Arcjet vs Microsoft Agent 365

Arcjet vs Microsoft Agent 365

Microsoft Agent 365 is a control plane that extends Microsoft Defender, Microsoft Entra, and Microsoft Purview to AI agents, with most of its controls built around Microsoft 365 Copilot, Copilot Studio, Microsoft Foundry, and agents registered with Microsoft Entra Agent ID. Arcjet is an AI agent runtime security platform that enforces policy in the path of each action: in your code for custom agents, and in the hooks of Claude Code, GitHub Copilot, Cursor, and OpenAI Codex, with no proxy or endpoint agent.

The key difference is coverage. Arcjet doesn't enforce inside Copilot Studio or Microsoft 365 Copilot, and Agent 365 doesn't evaluate policies that you write over specific commands, paths, or destinations. An organization that runs both Microsoft and non-Microsoft agents gets the most coverage by keeping Agent 365 for Microsoft agents and adding Arcjet for custom agents and non-Microsoft coding agents. Choose Arcjet when you need your own policies, decided before a tool call runs, without a $15 per-user Agent 365 license on a Microsoft 365 E5 base.

Arcjet publishes this comparison. Competitor details come from Microsoft's public documentation, reviewed on September 25, 2026. Several of the capabilities described here are in public preview, and products change, so check the linked sources before you decide.

Arcjet vs Microsoft Agent 365 at a glance

The following table compares Microsoft Agent 365 and Arcjet across 11 areas, from the agents each covers to how each is licensed.

What is Microsoft Agent 365?

Microsoft Agent 365 is Microsoft's control plane to observe, govern, and secure AI agents, with an agent registry, access control, agent mapping, and security enforcement. Agent 365 became generally available on May 1, 2026. The launch post lists coverage for Microsoft 365 Copilot and Teams agents, Copilot Studio and Microsoft Foundry agents, third-party SaaS agents, cloud agents on AWS Bedrock and Google Cloud, and local agents including GitHub Copilot CLI and Claude Code.

Agent 365 extends three Microsoft security products to agents, as described in the following list:

• Microsoft Entra provides agent identities, Conditional Access for agents, identity governance with sponsors, and network controls for agent traffic. Microsoft Entra Agent ID is available to all Entra customers, and non-Microsoft agent platforms can onboard through the Entra ID Auth SDK sidecar or workload identity federation. Extending Entra security features to agents requires Agent 365.
• Microsoft Purview applies data security posture management, sensitivity labels, DLP, insider risk management, auditing, retention, and eDiscovery to agent interactions. For third-party AI sites such as ChatGPT, Google Gemini, and DeepSeek, most Purview capabilities require the Purview browser extension and onboarded devices, and Purview requires pay-as-you-go billing.
• Microsoft Defender provides agent posture management, threat detection, and real-time protection. Real-time protection evaluates Agent 365 tool invocations through Work IQ MCP before they run, and covers Copilot Studio agents and Foundry agents in preview. Microsoft's documentation states that agents that don't integrate with Work IQ MCP aren't covered by the Agent 365 tool-invocation path. Custom rules block selected detection types, such as secret exfiltration and malicious content propagation, for agents with a Microsoft Entra agent ID.

For local coding agents, Defender for Endpoint AI agent runtime protection is in preview. Defender for Endpoint uses vendor hooks in Claude Code, Codex CLI, GitHub Copilot CLI, and the GitHub Copilot app to inspect the prompt, the tool call before it runs, and the tool response, and it detects prompt injection and high-risk agent activity.

Defender for Endpoint runtime protection requires Windows devices onboarded to Defender for Endpoint with Microsoft Defender Antivirus in active mode, and a Defender for Endpoint Plan 2, Microsoft 365 E5, Agent 365, or Microsoft 365 E7 license. You choose Disabled, Audit, or Block for each device group. Local agent discovery covers a wider list, including Cursor, on Windows and macOS (macOS in preview).

Agent 365 costs $15 per user per month, or comes included in Microsoft 365 E7 at a list price of $99 per user per month. Enterprise customers need Microsoft 365 E5, or Microsoft 365 E3 plus both Defender Suite and Purview Suite, as a prerequisite. Microsoft licenses the people who manage, sponsor, or delegate access to agents, not the agents themselves.

What is Arcjet?

Arcjet is an AI agent runtime security platform that discovers the agents running in your organization, enforces policy on every action, prompt, and tool call, and keeps the evidence of what happened. Arcjet decides in the path of the action rather than on the network or the device.

For coding agents, Arcjet enforces policy on Claude Code, GitHub Copilot, Cursor, and OpenAI Codex through the hooks each agent already fires, with no SDK and no code change. One Arcjet policy applies across all four agents, and you choose when the policy runs: Tool call, Prompt, or Model switch. Evaluation runs at the edge in over 300 data centers, and a hook typically adds a few tens of milliseconds.

Arcjet has 12 starter policies for coding agents, covering destructive commands, history rewrites, protected paths, credential access, piped installers, MCP allowlists, egress allowlists, destination threats, model allowlists, sensitive information, prompt injection, and npm publish. You install the hooks through managed settings or MDM on macOS, Linux, and Windows, so developers can't remove them without admin access.

For custom agents, the Arcjet JavaScript, TypeScript, Python, and Go SDKs call guard() on tool calls, queue consumers, MCP handlers, and other actions that have no HTTP request, and protect() on HTTP routes. Framework integrations include Microsoft Agent Framework for Go, the Claude Agent SDK, LangChain, LangGraph, OpenAI Agents, and the Vercel AI SDK. You write Guard policies in Rego or a builder, or generate one from an English description, dry run it before it goes live, and publish it from the Arcjet Console or MCP server. Changes take effect in real time.

Arcjet detectors include prompt injection, sensitive information with an SDK-local option that keeps the raw body in your process, destination threat analysis, token budgets, and rate limits. The same SDK covers bot detection, Shield WAF, and email validation for your web application.

The Arcjet Console records every decision and session. SIEM export to Datadog, Splunk, SentinelOne, Panther, and Amazon S3 is available on the Enterprise plan, so Arcjet decisions can reach the same security operations workflow as your Defender alerts through one of those destinations.

How do Microsoft Agent 365 and Arcjet differ?

Microsoft Agent 365 and Arcjet differ in four ways: which agents each governs, how each decides on a coding-agent tool call, where each enforces for custom agents, and how each is licensed. The following sections cover each difference for a Microsoft organization.

What Microsoft covers that Arcjet doesn't

Agent 365 governs Microsoft's own agents: Microsoft 365 Copilot, Copilot Studio, Foundry, and agents with an Entra agent ID. Agent 365 applies Entra identity and Conditional Access, Purview labels and DLP, and Defender detections to those agents, and Defender can block Copilot Studio tool invocations in preview.

Arcjet doesn't enforce inside Copilot Studio or Microsoft 365 Copilot, and Arcjet doesn't provide agent identities, sensitivity labels, eDiscovery, or an endpoint agent. If Microsoft agents are your main risk, Agent 365 is the product built for them.

Coding agents: authored policy compared with detection modes

Microsoft covers more than Copilot. Defender for Endpoint runtime protection inspects Claude Code, Codex CLI, and GitHub Copilot hooks for prompt injection and high-risk activity, in preview, on Windows devices running Defender Antivirus in active mode. You set a mode for each device group; the documentation doesn't describe rules over specific commands, paths, or destinations.

Arcjet enforces the policy you write. An Arcjet rule can deny git push --force to main, a write under .github/workflows/, a read of ~/.aws/credentials, a curl | sh installer, an MCP server that isn't on your allowlist, or a request to a host that Arcjet threat intelligence scores as malicious. A denial names the rule ID, the policy, and the decision, so you can trace a blocked command.

The same Arcjet policy applies to Cursor, which Defender discovers but whose runtime protection list doesn't include, and to the GitHub Copilot cloud agent, which loads its hooks from the repository rather than from a managed Windows device. For more information, see how to secure AI coding agents.

Custom agents: in-code enforcement at the tool call

For agents built on other platforms, Microsoft documents Entra Agent ID for identity, the Agent 365 SDK for observability, and real-time blocking for tools reached through Work IQ MCP and for Foundry agents in preview. Entra's network-level prompt injection protection requires TLS inspection and the Global Secure Access client on Windows, and it truncates prompts longer than 64,000 characters.

Arcjet puts the check inside the function that performs the side effect. An Arcjet policy can read the tool arguments, the user, the tenant, and the plan, and it decides before a refund, a deletion, or an email goes out. Arcjet works wherever your code runs, including work with no HTTP request, such as a queue consumer. For more information, see the Microsoft Agent Framework security guide and secure AI agents in production.

Licensing and cost

Agent 365 is licensed per user at $15 per month on top of a Microsoft 365 E5-level base, or through Microsoft 365 E7 at $99 per user per month. Purview coverage of third-party AI sites uses pay-as-you-go billing.

Arcjet is usage-based: plans start at $25 per month, with $50 per million agent requests and $5 per million web requests, and a 15-day trial. For a team that wants to govern Claude Code, Cursor, or Codex for its developers, Arcjet doesn't require moving the whole organization to an E5 or E7 license.

Who is Microsoft Agent 365 for?

Microsoft Agent 365 is for organizations whose agents run mostly on Microsoft platforms and whose security team works in Entra, Purview, and Defender. Agent 365 fits when any of the following apply:

• Your agents are mostly Microsoft 365 Copilot, Copilot Studio, and Foundry agents.
• You want agent identities, Conditional Access, and lifecycle governance in Microsoft Entra.
• You need Purview sensitivity labels, DLP, retention, and eDiscovery applied to agent interactions.
• Your security operations team works in Defender and wants agent alerts there.
• You already hold Microsoft 365 E5 or E7 licenses for the people who use or sponsor agents.

Who is Arcjet for?

Arcjet is for teams that build custom agents or run non-Microsoft coding agents and want policies they write, enforced before each action. Arcjet fits when any of the following apply:

• Your developers use Claude Code, Cursor, Codex, or GitHub Copilot, and you want policies you write, decided before the tool call runs.
• You build custom agents, including on Microsoft Agent Framework for Go, and want enforcement at the tool call with application context.
• You need coverage for macOS and Linux developer machines, or for the GitHub Copilot cloud agent, without an endpoint agent.
• You want bots, rate limiting, and WAF for the application that hosts your agent.
• You want usage-based pricing that doesn't depend on per-user Microsoft licenses.

Can you use Microsoft Agent 365 and Arcjet together?

Yes. If you run both Microsoft and non-Microsoft agents, use both products. Keep Agent 365 for Microsoft 365 Copilot, Copilot Studio, Foundry, agent identity, and Purview data controls, which Arcjet doesn't enforce inside. Use Arcjet for custom agents in your own code and for policy on Claude Code, GitHub Copilot, Cursor, and Codex.

If you enable Defender for Endpoint runtime protection on the same Windows devices, both products receive the same hook events, so test that a denial from either one stops the action. You can deploy Arcjet's managed hook settings with the MDM you already use, and send Arcjet decisions to your SIEM on the Enterprise plan.

What are the alternatives to Microsoft Agent 365?

The alternatives to Microsoft Agent 365, or products to run beside it, split between in-path enforcement and agent security platforms with posture and detection. The following products cover overlapping ground:

• Arcjet: in-path enforcement for custom agents in code and for Claude Code, GitHub Copilot, Cursor, and Codex through their hooks, plus web application security in the same SDK.
• Noma Security: posture management, access control, detection and response, and red teaming, with coverage of Copilot Studio and Agentforce. For more information, see Arcjet vs Noma Security.
• Zenity: observability, posture management, runtime enforcement, and threat detection for agents across SaaS, cloud, and endpoint deployments.
• Lasso Security: discovery, posture, red teaming, and runtime enforcement at a proxy, API, or AI gateway layer, plus a browser extension for employee chatbot use. For more information, see Arcjet vs Lasso Security.

For a wider map of the category, see AI agent security platforms.