsoft/agent365-skills, open your agent project in your coding assistant, and ask it to "set up this project for Agent 365."

If your developers are building agents right now, this is a good time to connect them to Agent 365 from the start, while the setup is this light.