Micorsoft Agent 365

Question

Micorsoft Agent 365

testuser7 286

As we all know the trio i.e., (agentBlueprint - agentBlueprintSPN - agentID) This are core security artifacts and no confusion around it.

Now one more object i.e., agentInstance has been introduced with the Agent 365 architecture.

It has different graph OData type from the AgentID

As you showed in the session, there could be several agentInstances for a single agentID

In fact, a single end-user can have multiple agentInstances

So when I onboard agent on Teams, I get one unique agentInstance

Later on when I onboard agent on Word, I get another unique agentInstance

So agentInstance is not created when A365-admin onboards the agent in the portal. That time only agentBlueprintSPN - agentID are created.

Am I right ?

Just would like to know where and how exactly agentInstance come into existence during the creation and deployment of an agent ??

Appreciate you help !!!

0 comments

2 answers

Your answer

Answer 1

agentInstance comes into existence when an instance is requested and created from an agent blueprint, not when the blueprint itself is first registered.

Supported model from the documentation:

The core identity model is centered on:
- agent identity blueprint
- agent identity
- optional agent's user account
In Agent 365, an agent instance is the operational instance created from an agent template/blueprint and surfaced in Microsoft 365.
For AI teammate agents, the Microsoft 365 admin center shows an Instances tab, and each instance has its own:
- Microsoft Entra-backed agent identity
- license
- mailbox
- OneDrive
- Teams presence

What this means for creation timing:

Blueprint registration/onboarding
- Bringing an agent into Agent 365 registers an agent identity blueprint in Microsoft Entra.
- Agent identities are then created from that blueprint.
- This is the identity foundation, but it is not the same step as creating an end-user-facing agent instance.
Instance creation
- An agent instance is created when someone requests an instance of the agent blueprint.
- The documented flow says: request the instance from Teams, the request goes to the tenant admin for approval, and after approval Teams creates the agent instance and makes it available in Teams.

So the statement is essentially correct in the documented Agent 365 flow:

Admin onboarding/registration establishes the blueprint/identity side.
The agent instance is created later, when an instance request is approved and provisioned.

What is directly supported about multiplicity:

One blueprint can create many agent identities.
In the Microsoft 365 admin center, AI teammate agents are described as templates from which the organization can create one or more agent instances.

What is not established by the provided documentation:

A confirmed one-to-many mapping of several agentInstances for a single agentID.
A documented statement that onboarding in Teams creates one instance and onboarding in Word creates another separate instance.
A precise lifecycle event sequence for agentBlueprintSPN -> agentID -> agentInstance using those exact object names.

Based on the available documentation, the safest supported conclusion is:

agentInstance is created during the instance request and approval flow, after the blueprint exists.
For AI teammate agents, that instance is then represented as its own manageable object in Microsoft 365 admin center, with its own Entra-backed identity and Microsoft 365 resources.

Answer 2

Sayali-MSFT 6,476 Microsoft External Staff Moderator

Hello testuser7,
The agentBlueprint, agentBlueprintSPN, and agentID belong to the core identity/security model. On the other hand, agentInstance is a separate object in the Agent Registry and represents a specific deployed or registered instance of an agent.

So, conceptually, it is possible to have multiple agentInstances associated with a single agentID. For example, if the same agent is deployed across different experiences such as Teams and Word, those deployments may have separate agentInstance records while still being associated with the same underlying agent identity.

That said, the exact lifecycle of agentInstance creation is the part that is not fully clear from the currently available public documentation. We should not assume that an agentInstance is created specifically at the time an agent is onboarded to Teams or Word.

Reference Document: -

testuser7 286 Reputation points

2026-08-28T14:56:13.97+00:00

Thanks @Sayali-MSFT

you clarified the first part very nicely. So it is possible to have multiple agentInstances associated with a single agentID. When I deploy the same agent on Teams and Word.

So is it correct to say that this concept of agentInstance is only for those agents which are configured and published with --aiteammate flag through Agent-CLI ??
testuser7 286 Reputation points

2026-09-03T12:17:56.1666667+00:00

@Sayali-MSFT Any update ??
Sayali-MSFT 6,476 Reputation points Microsoft External Staff Moderator

2026-09-11T10:58:45.7966667+00:00

Hello testuser7 •
Not exactly. agentInstance is not limited only to agents configured using the --aiteammate flag.

The --aiteammate flag specifically configures the blueprint for the AI teammate scenario, whereas agentInstance is a broader Agent 365 concept representing an instantiated/deployed agent based on an agent blueprint.

For example, Microsoft documents an instance-creation flow where an agent instance is requested through Teams and created after admin approval. Therefore, I wouldn't use --aiteammate as the boundary for determining whether an agentInstance can exist.

Also, I would be cautious about assuming that deploying the same agent to Teams and Word automatically creates two separate agentInstance objects unless Microsoft explicitly documents that host-to-instance mapping.
Reference Document:
1.https://learn.microsoft.com/en-us/microsoft-agent-365/developer/registration
2.https://learn.microsoft.com/en-us/microsoft-agent-365/developer/reference/cli/setup
3.https://learn.microsoft.com/en-us/graph/api/agentregistry-post-agentinstances?view=graph-rest-beta&tabs=http
4.https://learn.microsoft.com/en-us/microsoft-agent-365/developer/create-instance
testuser7 286 Reputation points

2026-09-11T14:51:38.3666667+00:00

Thanks @Sayali-MSFT for clarifying this imp architectural point. So as you said, "Agent-instance" object is not dependent on how agent was created i.e., with --aiteammate or without this flag.

So let me clarify one point right off the bat i.e., the cardinality. We very well understand authentication trio i.e., (agentBlueprint - agentBlueprintSPN - agentID)

For one agentBlueprint there could be multiple agentID

But every Agent-Instance (for eg., requested through Teams and created after admin approval) will have it's own agentID. So in other words, the relationship between agentID and agentInstance is 1:1

And secondly, as you said, agent-instance spawn on MS-teams will be usable on MS-words. There is no separate agent-instance created. Right ?