The Agent Control Plane

The control plane that arrived with Microsoft 365 E7: an identity per agent, Conditional Access on it, templates applied in bulk, runtime protection, and Purview policies that name agent instances.

In GCC High

Every row below is a documented claim until a tenant check turns it into an observation. The basis column says which, and when.

Control	GCC High	Basis
Agent 365 (Microsoft 365 E7 or G7, or the stand-alone subscription)	Not available No GCC High column; FedRAMP High authorization pending as of October 1, 2026; a GCC High variant of G7 is announced for later in 2026 (press).	Documented 2026-10-08
Conditional Access and identity protection for agent identities	Not checked Tenant check: whether the policy picker reads Users, agents or workload identities.	No basis recorded
Defender real-time protection for agents	Not available No GCC High column.	Documented 2026-10-08

#	Where to look	Microsoft documents	If the tenant disagrees
4	Microsoft 365 admin center, Agents, Settings: which of User access, Sharing, Agent and plugin access, Agent management rules, and Security templates appear	User access, Sharing, and management rules ship with Microsoft 365; policy templates and the Apply a template rule are Agent 365 features, and Agent 365 has no GCC High column	Templates present: Agent 365 governance exists in GCC High.
5	Entra admin center (GCC High), Conditional Access, Policies, New policy, Assignments: whether the picker reads Users, agents or workload identities and offers Agents with All agent identities; under Conditions, an Agent risk entry	Conditional Access for agent identities requires Agent 365 or Microsoft 365 E7; Agent 365 has no GCC High column	Entra agent identities and Conditional Access for agents exist in GCC High.