Agent Sprawl Is the New Site Sprawl — And Your Inventory Is Lying to You

One IT department expected to find 50 agents in their tenant. They found over 500. Welcome to agent sprawl — the SharePoint site sprawl story, just faster, more autonomous, and with a billing model nobody fully understands yet.

In Episode 27 of Guardians of M365 Governance, Christian Buckley and I sat down with Timothy Boettcher (SVP Go-to-Market & Global Product Marketing at AvePoint, and fellow MVP) to talk about what governance actually looks like when agents start creating other agents.

500 Agents, One Default Environment, Zero Visibility

The shocking part isn’t the number. It’s how it happens: anyone can spin up an agent in minutes. Most start as experiments. Few get cleaned up.

I see this in my own demo tenant. Six Power Platform environments. Around 140 agents. When I checked the official Agent 365 inventory, it returned roughly five. Five.

I opened a Microsoft ticket. The answer: by design, the inventory only reads the default environment. Anyone running dev, staging, integration, and production — which is everyone — is flying blind.

Agent 365 vs. Agent Pulse: The Gap Nobody Talks About

Agent 365 gives you basic discovery — default environment only. Incomplete the moment your customer has more than one environment or tenant.

AvePoint Agent Pulse, GA since April 2026, takes a different angle. It pulls agents from Copilot Studio, Azure AI Foundry, and Microsoft frontier agents — across multiple tenants and, with the new release, across Google Vertex too.

The headline isn’t “more agents in the list.” It’s that you finally see published and unpublished agents, get 180-day activity reporting (not just 30), and identify your most active creators. Discovery is the prerequisite for everything else.

The DSPM Coverage Problem

Here’s where I pushed Timothy: Microsoft DSPM in Purview works well only if you have high label saturation. Most of my customers don’t. Not even close.

The realistic governance stack today is layered:

• Agent 365 — basic inventory, default environment only
• Purview DSPM for AI — sensitivity scoring, depends on labels existing
• Agent Pulse — multi-environment, multi-tenant, multi-cloud discovery plus AvePoint scoring on top of Microsoft DSPM

Not “either/or.” Layered. And that only matters if your customer can afford it — which brings us to E7.

The E7 Reality Check

Microsoft now bundles Agent 365 inside the E7 suite at $50 per user per month. Timothy’s customers may see real savings versus E5 plus Copilot plus Agent 365 plus Entra. Mine? I currently have zero customers willing to pay $50 per user per month. That’s not a dig at Microsoft — it’s a market signal. And exactly the gap where ISVs like AvePoint earn their seat.

Build the Quality Gate Before You Build the Agent

In the Agent 365 admin center, approving and publishing an agent is essentially one click. A trained monkey can do it.

What’s missing in most rollouts is a supervisory board — a quality gate that reviews:

• Business value and use case
• Monthly cost (pay-as-you-go agents add up fast)
• Data access scope (read, write, archive, delete)
• Compliance and sensitivity exposure

We need agent classification, not just data classification. Same logic as document labeling — applied to agents.

Operationalize Governance, Don’t Centralize It

Timothy made one point I’ll keep stealing: governance has to be a team sport. Top-down IT review every six months doesn’t scale. Empower the citizen developer who built the agent to own its lifecycle — including the “do you still need this?” check-in. Tools like AvePoint MyHub plug in there: notifications inside Teams, not yet another email. Same playbook we’ve used for SharePoint sites and Power Automate flows for years. Now applied to agents.

Discovery is step one of the 12-step program. Agent sprawl is real, default-environment inventories are insufficient, and the quality gate is still optional in too many tenants. Fix that order — then talk about scale.

PS: Are you ready to implement solid governance for AI Agents? Contact me, Ragnar Heil, for advice on Agent 365, SharePoint Advanced Management, Microsoft Purview, 3rd Party Governance Tools like AvePoint or adoption strategies tailored to your organization. You can find my calendar here on our HanseVision Governance Landing Page.