Microsoft Ignite opens on 17 November, and its security news will be about AI agents, because the whole industry’s news has been about little else for six months. Here is what is confirmed about Agent 365, what “Citadel” actually is, and how Microsoft compares with its rivals’ buying spree.
Updated 24 October 2026. We will revise this after the 17 November keynote. This is a preview, not a hands-on review: Cyber-Threat.net has not tested any of the products mentioned.
When, where and who
Ignite 2026 runs from 17 to 20 November at the Moscone Center in San Francisco, or online for anyone avoiding San Francisco hotel prices. According to Microsoft’s security guide (30 September 2026), a Security Pre-Day runs on Monday 16 November. Satya Nadella and Judson Althoff give the keynote, which has a security segment, on Tuesday 17 November, 10am to noon PT (6pm to 8pm UK time).
Session titles are the nearest thing to a table of contents for an unseen keynote:
- “Inside look: Microsoft Security as customer zero for Agent 365”
- “Local agents are here. Can you find and secure them?”
- “The Alert Is Dead. The Blueprint for the Agentic SOC”
- “A Single Policy for Humans and AI Agents? Here’s How to Make It Work“
The direction of travel is not subtle.
Agent 365: what is already fact
Microsoft announced Agent 365 at Ignite 2025 (18 November 2025) as “the control plane for AI agents”, built around an Entra registry of every agent in the tenant. By March it counted “tens of millions of agents” in the registry.
Agent 365 became generally available on 1 May 2026. Agents with their own credentials went GA (team-workflow agents stayed in preview). It added Defender and Intune discovery of local and cloud agents, starting with OpenClaw for Frontier programme customers, and Windows 365 for Agents as a US-only public preview. Entra network controls were extended to Copilot Studio agents and local agents such as OpenClaw.
On price, Microsoft’s licensing FAQ says Agent 365 costs $15 per user per month on its own, or comes in Microsoft 365 E7 at $99. It is licensed per user, not per agent, and is not in E3 or E5. The FAQ also says every Microsoft Cloud subscription gets some foundational Agent 365 capabilities at no extra cost: agent identity, inventory visibility, basic usage insights and core admin governance actions. Governance policies, posture management, threat detection and data security need the paid licence. There are no consumption charges “yet”. That last word is doing a good deal of work.
The trailer: what Microsoft showed on 19 October
On 19 October Nadim Abdo, CVP for Identity and Network Access, published “Agents are your newest insiders. Security must move at their speed.”, which ends “join us at Microsoft Ignite”. It introduces:
- Guardian Agents and Playbooks for Project Perception (see AI in the hunt, part 1), sharing a registry with Agent 365.
- Discovery of 60 local agent types, up 35, including Claude Code, OpenAI Codex and GitHub Copilot.
- New Entra Agent ID types for local and unknown agents.
- Dynamic Permissions, Dynamic Agent Risk and Dynamic Conditional Access for agents. These use chain-of-thought signals, with the Microsoft Execution Container (MXC) as a sandbox.
The post quotes Nadella: “The most trustworthy agentic system will not be the one with the model we trust most. It will be the one designed that enables us to trust the model least.” It does not say what is in preview, what is GA or what anything costs. Ignite will most likely fill that gap.
So what is “Citadel”?
Readers have asked whether Microsoft will announce something called “Citadel” at Ignite. We found no Microsoft announcement, press report or published Ignite session that says so, so treat it as unconfirmed. The name itself is real, though, and it does connect to Agent 365.
The AI Citadel Blueprint, originally the Foundry Citadel Platform, is an open-source reference architecture from Microsoft’s Global Black Belt team, not a licensable product. It lives in the Azure-Samples/foundry-citadel-platform repository, which candidly calls itself “not a one-size-fits-all solution”. It has four layers:
- Layer 1, Governance Hub: an Azure API Management gateway in front of every model, built as the AI Hub Gateway solution accelerator, which includes “Citadel Access Contracts” and routes to Azure OpenAI, Microsoft Foundry, Amazon Bedrock and other OpenAI-compatible providers. (Wiggers’ review of the citadel-v1 branch also lists Gemini and Claude.)
- Layer 2, Agent Operations: Microsoft Foundry, Agent Service and the Foundry Control Plane, running on Container Apps or AKS.
- Layer 3, Agent Management: Agent 365 and Entra Agent ID.
- Layer 4, Security Foundation: Defender, Purview and Entra.
Microsoft’s Agent Governance Toolkit documentation calls Citadel “Microsoft’s layered architecture for AI governance”. Toolkit identity work and Microsoft Learning’s governance labs build on it. A “Citadel Blueprint V2” update was merged on 12 October, five weeks before Ignite.
The name is crowded. Partner appCURE will launch “appCURE Citadel” (application management) at Ignite on 17 November. Azure Citadel is a long-running Azure learning site. Three Citadels is how rumours cross wires.
Our reading (speculation): the likeliest Citadel story at Ignite is more prominence for the blueprint as Microsoft’s recommended wiring diagram. A product or SKU has no public evidence behind it. We would be glad to be proved wrong on 17 November; it beats being proved wrong by a press release on a Friday afternoon.
Meanwhile, everyone else went shopping
Microsoft builds; most of its rivals buy, mainly agent identity, non-human identity (NHI) and agent runtime protection.
| Date (2026) | Vendor | Move | What it adds |
|---|---|---|---|
| 21 Oct | SentinelOne | Singularity Agentic Detection and Response (early access) | Agent and MCP inventory; runtime detection and response |
| 22 Sep | Okta and 11 others | Blueprint Alliance | A shared multi-vendor agent security architecture |
| 3 Sep | Cyera | Completed Oasis Security acquisition, valued at $1bn | NHI and agentic access management, now Cyera Identity |
| 1 Sep | CrowdStrike | Falcon Guardian | Endpoint runtime security for agents (GA); AI Gateway GA planned for Q4 |
| 30 Jul | Okta | Agreed to acquire Permiso (closed 26 Aug) | Identity threat detection for humans, machines and agents |
| 21 May / 9 Jun | Zscaler | Intent to acquire Symmetry Systems, then AI Broker and Endpoint AI Security | Access graph; MCP and A2A brokering with an agent registry |
| 4 May | Cisco | Intent to acquire Astrix Security (closed 29 Jun) | NHI discovery and governance for Duo |
Fortinet (Virtue AI, 17 August), Check Point (Deepchecks’ team and IP, 19 May) and Cisco again (WideField, 18 June) made smaller moves, after two larger deals: Palo Alto Networks closed CyberArk on 11 February, and Google completed its $32bn Wiz deal on 11 March.
The Blueprint Alliance’s 12 founding members include AWS, Google Cloud, CrowdStrike, Wiz and Zscaler. Microsoft is not among them, nor are Palo Alto Networks or Cisco. The alliance’s architecture and Citadel may become rival maps of the same ground.
Head to head: who owns which piece of the agent stack
| Capability | Microsoft (GA or announced) | Nearest rival offerings |
|---|---|---|
| Agent registry | Agent 365 Registry (GA); registry shared with Perception (announced 19 Oct, availability not stated) | Zscaler AI Broker registry; SentinelOne ADR inventory; Okta for AI Agents |
| Agent identity | Entra Agent ID (agent identity is in the free foundational tier); local and unknown agent types (announced 19 Oct) | Okta plus Permiso; Cisco Duo plus Astrix; Cyera Identity |
| Local agent runtime | Defender and Intune discovery (GA); 60 agent types and MXC sandbox (announced 19 Oct) | CrowdStrike Falcon Guardian; SentinelOne ADR; Zscaler Endpoint AI Security |
| Model and tool gateway | APIM AI gateway (Citadel Layer 1, a reference architecture) | CrowdStrike AI Gateway (GA planned for Q4); Zscaler AI Broker |
| Price signal | Free foundational tier; premium $15 per user per month, or in E7 | Mostly undisclosed |
Microsoft owns the identity provider, the endpoint and the suite where agents live; rivals sell neutrality. Independent lab results and peer-review scores for agent security don’t exist yet; the category is younger than most of the conference badges printed for it.
Scorecard: what’s confirmed, and what we expect
| Claim | Status | Basis |
|---|---|---|
| Ignite runs 17 to 20 November at Moscone Center, San Francisco | Confirmed | Moscone Center |
| Agent 365 GA, free foundational tier, $15 premium | Confirmed | Licensing FAQ |
| Dynamic Conditional Access and related agent features | Announced; availability not stated | Microsoft, 19 Oct |
| Citadel exists, with Agent 365 as Layer 3 | Confirmed, as a reference architecture | GitHub |
| Microsoft will announce Citadel at Ignite | Unconfirmed; no public source | None found as of 24 Oct |
| Preview or GA dates for the 19 October features | Expected: likely | Session titles on local agents and single policy |
| An agentic SOC announcement | Expected: plausible | “The Alert Is Dead” session |
| Citadel promoted as Microsoft’s recommended architecture | Expected: plausible | V2 merged 12 Oct |
| Agent 365 packaging changes, such as moving more paid features into the free foundational tier, or consumption charges | Possible, no evidence | Speculation |
| Citadel becomes a paid product, or Microsoft buys an agent or NHI security firm | Possible, no evidence | Speculation |
The bottom line
For 2027 budgets, the facts are enough to plan around. Every Microsoft Cloud tenant already has the basic Agent 365 registry and agent identity at no extra cost, so start by seeing what is in yours. The premium tier is priced, and Citadel is a free blueprint on GitHub today. Buying a third-party agent security tool now? The honest answer is to wait for Ignite. The rivals’ products will still be there the week after, and so will their sales teams.