# Agents deployed to Microsoft 365 Copilot are discoverable in the Agent Registry
The Microsoft 365 Agent Registry is the tenant-scoped catalogue that lists every declarative agent, connected agent, and custom Copilot extension that has…
Source: https://maester.dev/docs/tests/ZTA.61005
## Overview
The Microsoft 365 Agent Registry is the tenant-scoped catalogue that lists every declarative agent, connected agent, and custom Copilot extension that has been published to users in the tenant. Its role is to provide the central answer to two questions that security teams must be able to answer at any moment: "which agents are operating inside our Microsoft 365 environment" and "who are they available to". Without a populated Agent Registry view, those questions cannot be answered consistently — agent deployments proliferate through individual authoring and sideloading paths, each with its own audit signal, and no single surface enumerates them. Threat actors exploit this inventory gap by publishing agents that impersonate legitimate productivity tools, by distributing agents to broad audiences when only a narrow scope was approved, and by relying on the visibility asymmetry to keep malicious or retired agents running long after they should have been removed. Confirming that the Agent Registry returns results — and, in follow-up specs, that those results match the organisation's approved inventory — is the baseline control that makes every downstream agent-governance check possible.
## Remediation
1. [Manage agents for Microsoft 365 Copilot](https://learn.microsoft.com/microsoft-365-copilot/extensibility/agent-registry)
2. [Publish and deploy an agent](https://learn.microsoft.com/microsoft-365-copilot/extensibility/build-agent)
3. [Governance of agents in Microsoft 365 Copilot](https://learn.microsoft.com/microsoft-365-copilot/extensibility/governance)
## Run it
The check runs as part of the whole assessment, with the ZeroTrustAssessment module installed:
```powershell
Install-Module ZeroTrustAssessment -Scope CurrentUser
Connect-Maester
Invoke-Maester -Pack ZTA -SkipBuiltIn
```
Leave out `-SkipBuiltIn` to run Maester's own checks in the same run.
About this check
| | |
| --- | --- |
| Severity | High |
| Effort to fix | Low |
| Impact on users | Low |
| Pillar | AI |
| Category | AI Inventory & Lifecycle |
| Product | [Microsoft 365](/docs/tests/products/microsoft-365) |
| Feature | Organization settings |
| Area | AI and agents |
| Licence | Microsoft_365_Copilot, AGENT_365 |
| Tenant | Workforce |
Product, feature, area and ATT&CK are Maester's: the assessment does not record them, so Maester keeps them in the pack's `taxonomy.json`.